Facebook Vulnerability Discloses Friends Lists Defined as Private
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Researchers from the Quotium Seeker Research Center identified a security f=
law in Facebook privacy controls. The vulnerability allows attackers to see=
the friends list of any user on Facebook. This attack is carried out by ab=
using the 'People You May Know' mechanism on Facebook, which is the mechani=
sm by which Facebook suggests new friends to users.=20
With attacks being on the rise, Facebook is often targeted by hackers for t=
he information it possesses. Users rely on Facebook to maintain their priva=
cy to the best of Facebook's ability.=20
Technical Details
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
To execute the attack, an attacker needs to create a new user on Facebook, =
and send a friend request to the victim. The victim declining the request i=
s irrelevant. At this point Facebook begins to suggest to the attacker peop=
le he may know, with the option of clicking a 'see all' button for convenie=
nce. The people suggested at this point are the friends of the user to whom=
the attacker sent a friend request, even when the friends list of the vict=
im is set to private, and the other suggested users also have their friends=
list private.=20
For full technical information see www.quotium.com/research/advisories/Face=
book_Vulnerability_Discloses_Private_Friends_list.php=20
Vendor Response
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
FB responded that:"If you don't have friends on Facebook and send a friend =
request to someone who's chosen to hide their complete friend list from the=
ir timeline, you may see some friend suggestions that are also friends of t=
heirs. But you have no way of knowing if the suggestions you see represent =
someone's complete friend list." However, research of this issue has shown =
that most of the friends list, often hundreds of friends, is available to t=
he attacker. In any case, even a partial friends list is a violation of use=
r-chosen privacy controls.=20
Since this vulnerability renders the privacy control to hide friends lists =
from other users irrelevant, we hope Facebook will change its mind and this=
flaw will be addressed.=20
Credit
=3D=3D=3D=3D=3D
Irene Abezgauz, VP Product Management at Quotium and Seeker Research Center=
leader is credited with the discovery of this vulnerability.=20