Feeds

Facebook bug leaks contact info of 6 million users

But to each other, oddly enough – not the NSA

Internet Security Threat Report 2014

Facebook's Download Your Information (DYI) tool has occasionally been criticized for not offering enough transparency into user-account data, but it recently revealed more than it intended when a bug led it to leak the contact information of some six million users.

In an advisory posted on Friday, Facebook's security team explained that the code the social network uses to make friend recommendations inadvertently caused the email addresses and phone numbers of potential contacts to be associated with other users' account data.

If those users then used the DYI tool, the wrongly added contact information would be included in the download, whether or not the users were actually friends with the owners of the addresses or numbers in question.

"After review and confirmation of the bug by our security team, we immediately disabled the DYI tool to fix the problem and were able to turn the tool back on the next day once we were satisfied that the problem had been fixed," Facebook's White Hat staff wrote.

In all, the security team has concluded that the addresses or phone numbers of around six million Facebook users were leaked in this way – a figure equivalent to about 0.54 per cent of the social network's global user base.

Zuck's security bods have determined that each individual email address or phone number was typically only included in a download once or twice, meaning it was only leaked to one person. In addition, Facebook assures us that only other people could have had access to the data – as opposed to developers or advertisers – and no other financial or personal information was disclosed.

The bug was first brought to Facebook's attention by an independent security researcher, whom the social site's security staff say has already been paid a bug bounty for his efforts. In addition, Facebook has notified its regulators in the US, Canada, and Europe of the incident and is in the process of notifying affected users via email.

Equally important, although the social network has downplayed the severity of the leak and it doubts that the bug was ever exploited for malicious purposes, it's still really, really, really sorry about the whole thing.

"It's still something we're upset and embarrassed by, and we'll work doubly hard to make sure nothing like this happens again," the White Hat team wrote. "Your trust is the most important asset we have, and we are committed to improving our safety procedures and keeping your information safe and secure." ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.