Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Facebook Privacy Security Your Rights Online

Facebook Confirms Data Breach 155

Posted by timothy from the you-like-this dept.
another random user writes "A researcher by the name of Suriya Prakash has claimed that the majority of phone numbers on Facebook are not safe. It's not clear where he got his numbers from (he says 98 percent, while another time he says 500 million out of Facebook's 600 million mobile users), but his demonstration certainly showed he could collect countless phone numbers and their corresponding Facebook names with very little effort. Facebook has confirmed that it limited Prakash's activity but it's unclear how long it took to do so. Prakash disagrees with when Facebook says his activity was curtailed." Update: 10/11 17:47 GMT by T : Fred Wolens of Facebook says this isn't an exploit at all, writing "The ability to search for a person by phone number is intentional behavior and not a bug in Facebook. By default, your privacy settings allow everyone to find you with search and friend finder using the contact info you have provided, such as your email address and phone number. You can modify these settings at any time from the Privacy Settings page. Facebook has developed an extensive system for preventing the malicious usage of our search functionality and the scenario described by the researcher was indeed rate-limited and eventually blocked." Update: 10/11 20:25 GMT by T : Suriya Prakash writes with one more note: "Yes, it is a feature of FB and not a bug.but FB never managed to block me; the vul was in m.facebook.com. Read my original post. Many other security researchers also confirmed the existence of this bug; FB did not fix it until all the media coverage." Some of the issue is no doubt semantic; if you have a Facebook account that shows your number, though, you can decide how much you care about the degree to which the data is visible or findable.
This discussion has been archived. No new comments can be posted.

Facebook Confirms Data Breach More

Facebook Confirms Data Breach

Comments Filter:

  • Phonebook (Score:5, Insightful)

    by Nerdfest ( 867930 ) on Thursday October 11, 2012 @09:34AM (#41618537)

    A friend sent me an email a couple of years ago saying "Did you know that you have your phone number on FaceBook?". I said "Yes, I also have it in the phonebook".

    • Re:Phonebook (Score:5, Insightful)

      by bondsbw ( 888959 ) on Thursday October 11, 2012 @09:41AM (#41618615)

      Actually, I just looked and noticed that Facebook has my phone number. I don't remember ever giving it to them, since I specifically don't want them sending me text messages (I don't have a texting plan and each text is a charge).

      When I click to remove it, it says "You will no longer be able to use this phone to receive notifications or upload any photos and videos to Facebook."

      Perhaps they got my number because I installed the app on my phone? I just don't remember explicitly giving it to them.

      • Re:Phonebook (Score:5, Interesting)

        by Crayon Kid ( 700279 ) on Thursday October 11, 2012 @10:19AM (#41618993)

        You probably don't remember this, but when you first started using the Facebook application on your phone you had to confirm your phone number. You probably got a text with a code you had to enter or something like that.

        You can remove the number, as you noticed, but I'd be really skeptical whether they actually remove it. I suspect they don't, since it's a great way of tracking people across multiple accounts. As you experienced yourself, people often forget that they made Facebook aware of their personal phone number at some point in time.

        Consider for example the case of someone who becomes more privacy-aware, closes their initial FB account then later opens another when where he is more guarded about who he friends and what he publishes. And he thinks he's leaving less of an online footprint... when in reality I bet FB is tying it all in with his previous account.

      • I just refused to install the Facebook app (Score:5, Informative)

        by bdwoolman ( 561635 ) on Thursday October 11, 2012 @10:26AM (#41619083) Homepage

        I grudgingly use Facebook (Forcebook, Farcebook, Facebroke, Facebork) because so many of my real friends from overseas postings here and there can be found on it. They move around, too, and, well, it just makes sense.. My Android phone just offered me the opportunity to install the FB app when I checked an email message from Facebook -- A friend request from a German pal of mine from my days in Armenia (See?) He's in Uraguay it seems. Well, when I was ready to do the install I read the permissions list.Holy privacy invasion, Batman! It was going to do all the crap I painstakingly don't let the creepy site do on my web browser (it is a battle). And then it was going track my location to boot.

        Bondsbw, you so gave them permission to have your phone when you installed that app. Moreover, you also gave them permission to marry your firstborn child off to the evil sorcerer Zuck when he or she comes of age. (The sorcerer swings both ways.) Oh, I forgot F*ckedbook.

      • Ditto, but like GP Im having a hard time finding a reason to care. People I DONT want calling me generally already have my phone number, the least I can do is put it out there for those I do want to contact me.

    • Re:Phonebook (Score:5, Funny)

      by Anonymous Coward on Thursday October 11, 2012 @09:44AM (#41618665)

      Phonebook? Is that like an e-book on your phone?

    • One teensy weensy difference... (Score:5, Interesting)

      by Viol8 ( 599362 ) on Thursday October 11, 2012 @09:47AM (#41618687) Homepage

      Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank. Not only that , but once data is on a computer a lot of things can be automated. When its in barely readable type in a large book its a bit more effort.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        I remember in the mid 80s buying entire united states phonebooks on disks...

        In the 90s it was a giveaway with many computers on a CD.

        • BT Phonedisk SE 1994(?), freebie on the front of I think it was PCPro. Several hundred thousand domestic line numbers, from every UK directory, on one CDROM.

      • Yeah, I suppose that stops him from dialing random numbers and picking up names from answering machines.

        • Yeah, I suppose that stops him from dialing random numbers and picking up names from answering machines.

          That's exactly why our answering machine just as a flat "Please leave your name and number at the sound of the tone."

      • Re:One teensy weensy difference... (Score:5, Informative)

        by Minwee ( 522556 ) <dcr@neverwhen.org> on Thursday October 11, 2012 @10:01AM (#41618837) Homepage
        It's a good thing there are no phone books on the Internet [whitepages.com], isn't it?

      • Re: (Score:1)

        by Anonymous Coward

        You're joking right? 411 and other such online phonebooks have been around for more than a decade.

      • Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank. Not only that , but once data is on a computer a lot of things can be automated.

        So if I get this right, your solution to the fact that the US has a major identity theft problem is "would everybody be so kind and ignore it", or perhaps "bad guys, please don't use computers"? I'm afraid it may not work very well.

        I'm not ev

        • We chafe against national ID cards because we are supposed to be a Union of independent states. The whole idea of having many states is to enjoy variation in law.

          • The problem isn't with the IDs. It isn't. Not even close. The problem is that we are convenience oriented society that wants everything nice and easy. Problem is not with the IDs but those that trust random people using random IDs and issuing huge lines of credit to them, without verifying that the person presenting the ID is who they say they are, because that is not convenient.

        • re your last comment: are you saying that there are situations where you have to prove the nonexistence of a document such as a marriage certificate?? Waitwhat? I would've thunk that if someone were convinced that you had been married before the burden would be on them to prove it and not the other way round?

          • You're right, but how difficult do you think it is to "prove" marriage? Marriage licenses in the US can be very casual, basically they're just a piece of paper. If a woman shows up with such a (forged) piece of paper and a random priest swearing "yeah, I married you two back in '67 in Vegas, I remember you were drunk as shit", you're screwed.

            There's practically no way you can prove they're lying, and the US law recognizes this as a legal marriage, without the requirement that it was recorded in an official

      • Re: (Score:2)

        by 1u3hr ( 530656 )

        Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk

        Until about 1990 when they were available online.

        When its in barely readable type in a large book its a bit more effort.

        OCR can read a phonebook as as fast as you can feed pages into a scanner.

      • " Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank."

        This is a problem, but not with privacy, but with impersonation. Banks (and those like them) that take phony credentials to allow people to open up lines of credit and rip people off. The fix for this is painful, but really necessary, make banks eat the cost without being able to write it off as a cost of business. It isn't a cost of business, it is complicity in fraud.

        What ever happened to due diligence?

      • Phonebooks were generally only easily available in the area you lived in and not accessable by Vlad in Minsk who wants to collect as much data as he can on you to impersonate you to a bank.

        I can't speak to Minsk - but pretty much every library I ever visited in the US back in the day had a huge collection of phonebooks. Generally, one book from each for every community in the county, one for most communities in adjacent counties, one for for every major and medium (and often many smaller) city in the state

    • I'd say the issue here is not connecting a number with a person but rather that many of these numbers are mobile phone numbers. This can lead to a significant amount of SMS spam, phishing and other nasty stuff. In the days of phonebooks, while there were robo-dialers and whatnot, the volume and availability of automating this kind of spam has increased exponentially.

    • Yeah, but scammers had to originally tear out pages and hand them to call reps, which was time consuming and man-hour intensive. Now all they have to do is slip them all into a modem call list and when you pick up, they have your home address and full name on screen and linked up ready to jump straight into "Hello Mr Fest. I am calling from Windows Techincal Support about your home computer. You currently reside at $address, correct?".

      It's like the bastard child of spear phishing and cold call scamming.

    • Re:Phonebook (Score:5, Insightful)

      by Thruen ( 753567 ) on Thursday October 11, 2012 @10:35AM (#41619171)
      The phone book doesn't have my cell phone number, or most other peoples' cell phone numbers, but that is what Facebook has most of the time. The phone book doesn't have photos of me, my friends, and my family so as to positively identify me from anyone else in the world who might share my (relatively common) name. The phone book doesn't not allow me to find people by interest so I can find people to call and sell my products to. The phone book requires you to know pretty specifically who you are looking for in order to find them without using the trial and error method. Oh, and lastly, you know the phone book is going to list your number unless you do something about it, and many people choose not to have their number listed, Facebook was never supposed to list your number and so people gave it to them expecting it to remain private. So, while you might not care that Facebook decided to show your number, plenty of people would be bothered by it. It isn't the end of the world or anything, but to downplay it and equate it to having your number in the phone book is a just a bit crazy. Oh, and a point I nearly forgot, lots of teenagers have their cell phone numbers in their Facebook accounts, and without tackling why they shouldn't to begin with, those numbers should definitely not be available publicly.

      • Safegaurding anonymity (Score:3, Informative)

        by Picass0 ( 147474 )

        I hope I don't sound trollish, but it is ultimate your responsibility to safegaurd information you don't want passed around. Reliance on Facebook to safegaurd your stuff implies they care about a few phone numbers, or private photos, or whatever. They don't. They'll write some form letter to everyone and apologize and then go back to fretting about their stock price.

        At Facebook you the product for sale. As long as you keep coming back they don't have a problem.

        • Re: (Score:2)

          by Thruen ( 753567 )
          The big problem with this logic is that you do need to give out your personal information to sign up for various services, and the truth is nobody else really gives a damn unless it's regulated, and at that point they only care about the regulations. I'm not saying you're altogether wrong, it's definitely a good idea to keep things you want to stay private off of services like Facebook (or Google+ or Myspace) but that doesn't make it in any way acceptable when they publish information they claimed would be

          • Re: (Score:3)

            by Picass0 ( 147474 )

            I did not hand out personal information when I created my /. account all those years ago. I can express every opinion I want on Slashdot without handing over my blood type.

            The problem in your logic is it assumes a person needs a facebook account (or like service). What do Myspace, Google+ and Facebook all have in common? I don't have user accounts on any of them.

            I belong to several discussion forums where I post at almost daily. None of them have my real name, phone number, pictures of me or my kids...

            I

            • Re: (Score:3)

              by Thruen ( 753567 )
              They're not the only service you give your information to, they're just the ones that you don't use. I don't have a MasterCard, so if they release all of their customers' information I should think "They're stupid for using MasterCard!" You can argue that they're optional all you want, but so are credit cards, cable, and the internet you use to find said discussion forums. There's no reason to sit there and say it's the users' fault for using a service, that's completely ridiculous. Any time a service, even

        • For some reason, the number, 867-5309, that I put on facebook never gets called. Go figure.

      • Facebook does not have my phone number, my address, photos of me and my family. I can not be found by interest on Facebook.
        The problem here is not Facebooks security. Everyone has known for years it is shit.
        You have known for years Facebook is shit for privacy. You have had to have known. I can tell that by the fact that you seem to be able to string more than one sentence together to form coherent thoughts.
        You made a choice to give up your privacy in order to be able to "like" things and post on peoples wa

        • Re: (Score:3)

          by Thruen ( 753567 )
          Personally, I'm not bitching, Facebook doesn't have anything of mine I need kept private. They have my name, and some pictures I wanted to share with family and friends, none of which even include any people. I keep it simple partly because I don't trust Facebook, mostly because I don't use it often and don't care to. Facebook is an optional service, sure, you don't need it at all, but as much as I used to hate on it, it does provide a number of benefits for people who want to use it. You can tell people th

          • Facebook is different.
            We know the privacy is a joke. We know that if we set stuff private that in the next "enhancement" all of it will be moved and reset back to everything public.
            They do it every time. There is no reason to believe that your data will be or ever has been protected.
            Facebook is working as intended. You can not get mad at a stove for getting hot.
            You can not get mad at Facebook for making all your shit public.

            • Re: (Score:2)

              by Thruen ( 753567 )
              Well, I'm going to steal from you every week for the next ten years, and within a year I'll tell you you can't get mad at me, because it's just what you should expect.... I don't understand why people think the fact that Facebook keeps doing this means it's alright, and we have no right to be mad about it. It's just crazy. We could have six breaches of PSN a year and nobody would ever come out and say "Well, after the first two you really should've stopped using PSN!" and expect it to be taken seriously. It

              • If everyone tells me you are going to steal from me every week and I see you do it 2 weeks in a row, then, yes.
                I can not get mad at you.

    • A friend sent me an email a couple of years ago saying "Did you know that you have your phone number on FaceBook?". I said "Yes, I also have it in the phonebook".

      Except that you can opt-out form the phonebook with an unlisted number. Facebook harvests your phone number and your contacts phone numbers, names email addresses. Potentially they can access IMEI, record sound and take pictures at any time (not just when you click a button), manage your accounts (not sure if they can retrieve anything from other accounts like email etc...)

    • Re: (Score:2)

      by jest3r ( 458429 )

      A friend sent me an email a couple of years ago saying "Did you know that you have your phone number on FaceBook?". I said "Yes, I also have it in the phonebook".

      Do you also have your photo in the phonebook?

    • Re: (Score:2)

      by starless ( 60879 )

      My cell phone and google voice numbers certainly aren't in the phone book.

  • So? (Score:5, Insightful)

    by backslashdot ( 95548 ) on Thursday October 11, 2012 @09:35AM (#41618551)

    Remember phone books? It used to be possible to match people with not only their phone number but their home address too.

    • Anecdote Time! (Score:5, Interesting)

      by eldavojohn ( 898314 ) * <eldavojohn@noSpAM.gmail.com> on Thursday October 11, 2012 @09:51AM (#41618721) Journal

      Remember phone books? It used to be possible to match people with not only their phone number but their home address too.

      Ah, yes! And let me tell you a story about that! I used to have a very common name. So common that according to the latest census there are 40,000 of me walking around the United States (first and last name). I have met myself (first, middle and last) four times and the second time I met myself I was 19 and he was 20 and he said to me: "Don't you ever let your name be published in the phone book" (as advice from one being raised in a major metropolis and I being raised in a very small town) and then went on to describe at length how, when he turned 18, he started receiving odd phone calls from credit card companies demanding he pay up tens of thousands of debt. After months of harassment, he finally got it all straightened out with one of the credit bureaus who then basically had to show the credit card companies that his records and the records of the real person they were looking for were completely different. The other odd thing was that the address the credit card companies had on file had the same exact abbreviations as his address in the phone book and the person had "moved" to that address right when my friend turned 18 and had his name put in the phone book.

      Is it a common problem? Maybe not ... but I'd just as well keep as much of my life private as possible ... to avoid whatever creative scofflaw there might be out there.

      • Re:Anecdote Time! (Score:5, Funny)

        by SIR_Taco ( 467460 ) on Thursday October 11, 2012 @10:00AM (#41618825) Homepage

        ...

        I used to have a very common name. So common that according to the latest census there are 40,000 of me walking around the United States (first and last name). I have met myself (first, middle and last) four times and the second time I met myself I was 19

        ...

        John Jacob Jingleheimer Schmidt? That's my name, too!

      • This reminds me of when the FBI visited my grandfather because he had the same name as some mafia guy who happened to live nearby. I remember him having to sign paperwork swearing he wasn't the same guy as the criminal. lol Crazy stuff! This was in the late 80s, btw.

    • Where you could look up a phone number given an address?

    • Re: (Score:2)

      by mcgrew ( 92797 ) *

      The problem is cell phones. Most are paying by the minute. Phone books only list landlines, which don't bill you for calls recieved.

  • Facebook is (Score:3)

    by kiriath ( 2670145 ) on Thursday October 11, 2012 @09:36AM (#41618563)

    One giant privacy breach anyway. I mean seriously, they churn your personal lives into gold.

    Not much right now, but SOMEDAY they will churn your personal lives into gold.

    • Implying that most people's personal lives are worth gold. Which they aren't. I don't know the exact numbers, but I know that marketing data per capita is very cheap. You are not worth very much at all.

  • "not safe"? (Score:4, Insightful)

    by 1u3hr ( 530656 ) on Thursday October 11, 2012 @09:37AM (#41618575)
    How is a phone number "not safe"?

    Its a new one on me to have an infected phone number. I guess they mean "not secret".

    And who cares? Ever heard of phone directories? You can find millions of phone numbers in there. Including mine. Phone spammers have lists anyway or just have dialers that try every number in a range till one answers.

    • Re: (Score:2)

      by Jawnn ( 445279 )

      How is a phone number "not safe"?

      Seriously? Dude, use your imagination just a little bit here...

      • Re: (Score:2)

        by 1u3hr ( 530656 )

        How is a phone number "not safe"?

        Seriously? Dude, use your imagination just a little bit here...

        Something to do with the Necronomicon?

    • I think this is about mobile numbers - mine certainly isn't published in any publicly available phone book and I try not to give it out to anyone who doesn't need it.

  • Need a Survey / Cognitive Risk (Score:5, Interesting)

    by retroworks ( 652802 ) on Thursday October 11, 2012 @09:38AM (#41618585) Homepage Journal
    It would be really interesting, as a kind of control group, to ask a statistically represented sample of people how alarmed they are, on the basis of 1-10, about the following: 1) Their name is in the phone book, 2) The government has their Social Security Number, 3) Their face is recognizable by the bank ATM camera, 4) their neighbor has a X% chance of receiving their mail in the wrong mailbox. Throw in the word "breach" and watch the fur fly.

  • I don't get why people give Facebook their real phone numbers, even if it's supposedly only visible to friends. Any "friends" should already have your number, and if they don't they can ask.

    It's crazy how much the world has changed. When I was using the Internet in the 1990, there was a golden rule among pretty much everyone I knew that you do not give real names or personal information to any entity on the Internet for any reason whatsoever.

    Wow times have changed! Here [company who specializes in market

  • Or is that redundant?

  • I may answer the phone, and in general, talking to me on the phone is usually unpleasant, even bordering on unsafe.

  • What Do You Mean by "Data Breach" (Score:5, Insightful)

    by Anonymous Coward on Thursday October 11, 2012 @09:52AM (#41618739)

    The *only* difference between a "data breach" and their normal business model is that Facebook didn't get paid.

  • "Facebook has confirmed that it limited the Prakash's activity". -- What is "the Prakash"?

    "Prakash disagrees with when Facebook says". -- That phrasing doesn't feel right to me either.

  • misleading (Score:5, Insightful)

    by tero ( 39203 ) on Thursday October 11, 2012 @09:58AM (#41618801)

    So this is not about breaching phone numbers data that are set to private. This is about finding publicly published phone numbers through the normal search.

    Meh. Phonebooks didn't even have privacy policies back in the day.

    A more valid complaint might have been the ever changing default settings and user interface "improvements" which make finding the said settings very hard.

    But even then, this is not really post-worthy.

  • Phone book? (Score:1)

    by Anonymous Coward

    Several people on here are bringing up the phone book parallel, but it doesn't really fit. Many of us are not listed in the phone book. For that matter, millions of people are unlisted, but give their mobile number to Facebook in order to receive updates or due to their security questions. These people (unfortunately) think their number is still unlisted and private due to their account settings, unaware how easy it is to get access to that information.

    Point is, if put your number in the phone book, you exp

  • the majority of phone numbers on Facebook are not safe

    Is this a viral campaign for another awful horror movie? If you call these unsafe numbers you'll die within 24 hours, that kinda thing?

  • Confirmed: works for private numbers (Score:2, Interesting)

    by Anonymous Coward

    I verified that my mobile number is set to be visible to myself only. I then used a fake facebook account that I keep around, and searched for my phone number. Sure enough, my account showed up. If I try to remove it, I'm informed that I will no longer be able to use that phone to do anything with Facebook. I removed it anyway, and so far, Facebook is still returning my account when I search for my cell number.

    • > I verified that my mobile number is set to be visible to myself only. I then used
      > a fake facebook account that I keep around, and searched for my phone number.

      So you set up a Facebook account as Jane Doe with phone number 123-456-789-0000. However, several of your real-life friends have you under that number in their cellphone contacts as John Smith. Those friends have Facebook accounts, and their mobile phone contacts get scraped. Now Facebook knows you're lying, and they can connect that account

  • They weren't so much upset about the data breach as they were that Prakash did not pay for it.

  • Facebook has confirmed that it limited the Prakash's activity but it's unclear how long it took to do so.

    Am I the only one who thinks this was not the right response here? It seems like it would be far better to fix the damn vulnerability rather than blocking the guy who reported it...

  • Yes, let's put a billion eggs into this basket (Score:5, Informative)

    by sootman ( 158191 ) on Thursday October 11, 2012 @01:24PM (#41620789) Homepage Journal

    Businessweek: What's possible at a billion-plus users that wasn't possible at, say, 500 million?

    Mark Zuckerberg: There are two ways that I look at this. There's what we can build internally and then there's what can be built externally using Facebook. I'll start with the external stuff... when we were at half a billion people, you got these large-scale services like Skype or Netflix (NFLX) that also had big user bases. And we weren't yet at the point where the majority of their users were Facebook users, so they couldn't really rely on us as a piece of critical infrastructure for registration. A lot of startups did, but the bigger companies couldn't. Now really everyone can start to rely on us as infrastructure.

    http://www.businessweek.com/printer/articles/74456-facebooks-next-billion-a-q-and-a-with-mark-zuckerberg [businessweek.com]

    The problem isn't that the data exists. (As others are pointing out with phonebook analogies.) The problem is that the data--your data--isn't safe. Not that it's totally safe anywhere, but FB seems to have had more than their share of problems.

  • Simple answer: (Score:3)

    by Tastecicles ( 1153671 ) on Thursday October 11, 2012 @03:10PM (#41621991)

    Remove your number from Facebook listings (easy done) and write the administrators with a tort-actionable letter stating they have seven days to remove it from their database (not so easy; you will have to be prepared to take it to small claims court to action the tort, which in the UK is £5000 so make the option a claim for £4999.90. If you do end up taking a claim, you will likely get a summary judgment in favour since you made a legal request to a company, who are very unlikely to send a representative to challenge it. International borders be damned, they do not exist; when a company trades in the UK they play by UK rules or they fuck off.

  • "The ability to search for a person by phone number is intentional behavior and not a bug in Facebook.

    "It' s not a bug, it's a feature." I've used this excuse many times - it's an indispensable tool for any software developer. After all, sometimes it goes unchallenged, and you get out of doing actual work.

Slashdot Top Deals

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Close