Feeds

Facebook 'cloaking' flaw allows unexpected snooping

Eggheads label flaw a 'zero-day privacy loophole'

Build a business case: developing custom apps

University College London research student Shah Mahmood and Chair of Information Communication Technology Yvo Desmedt have told a conference of what they call a “zero day privacy loophole” in Facebook.

Details of the loophole, which the pair name “Deactivated Friend Attack” was presented at the IEEE International Workshop on Security and Social Networking SESOC 2012 in Lugano, Switzerland on March 19th.

The pair say the attack works like this:

“Our deactivated friend attack occurs when an attacker adds their victim on Facebook and then deactivates her own account. As deactivation is temporary in Facebook, the attacker can reactivate her account as she pleases and repeat the process of activating and deactivating for unlimited number of times. While a friend is deactivated on Facebook, she becomes invisible. She could not be unfriended (removed from friend’s list) or added to any specific list.”

Complicating mattters is the fact that, the pair say, Facebook users aren't told when friends de-activate or re-activate accounts.

That means trouble if the account is re-activated, as the newly-re-activated friend regains access to anything their connections have posted. Once they've rummaged around, they can de-activate the account again and their friends will almost certainly not know what has happened or that they've shared information.

The pair label this behaviour “cloaking” and cannot resist explaining it with a Star Trek metaphor, writing “Badass Blink or Jem’Hadar has to uncloak (be visible), even if only for a moment, to open fire.”

The extended abstract of the talk asserts cloaking is a problem because many Facebook users aren't very discriminating about whom they befriend on the service. Some could therefore Friend members whose only intention is to “cloak” their accounts and then “... activate her account at the moment least likely to be detected and crawl her victims profile for information, keeping an updated record."

That's bad because, the pair say, "Various groups of information aggregators including marketers, background checking agencies, governments, hackers, spammers, stalkers and criminals would find this attractive as a permanent back door to the private information of a Facebook user.”

The user would never know of that information-gathering effort, unless they happened to be paying attention to the temporarily uncloaked account.

To prove the approach works, the pair say the conducted a lengthy experiment in which a dummy account acquired many friends and conducted frequent cloaking and uncloaking without attracting much attention.

The fix, the pair say, is for Facebook to notify users of de-activations and re-activations, so that odd behaviour can be spotted. Flagging of accounts that cloak is another option, as is removing re-activation features altogether. ®.

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Know what Ferguson city needs right now? It's not Anonymous doxing random people
U-turn on vow to identify killer cop after fingering wrong bloke
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.