Tuesday, 18 December, 2018

Facebook bug allowed other sites to view users' likes and interests

Facebook flaw opened your profile to data thieves Facebook bug allowed other sites to view users' likes and interests
Roberta Sherman | 15 November, 2018, 20:59

That element, along with the fact that Facebook's search page is effectively an endpoint that expects a GET request (a method of retrieve information from a server in response to a specific query) with search parameters in order to serve up results is not protected against cross-site request forgery, allowed Masas to come up with a data extracting hack.

"We appreciate this researcher's report to our bug bounty program", Facebook said in a statement, adding that "We've fixed the issue in our search page and haven't seen any abuse". This means any website could easily access some of your data from your logged-in Facebook profile.

Furthermore, the attack also doesn't need to open individual tabs for each search query, allowing the attacker to reload the existing tab with a new search URL at short intervals.

Facebook is not the only company which has faced this type of issue and it seems no one took advantage of this particular vulnerability.

Scientists said if the social network for health
Those are questions she still hopes to answer, including in an upcoming study about the use of dating apps by college students. These effects were more prominently observed among the students who came into the study already having depression.

Fortunately, there are no cases of the bug being implemented and Facebook patched it before the details were made public.

Security firm Imperva found a bug in May that allowed websites to read Facebook users and their friends' private information.

Warning that the technique could increase in popularity throughout 2019, Masas added, "Bugs are usually found to circumvent authentication bypasses to gain access to personal information, but this bug enables attackers to exploit Facebook's use of iframes to leak the user's personal information".

Discovered by Ron Masas, security researcher at Imperva Inc.

LeBron gets 44, passes Wilt in LA's 126-117 win over Blazers
At James' current points per game this season, the four-time MVP would pass Jordan in 33 games on January 19 against the Rockets. Oh, some guy named Michael Jordan, who he should pass later this season.

Masas warned that though a CSRF attack is not a common technique, it could rise in popularity next year. The vulnerability was tied to Facebook on Google's Chrome browser, which accounts for more than 60 percent of browsers used online. Interestingly, the vulnerability exposed the user and their friends' interests, even if their privacy settings were set so that interests were only visible to the user's friends.

From there, an attacker could basically infer a target and their Facebook friends' private data, such as finding posts with certain text or seeing if they have photos taken at a specific location.

A Facebook spokesman explained the company's reaction to the bug. An error was identified in may, then they reported it to management Facebook.

Michelle Obama sobbed for 30 minutes after departing from Trump inauguration
Becoming describes Obama's upbringing on Chicago's South Side and her transition to college at Princeton University. She wrote: "I'll say it here directly: I have no intention of running for office, ever".

Recommended

  • Surge in electricity needs to require flexible power systems - IEA

    Surge in electricity needs to require flexible power systems - IEA

    Carbon emissions have grown in the past two decades and coal-fired plants were the biggest contributors, according to the IEA. By 2025, the USA could account for around half the growth in oil and natural gas over the next six years.
    Raj scores fifty as India post facile win over Pakistan

    Raj scores fifty as India post facile win over Pakistan

    Haf-centurions Nida Dar and Bismah Maroof were initially warned by the umpires after the 13th over for running on the danger area. Earlier, Indian bowlers pinned Pakistan down for most part of their innings before allowing them to wriggle out for 133 for 7.
    Canada engaging with Pakistan for Asia Bibi's asylum: PM Justin Trudeau

    Canada engaging with Pakistan for Asia Bibi's asylum: PM Justin Trudeau

    Her husband, Ashiq Masih, has said the family is in great danger in Pakistan and has pleaded for asylum in the UK, US or Canada . Islamists have threatened to stir up protest in Pakistan if Bibi is permitted to leave.
  • Pence says Myanmar's handling of Rohingya 'without excuse'

    Pence says Myanmar's handling of Rohingya 'without excuse'

    Earlier this week, dozens of Rohingya families on the list of refugees to be repatriated began fleeing camps in Bangladesh. Bangladesh's friends and donors should call on leaders in Dhaka to halt all attempts to return Rohingya refugees .
    John Lewis Christmas advert

    John Lewis Christmas advert

    It ends with a young Elton, four, running down the stairs on Christmas morning to unwrap his grandmother's gift of a piano. Earlier this year, reports speculated that John Lewis had paid Elton John £5m to feature in the Christmas ad.
    Federation Internationale de Football Association  investigating five Premier League clubs over youth transfers

    Federation Internationale de Football Association investigating five Premier League clubs over youth transfers

    Bertrand Traore's signing by the club is a part of the Federation Internationale de Football Association investigation as well. Barcelona were also fined £305,000 in 2014 for irregularities involving the transfer of 31 minors between 2005 and 2012.
  • Your Last Opportunity To Opt-Out Of My Health Record Is Here

    Your Last Opportunity To Opt-Out Of My Health Record Is Here

    People can access their data online at any time and can adjust how it may be viewed by health professionals and people they trust. There's also the potential for data breaches which could result in your records being used for god knows what.
    Cold ‘super-Earth’ exoplanet discovered orbiting nearby star

    Cold ‘super-Earth’ exoplanet discovered orbiting nearby star

    The new candidate planet, Barnard's Star b, is thought to have a mass between those of Earth and Neptune in the Solar system. And to look at it through a telescope, the star appears to be moving the fastest among the other stars in the night sky.
    Saudi Arabia seeks death penalty for five Khashoggi murder suspects

    Saudi Arabia seeks death penalty for five Khashoggi murder suspects

    The prosecutor's office also said it was awaiting Turkey's response to its request for evidence and sound recordings of the crime. Their cases have been referred to a court while investigations into another 10 people suspected of involvement continue.
  • Joe Cole announces retirement from professional football

    Joe Cole announces retirement from professional football

    He played at the 2002, 2006 and 2010 World Cups, making his final England appearance at the latter tournament in South Africa. Former England worldwide Joe Cole announced on Tuesday that he is retiring after over 20 years as a professional footballer.
    Yemen Rebels Mine Entrances to Hodeida Port

    Yemen Rebels Mine Entrances to Hodeida Port

    The move comes ahead of another proposed round of peace talks in Sweden later this month, Hunt s office said. More than 8 million are at risk of starvation in what has become the world's worst humanitarian disaster.
    Only One in Five Teens Meet Physical Fitness Guidelines

    Only One in Five Teens Meet Physical Fitness Guidelines

    This new guideline suggests a young child should be lightly, moderately, or vigorously active for at least 3 hours per day. In pregnant women, physical activity lowers the risk of postpartum depression.

Curran's brilliant fifty rescues England's innings Curran's brilliant fifty rescues England's innings However, the Sri Lanka pair of Silva and Akila Dananjaya simply sauntered to the opposite ends thinking they will get a boundary. Roshen Silva's assured 85 helped Sri Lanka secure a first-innings lead after England were bowled out for 290 on day one.

Couple who crowdfunded $400,000 for homeless man accused of scam Couple who crowdfunded $400,000 for homeless man accused of scam The couple also bought Bobbitt a camper with some of the funds and parked it on land McClure's family owns in New Jersey. Burlington County prosecutor Scott Coffina has scheduled a news conference for Thursday afternoon.

Monkey snatches baby as mum breastfeeds him Monkey snatches baby as mum breastfeeds him It left him on a neighbour's roof with bite injuries after being chased by locals. [He] was heavily bleeding and had no pulse. A 59-year-old woman died in the outskirts of Agra city after she was attacked by a group of monkeys, police said on Thursday.

Merkel backs creation of European Union army Merkel backs creation of European Union  army Macron's speech at the ceremony wasn't the only time he put Trump's foreign policy in his crosshairs. In a next stage would then be the project of a "genuine European army" addressed.

John Lewis Christmas advert stars Broadstairs boy Hudson Trindall as Elton John John Lewis Christmas advert stars Broadstairs boy Hudson Trindall as Elton John This year department store rival Debenhams was criticised for releasing a Christmas advert similar to John Lewis's 2017 offering. They've produced some truly heartwarming adverts over the years, check out some of the best John Lewis Christmas adverts .

Cigarette Companies' Shares Fall As US Ponder Menthol Ban Cigarette Companies' Shares Fall As US Ponder Menthol Ban Earlier this year, San Francisco passed a prohibition against the sales of menthol cigarettes and flavored e-cigarettes. The proposal would also be delayed if large tobacco companies fight the FDA's authority to do restrict it.

Odell Beckham catches 2 touchdowns as Giants outlast 49ers Odell Beckham catches 2 touchdowns as Giants outlast 49ers What he did instead was keep the 2-8 Niners in a game in which he faced some real adversity for the first time. However, just as what happened at Arizona and Green Bay, the defense couldn't get off the field to get a win.

Rooney to wear 10 shirt, captain's armband in England farewell Rooney to wear 10 shirt, captain's armband in England farewell I had a new opportunity to go and play in the States. "The competition for places is really intense and we need that". Now thriving at DC United , Wayne Rooney admits he would have preferred to stay at Manchester United until retiring.

Sony Announces PlayStation Black Friday Week Deals for Canada Sony Announces PlayStation Black Friday Week Deals for Canada The Black Friday applies to various color models, including the new Blue Camouflage, Magma Red, Midnight Blue, Gold, and Crystal. Now, a new patent from Sony could hint at the direction their next console could take, and it might surprise many.

Francesco Molinari wants to finish stunning year on a high Francesco Molinari wants to finish stunning year on a high As the last of the eight Rolex Series events on the tour, the tournament carries a purse of $8 million (Dh29.4m). "Winning the Race to Dubai (order of merit) would crown a unique year".

MLB.com FastCast: deGrom, Snell win Cy Young MLB.com FastCast: deGrom, Snell win Cy Young Verlander led the AL with 290 strikeouts while going 16-9 with a 2.52 ERA for AL West champion Houston . His 180 2/3 innings are the fewest for a Cy Young-winning starting pitcher in a nonstrike season.

Fake images on social media show Asia Bibi leaving Pak Fake images on social media show Asia Bibi leaving Pak The charge also carries the death penalty and critics say the controversial blasphemy law is abused to settle religious scores. An argument took place after two Muslim women refused to drink from the same container as Ms Bibi, who is Roman Catholic.

Ranveer-Deepika to tie the knot in a Sindhi wedding today Ranveer-Deepika to tie the knot in a Sindhi wedding today Couldn't stop my tears, but these were tears of happiness and so I hope they never do. The second wedding ceremony per Sindhi rituals is set to take place on Thursday.

SAP to buy Qualtrics for $8bn in its largest-ever deal SAP to buy Qualtrics for $8bn in its largest-ever deal Not only is it a fast-growing company, but it was also profitable, all of which helps SAP justify its premium price. Qualtrics was on the verge of its IPO - it was even on its roadshow with potential investors this past week.

Google Traffic Misleading Affects Services Google Traffic Misleading Affects Services ThousandEyes executive Alex Henthorn-Iwane said it was the worst incident affecting Google traffic that his firm had ever seen. It can also be used to block access to information by sending data requests into internet black holes.