Facebook Bug Lets Hackers Delete Friends

swandives writes "There's lot of talk about Facebook and privacy at the moment, but a bug in Facebook's website lets hackers delete Facebook friends without permission. Steven Abbagnaro, a student from Marist College in Poughkeepsie, New York, reported the flaw, writing proof-of-concept code that scrapes publicly available data from users' Facebook pages and deletes all of their friends, one by one. The victim first has to click on a malicious link while logged into Facebook. Abbagnaro's code exploits the same underlying flaw that was first reported by Alert Logic security analyst M.J. Keith who discovered a cross-site request forgery bug, where the website doesn't properly check code sent by users' browsers to ensure that they were authorized to make changes on the site."

Comments

GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMORE

[Anonymous Coward]

How soon can I get them out of the picture, if you know what I mean.

This is not a bug

[Anonymous Coward]

"It's a feature."

Re:This is not a bug

[tuomoks]

Everything today is "a feature". Real tired to hear these "problems" - not really problems but laziness, ignorance, whatever by developers / designers! Yes, the base, the standards, the tools, and so on are flawed but nothing says the systems have to be coded that way, allowing all the security and other problems. I have tried a long time to defend the developers - it wasn't their problem that that their tools, toys, systems, etc were bad but after so long - anyone anymore creating systems with these flaws is to blame!

This is really getting out of hand - why would anyone build systems which allow these problems, cross-site without checking, whatever - on purpose? Sorry, after 30+ years designing / creating safe systems for global mission critical operations, public safety, etc - I just can't understand!! Yes - sometimes it means fighting the management and even customer but why would anyone do it - every time it comes back haunting you, badly! What has happened to separation of presentation, processing, authentication, authorization, etc?? The basic rules in safe computing! Or did your vendor licensing book forget to tell you about the bad and ugly world outside the door? If so - why not start thinking yourself?

Re:GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMOR

[MichaelSmith]

Thats one hell of a bug. I didn't know you could do that much damage with php.

Raising false hopes

[Thanshin]

In case you didn't RTFA, you can only delete the link between your facebook accounts, not the friends themselves.

And so dies our intricate plan to befriend our enemies and erase them from existance.

Re:Raising false hopes

[MichaelSmith]

They're a bunch of spoil sports:

5/11/2010 – Facebook notified of vulnerability
5/13/2010 – Work begins with Facebook to patch flaw.
5/14/2010 – Facebook confirms flaw is patched.

5/24/2010 – Post on slashdot.

Re:Raising false hopes

[Thanshin]

They're a bunch of spoil sports:
5/11/2010 - Facebook notified of vulnerability
5/13/2010 - Work begins with Facebook to patch flaw.
5/14/2010 - Facebook confirms flaw is patched.

5/24/2010 - Post on slashdot.

5/28/2010 - Dupe post on Slashdot.
6/15/2010 - Trupe post on Slashdot.
6/15/2010 - AskSlashdot question about whether dupe+1 = trupe or redupe. Links to original post.
6/15/2010 - Slashdot is slashdotted, creating a singular paradox.
5/24/2010 - The end of the world as we know it.

Re:Raising false hopes

[Zebaulon]

5/28/2010 - Dupe post on Slashdot.
6/15/2010 - Trupe post on Slashdot.
6/15/2010 - AskSlashdot question about whether dupe+1 = trupe or redupe. Links to original post.
6/15/2010 - Slashdot is slashdotted, creating a singular paradox.
5/24/2010 - The end of the world as we know it.

And I feel fine.

So THAT'S Why I Don't Have Any Friends on Facebook

[Anonymous Coward]

It was ... the hackers ... yes, that's it, it was the hackers that must have made everyone defriend me.

Social networking sucks

[asherlev]

I deleted my Facebook account a week or so ago, and I was, at the time, hoping that diaspora would end up being something besides vaporware. After a week without it, though, I find myself pleased with my lack of knowledge about what people I didn't like in high school had for dinner.

Re:Social networking sucks

[AmonTheMetalhead]

Why did you befriend them if you don't like them?

Re:Social networking sucks

[ClioCJS]

Blaming facebook for your friend choices. Classy.

Re:Social networking sucks

[Fnkmaster]

Just to give you a word of support - ignore the people saying it's your fault for who you accepted as a friend. The problem is that it's easy to say "yes, this person is my friend", even if they are somebody marginal who you never particularly cared for (it's easy to click "Ignore" for evil ex-girlfriends and the real assholes from high school). But it's very hard to rethink that and unfriend them in such a public forum later on, and have to deal with awkward questions about why you unfriended so-and-so. However, that is what Facebook made the "hide this person's updates" feature for - when somebody isn't egregiously awful enough to unfriend, but you just don't want to see their bullshit updates anymore.

In any case, I didn't actually delete my Facebook account, but I have cleared out any information but the absolute basics. And I began an experiment by avoiding logging into Facebook for a week. I found that I rapidly reverted to visiting other websites and finding other things online to fill my down time at work.

I believe the reason Facebook is so addictive is the feed mechanism. It fills our psychological need for gossip and trivial sorts of information about friends. However, like many addictive things, I think too much of a "good" thing (and by good thing, I mean it's fun, enjoyable, makes us feel connected) is no longer a good thing. While I want to know when old friends go back to grad school, get engaged, married, or have their first kids, I don't really want to hear somebody's snarky comments about their workplace, read about their lost cell phone, hear about how they just bought an iPad and it's changed their lives, or read about their drunken escapades.

So the point - I agree with you, and I think we are both going to be happier, with cleaner, fresher, less cluttered minds for turning our backs on this inane distracting chatter. Saying "I'm Facebook friends with them" has become synonymous with "they are somebody I know but don't really give enough of a shit about to keep up with in real life".

Re:Social networking sucks

[sakdoctor]

You're missing the point because that isn't the reality of using facebook.

What actually happens is that when you first signed up, you naively used your real name. Then loads of people from your past, who you couldn't give two shits about, inexplicably add you.
As a new user you aren't going to press ignore, so you confirm everyone.

In the default mode, your front page is now full of the most verbose idiots literally broadcasting what they had for dinner.

Finally you delete your account, because facebook is a horrible ad ridden, malware invested fad, and it's dying. Or at least becoming a zombie.

Re:Social networking sucks

[StuartHankins]

They were going to give him a wedgie if he didn't add them.

Re:Social networking sucks

[adamofgreyskull]

You're missing the point because that isn't the reality of using facebook.

In the default mode, your front page is now full of the most verbose idiots literally broadcasting what they had for dinner.

No. I don't think he was missing the point. You can remove anyone and any application from your "feed". If you really think the people, who you added as friends, are "verbose idiots" and they are literally broadcasting what they had for dinner, then why not just remove them? Or you could just not add them in the first place? You have the choice to cease being friends with people or to not become friends with them, just as you do in real life. If you felt obligated to add them as a new user and are now scared to remove them, then it sucks to be you. If you befriended someone in real life and they kept ringing you up to tell you that they just bought some new fish and that they were about to eat McDonalds, then go and see a movie, would you sell up and move to a shack in the woods?

Finally you delete your account, because facebook is a horrible ad ridden, malware invested fad, and it's dying. Or at least becoming a zombie.

"Ad ridden"? Not noticed. There are no, or very few, obnoxious ads on there that I've seen. The ones that I have seen are text ads with no/very small pictures and all seem to be vaguely relevant and unobtrusive, and you even have the option to click on specific ads if you think they're inappropriate, or irrelevant etc. (I forget the exact options) to get rid of them. As for malware, again, not that I've noticed.

Your main gripe would seem to be that Facebook is a "social networking" site and that you have no interest in being social, nor in networking. The second gripe regarding "malware" is either imaginary, or a product of your befriending of mouth-breathers...who you don't like. As for the "ad ridden" part...that's either made up, or ad-block is removing all the ads for me. (inb4 YHBT)

Re:Social networking sucks

[Bakkster]

PEBKAC

Re:GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMOR

[Thanshin]

How soon can I get them out of the picture, if you know what I mean.

Sorry but I don't think the hack goes as far as photoshopping your pictures to erase your friends from them.

Patched already

[wannabgeek]

The CSRF bug page in the summary says that facebook confirmed that it's patched already. And the actual hacker's page says that he found if he does a little more (delete a few more parameters as well as the "post_form_id"), the CSRF resurfaces.

Anyway, he posted an update saying fb patched this one now (22 May)..

a self-copying worm code

[bl8n8r]

The article seems to be directed at facebook, but it sounds to me like there needs to be a browser or OS exploit first in order to work: "combine an exploit for this bug with spam or even a self-copying worm code". I'm not a facebook user (get off my lawn), but a lot of XSS flaws are browser specific and if there is a general browser exploit going on, this could affect more websites than facebook. TFA just sounds a little misdirected to me.

Re:a self-copying worm code

[tokul]

lot of XSS flaws are browser specific and if there is a general browser exploit going on, this could affect more websites than facebook

It is not XSS, but CSRF. Cross-site request forgery. Such exploits are designed to exploid the way site processes user inputs. If site uses custom forms or request fields, exploit will work only on this site and in most of the cases it is not specific to some browser.

And since Facebook only notifies you of "good" new

[ickleberry]

It's hard to tell if your friends have been affected by this 'bug'. If someone unfriends you then you might never know, yet when you add a new one it's all over everyone else's page

At last an easy way to...

[jimwormold]

... delete an account from facebook!

Hey, wait a minute...

[wilder_card]

Hackers have friends???

Bug condition:

[Anci3nt of Days]

After the bug deletes all your friends... Tom is added.

He was feeling all left out when everyone left myspace.

Can we name the bug?

[Yvan256]

May we suggest the name "KipDrordy" for the bug?

No Mother-in-law

[ubrgeek]

I didn't delete you as a friend. And now the system won't let me add you back. Damn those evil, evil hackers!

Re:GOOD I'VE GOT A FEW FRIENDS I DON'T NEED ANYMOR

[zalas]

I wonder how long before someone writes an app that connects Facebook friend deletion events with Photoshop's Content-aware Fill feature... They could name the app "Stalin".