Slashdot Mirror
Facebook Admits SMS Notifications Sent Using Two-Factor Number Was Caused by Bug (theverge.com)
Facebook has clarified the situation around SMS notifications sent using the company's two-factor authentication (2FA) system, admitting that the messages were indeed caused by a bug. From a report: In a blog post penned by Facebook Chief Security Officer Alex Stamos, the company says the error led it to "send non-security-related SMS notifications to these phone numbers." Facebook uses the automated number 362-65, or "FBOOK," as its two-factor authentication number, which is a secure way of confirming a user's identity by sending a numeric code to a secondary device like a mobile phone. That same number ended up sending users Facebook notifications without their consent. When users would attempt to get the SMS notifications to stop, the replies were posted to their own Facebook profiles as status updates.
We are very sorry we prematurely started sending you Facebook advertisements using the phone number you provided for 2-step verification. Our intention was to not do so until we had finished our latest marketing plan and updated the wording of our terms of service.
Please accept our apologies. We hope you continue to enjoy Facebook and provide us with what little of your valuable personal information we have not already collected.
- Your Facebook Team
#DeleteChrome
I am at a loss as to how this could be a bug. We almost all here write code, making a computer do anything requires effort, concentration and time.
This was done on purpose. To what end I do not know but the idea that through some mystery code all this happened is just not logical, it makes much more sense that it was crafted to perform the actions it performed.
At some point in the code during the authentication process it had to capture the response, that response then had to be applied to a users 'wall' which again is not an easy task and takes time, concentration and effort to make it perform this action.
I call BS, facebook did this on purpose, why is unknown, but the amount of effort to create this situation goes beyond a bug and into the realm of the deliberate.
Shame on whoever modded this down -- "2FA" over SMS is empirically proven insecure, by e.g. social engineering attack on the cell phone company to redirect text messages to an attacker's phone.