A Facebook bug exposed Instagram users’ personal email addresses and birthdays
Illustration by Alex Castro / The Verge When signing up for an Instagram account, the service promises that your email and birthday won't be publicly visible. A bug discovered by security researcher Saugat Pokharel, however, made it so that an attacker could easily get that private information. The bug, which was patched after being reported to Facebook, was exploitable by business accounts that were given access to an experimental feature the company was testing.
The attack worked on private accounts, and ones that don't accept public DMs
The attack used Facebook's Business Suite tool, available to any Facebook business account. The experimental upgrade meant that if a Facebook business account was linked to Instagram and was included in the test group, the Business Suite...