Slashdot Mirror
Facebook Patches Vulnerability That Could Have Exposed User Data (theverge.com)
Yet another vulnerability has been patched that could have exposed user data. According to security company Imperva, the bug "allowed websites to obtain private information about Facebook users and their friends through unauthorized access to a company API, playing off a specific behavior in the Chrome browser," reports The Verge. From the report: In technical terms, the attack is a cross-site request forgery, using a legitimate Facebook login in unauthorized ways. For the attack to work, a Facebook user must visit a malicious website with Chrome, and then click anywhere on the site while logged into Facebook. From there, attackers could open a new pop-up or tab to the Facebook search page and run any number of queries to extract personal information. Some examples Imperva gives are checking if a user has taken photos in a certain location or country, if the user has written any recent posts that contain specific text, or checking if a user's friends like a company's Facebook page. In essence, the vulnerability exposed the interests of a user and their friends even if privacy settings were set so interests were only visible to a user's friends. Imperva says the vulnerability was not a common technique and the issue has been resolved with Facebook. However, it does mention that these more sophisticated social engineering attacks could become more common in 2019. A Facebook representative told The Verge: "We appreciate this researcher's report to our bug bounty program. We've fixed the issue in our search page and haven't seen any abuse. As the underlying behavior is not specific to Facebook, we've made recommendations to browser makers and relevant web standards groups to encourage them to take steps to prevent this type of issue from occurring in other web applications."
Google decided to close Google Plus instead of patching a similar issue. It was not a leak because nobody knew it had been exploited, same as here.
Well, I should hope so, right?
Is this really a story? I probably patch dozens of vulnerabilities a day. That's what I get paid to do.
Is to not use Facebook.
Corporatism != Free Market
is that still a thing?
I work in the field too. Cataloged 80 new vulnerabilities today.
https://tech.slashdot.org/comments.pl?sid=12520486&cid=57184660 - KNOWN LYING FAGGOT RAY MORRIS PUSHING DEBUNKED NAZI PROPAGANDA AFTER CAUGHT, WHAT A LYING FAGGOT. GET A ROPE.
Filter error: Don't use so many caps. It's like YELLING. Filter error: Don't use so many caps. It's like YELLING.
Applying patches != patching the code. You're bragging about glorified monkey work, double clicking.
Of course debunked nazi propagandist Ray Morris is happy to suck your banana.
It was a CSRF at Facebook, but why blame Chrome? The browser seems to just do its job.
You're caught impersonating me c6gunner (your name's the submitter signing "APK") https://linux.slashdot.org/com... & you ALTERED /.ers PRAISE of my work (not yours you don't even HAVE).
(Don't throw stones if you live in a glass house vs. me: RIGHT ZIP? https://yro.slashdot.org/comme... )
*** IGNORANT LYING CHIMP "ZIP" SHOT DOWN FOR HIS LIES & TECH FUCKUPS vs. me https://games.slashdot.org/com...
LIAR ZIP says he has no account "I don't have an account, so I don't have mod points" https://news.slashdot.org/comm...
Yet LIAR ZIP says he downmods my posts (IMPOSSIBLE MINUS AN ACCOUNT on /.): "I down-modded a few of your post on other threads" - by Anonymous Coward "ZIP" on Thursday October 11, 2018 @11:31AM (#57461058) FROM https://yro.slashdot.org/comme...
These PUSSY bullshit artists aren't bullies - they're worse - they're pussy ass PUNKS & talkers (all talk "ne'er-do-well" DO-NOTHINGS).
APK
P.S.=> Hosts can stop portsmash (blocking downloads of it) "You basically have to already be able to run your own evil code on a machine in order to PortSmash it." from https://www.theregister.co.uk/... not Spectre/Meltdown AFAIK (but it's POSSIBLE it might but NOT TOTALLY SURE here (vs. say, RPC using them which would be REMOTE vs. LOCAL as in portsmash above) per https://meltdownattack.com/mel... &/or https://spectreattack.com/spec... ACADEMIC RESEARCH into their mechanics ) - & U FAIL a PORTFILTERING TEST https://yro.slashdot.org/comme... ... apk
rm -rf / on all of Facebook's servers.
"What lies behind us, and what lies before us are tiny matters compared to what lies within us." Ralph Waldo Emerson
FTFT
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
See subject: A lying BLOWHARD bullshit artist that can't READ stupid CHIMP named Zach Patterson https://tech.slashdot.org/comm... who tried to "take credit" for something I did BEFORE him with proof of it RIGHT there & he says "I'm a much better programmer than APK" - by Anonymous Coward ZIP on Monday October 08, 2018 @11:27PM (#57449082) FROM https://yro.slashdot.org/comme... ) ?
* FUNNY THAT JACKASS IS ALL TALK but not a DAMN THING to show for himself in code let alone what others LIKE/USE/PRAISE (even /.ers) in MY work (that 100k++ users do worldwide also).
APK
P.S.=> There's TOO MANY pitiful do-NOTHING "ne'er-do-wells" INFESTING this place that are like YOU, you disgusting UNIDENTIFIABLE anonymous punk IMPERSONATING me... apk
They moved Mark Zuckerberg's desk into a closet.
In every middle school, you have the librarians-turned-media-specialists trying to teach kids cybersecurity by reviewing things like "privacy" settings on Facebook. It's time we start telling kids to ignore such rubbish and assume everything they post, email, text etc. will someday be public. Once we get that point across to kids and their parents, not only will we have a safer Internet but a more civil one.