Brace Yourselves. Facebook has a New Mega-Leak on its Hands
upstart writes in with an IRC submission:
Brace yourselves. Facebook has a new mega-leak on its hands:
Still smarting from last month's dump of phone numbers belonging to 500 million Facebook users, the social media giant has a new privacy crisis to contend with: a tool that, on a mass scale, links the Facebook accounts associated with email addresses, even when users choose settings to keep them from being public.
A video circulating on Tuesday showed a researcher demonstrating a tool named Facebook Email Search v1.0, which he said could link Facebook accounts to as many as 5 million email addresses per day. The researcher-who said he went public after Facebook said it didn't think the weakness he found was "important" enough to be fixed-fed the tool a list of 65,000 email addresses and watched what happened next.
"As you can see from the output log here, I'm getting a significant amount of results from them," the researcher said as the video showed the tool crunching the address list. "I've spent maybe $10 to buy 200-odd Facebook accounts. And within three minutes, I have managed to do this for 6,000 [email] accounts."
Ars obtained the video on condition the video not be shared. A full audio transcript appears at the end of this post.
In a statement, Facebook said: "It appears that we erroneously closed out this bug bounty report before routing to the appropriate team. We appreciate the researcher sharing the information and are taking initial actions to mitigate this issue while we follow up to better understand their findings."
A Facebook representative didn't respond to a question asking if the company told the researcher it didn't consider the vulnerability important enough to warrant a fix. The representative said Facebook engineers believe they have mitigated the leak by disabling the technique shown in the video.
Read more of this story at SoylentNews.