Slashdot Mirror
Tens of Thousands of Malicious Apps Use Facebook's APIs (threatpost.com)
Slashdot reader lod123 quotes ThreatPost:
At least 25,936 malicious apps are currently using one of Facebook's APIs, such as a login API or messaging API. These allow apps to access a range of information from Facebook profiles, like name, location and email address. Trustlook discovered the malicious apps using a formula, which created a risk score for apps based on more than 80 pieces of information for each app, including permissions, libraries, risky API calls and network activity... A malicious app (with a risk score above 7) "might be doing things such as capturing pictures and audio when the app is closed, or making an unusually large amount of network calls," a spokesperson told Threatpost...
To be fair, Facebook is not the only company with its APIs embedded in malicious applications... "The problem, for the most part, is that this is data that is provided when their login is used elsewhere. The API is simply passing through intelligence it has gathered from their profile," said Chris Roberts, chief security architect at Acalvio, via email. "LinkedIn, Google and Twitter, among others, have similarly flawed APIs that can be used to harvest information both about you (the target) and possibly associated individuals...depending upon queries and other developer privileges that are being exploited."
A Trustlook spokesperson summarized their position after the report. "Just as Coke does not want its ads running on certain websites, Facebook should not want malicious app developers using its APIs."
To be fair, Facebook is not the only company with its APIs embedded in malicious applications... "The problem, for the most part, is that this is data that is provided when their login is used elsewhere. The API is simply passing through intelligence it has gathered from their profile," said Chris Roberts, chief security architect at Acalvio, via email. "LinkedIn, Google and Twitter, among others, have similarly flawed APIs that can be used to harvest information both about you (the target) and possibly associated individuals...depending upon queries and other developer privileges that are being exploited."
A Trustlook spokesperson summarized their position after the report. "Just as Coke does not want its ads running on certain websites, Facebook should not want malicious app developers using its APIs."
should be all-American, the world over. Just like their content policies.
No titties in APIs, dammit! And no copyright infringment if the copyright belongs to a MAFIAA-member! But beheadings and other violence is just fine.
And Fuckerberg just shrugs. He got his shekels already so why would he care?
They have access to Facebook, that makes them malicious.
Until we create and enforce a law preventing anyone from maintaining a record on people who have not given them express permission to maintain that record, Facebook and their ilk are malicious.
My data should have my permission before it is kept, not after.
excitingthingstodo.blogspot.com
The purpose of a login API should just be to verify the credentials of the person attempting to login to the service, period. The fact that "when people use Facebook Login, they grant the app’s developer a range of information from their Facebook profile" is simply incorrigible.
If there was an API for it,
Finally! Someone is bringing up LinkedIN.
Just think what information about you that could be more damaging. Your vacation and cat photos on facebook or your work history, news, and employers on LinkedIN?
And we don't know what they do with our information at all.
Yes, it's important to look at the problems, but if there is no solution, is there really a problem? There seems to be a lot of confusion these days about reality, ugly reality, and bothersome realities that certain people refuse to believe in. (Even worse when gaslighting Level-3 liars exploit the will to believe...)
So is there any solution to this malicious app problem? I think the best solution approach would involve exposing the financial models of the apps, with secure commentary provided by financial experts. In minimalist other words, if we knew where the money was coming from, then we would have a much better chance of avoiding the scams. By the way, the same basic approach would help with malicious smartphone apps.
On today's Slashdot the only response will probably be a pile of snark, but let me suggest a few solutions there, too. You snarksters could stop and think a minute. You could ask for clarifications of parts that you don't understand. Even better if you could offer a better suggestion or three.
On the one hand, I feel like dragging in a couple more solutions, such as EPR or the news-reputation as a multidimensional metric, but on the other hand today's Slashdot doesn't feel so motivating.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
That is the whole point of the API, to give others your information.
on slashrot
This is a Sample for comment test
http://www.urltesting.com