Slashdot Mirror

← Back to Stories (view on slashdot.org)

Facebook Bug Lets Hackers Delete Friends

Posted by timothy on from the friends-don't-let-friends dept.

swandives writes "There's lot of talk about Facebook and privacy at the moment, but a bug in Facebook's website lets hackers delete Facebook friends without permission. Steven Abbagnaro, a student from Marist College in Poughkeepsie, New York, reported the flaw, writing proof-of-concept code that scrapes publicly available data from users' Facebook pages and deletes all of their friends, one by one. The victim first has to click on a malicious link while logged into Facebook. Abbagnaro's code exploits the same underlying flaw that was first reported by Alert Logic security analyst M.J. Keith who discovered a cross-site request forgery bug, where the website doesn't properly check code sent by users' browsers to ensure that they were authorized to make changes on the site."

12 of 89 comments (clear)

  1. GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMORE by Anonymous Coward · · Score: 2, Funny

    How soon can I get them out of the picture, if you know what I mean.

  2. This is not a bug by Anonymous Coward · · Score: 5, Funny

    "It's a feature."

  3. Re:GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMOR by MichaelSmith · · Score: 3, Funny

    Thats one hell of a bug. I didn't know you could do that much damage with php.

    --
    http://michaelsmith.id.au
  4. Raising false hopes by Thanshin · · Score: 5, Funny

    In case you didn't RTFA, you can only delete the link between your facebook accounts, not the friends themselves.

    And so dies our intricate plan to befriend our enemies and erase them from existance.

    1. Re:Raising false hopes by Thanshin · · Score: 5, Funny

      They're a bunch of spoil sports:
      5/11/2010 - Facebook notified of vulnerability
      5/13/2010 - Work begins with Facebook to patch flaw.
      5/14/2010 - Facebook confirms flaw is patched.

      5/24/2010 - Post on slashdot.

      5/28/2010 - Dupe post on Slashdot.
      6/15/2010 - Trupe post on Slashdot.
      6/15/2010 - AskSlashdot question about whether dupe+1 = trupe or redupe. Links to original post.
      6/15/2010 - Slashdot is slashdotted, creating a singular paradox.
      5/24/2010 - The end of the world as we know it.

    2. Re:Raising false hopes by Zebaulon · · Score: 2, Funny

      5/28/2010 - Dupe post on Slashdot.
      6/15/2010 - Trupe post on Slashdot.
      6/15/2010 - AskSlashdot question about whether dupe+1 = trupe or redupe. Links to original post.
      6/15/2010 - Slashdot is slashdotted, creating a singular paradox.
      5/24/2010 - The end of the world as we know it.

      And I feel fine.

  5. So THAT'S Why I Don't Have Any Friends on Facebook by Anonymous Coward · · Score: 3, Funny

    It was ... the hackers ... yes, that's it, it was the hackers that must have made everyone defriend me.

  6. Re:GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMOR by Thanshin · · Score: 4, Funny

    How soon can I get them out of the picture, if you know what I mean.

    Sorry but I don't think the hack goes as far as photoshopping your pictures to erase your friends from them.

  7. Hey, wait a minute... by wilder_card · · Score: 3, Funny

    Hackers have friends???

  8. Can we name the bug? by Yvan256 · · Score: 2, Funny

    May we suggest the name "KipDrordy" for the bug?

  9. Re:Social networking sucks by StuartHankins · · Score: 4, Funny

    They were going to give him a wedgie if he didn't add them.

  10. Re:GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMOR by zalas · · Score: 2, Funny

    I wonder how long before someone writes an app that connects Facebook friend deletion events with Photoshop's Content-aware Fill feature... They could name the app "Stalin".