Posted on

Facebook exposed up to 6.8 million users’ private photos to developers in latest data leak

Facebook exposed private photos from up to 6.8 million users to apps that weren’t supposed to see them, the company said today. These apps were authorized to see a limited set of users’ photos, but a bug allowed them to see pictures they weren’t granted access to. These included photos from people’s stories as well as photos that people uploaded but never posted (because Facebook saved a copy anyway).

“Darktrace’s machine learning approach means that our days of battling cyber-threats at the border are over,” commented Paul Martinello, Vice President of Information Technology, Energy+. “Before deploying Darktrace, we had no way of detecting emerging threats, and we had a reactive approach to cyber defense. The Enterprise Immune System protects our network from the inside out, allowing us to catch even the subtlest and most advanced forms of threat at their earliest stages.”

Darktrace Enterprise Network Process Cyber-Security Immune System

The exposure occurred between September 12th and September 25th. Facebook toldTechCrunch that it discovered the breach on the 25th; it isn’t clear why the company waited until now to disclose it. (Perhaps it’s because the company was dealing with a separate and substantially larger breach that it also discovered on September 25th.)

Affected users will receive a notificationalerting them that their photos may have been exposed. Facebook also says it’ll be working with developers to delete copies of photos they weren’t supposed to access. In total, up to 1,500 apps from 876 different developers may have inappropriately accessed people’s pictures.

Image: Facebook

Facebook said the bug had to do with an error related to Facebook Login and its photos API, which allows developers to access Facebook photos within their own apps. All of the impacted users had logged into a third-party app using their Facebook accounts and granted them some degree of access to view their photos.

“We’re sorry this happened,” writes Tomer Bar, engineering director at Facebook. The disclosure comes exactly one day after Facebook opened a pop-up installation in New York to show people how “you can manage your privacy” on the site.

Facebook has been in hot water again and again this year over data breaches and exposures, most notably with Cambridge Analytica. In many cases, the problems haven’t been caused by hackers, but they have stemmed from issues within Facebook itself. The Cambridge Analytica breach happened because of Facebook’s lax oversight of developers and data sharing; today’s issue happened because of another breakdown in communication between Facebook and developers.

Google has already pledged to shut down Google+ over similar issues. Twice this year, the service exposed information inappropriately to developers.

Source:  The Verge Jacob Kastrenakes on 


Customers who viewed this item also viewed

Hackers Data Breach Equifax For 76 Days Before Being Discovered

Marriott faces backlash over data breach impacting 500 million guests

Solutions

Meet Penny, an AI tool that can predict wealth from space

Windows 10’s Built-in Antivirus Is Getting A Massive Upgrade

Quora Website Data Breach Hits 100 Million Users

The 21 biggest data breaches of 2018

5 Key Benefits of Computer-Integrated Manufacturing

What We Do

Executive Team

Posted on

Windows 10 can carry on slurping even when you’re sure you yelled STOP

All your activity are belong to us

Updated A feature introduced in the April 2018 Update of Windows 10 may have set off a privacy landmine within the bowels of Redmond as users have discovered that their data was still flowing into the intestines of the Windows giant, even with the thing apparently turned off.

In what is likely to be more cock-up than conspiracy, it appears that Microsoft is continuing to collect data on recent user activities even when the user has explicitly said NO, DAMMIT!

First noted in an increasingly shouty thread over on Reddit, the issue is related to Activity History, which is needed to make the much-vaunted and little-used Timeline feature work in Windows 10.

Introduced in what had previously been regarded as one of Microsoft’s flakiest updates – prior to the glory of the October 2018 Update, of course – Timeline allows users to go back through apps as well as websites to get back to what they were doing at a given point.

Use a Microsoft account, and a user can view this over multiple PCs and mobile devices (as long you are signed in with that same Microsoft account). The key setting is that “Send my activity history to Microsoft” check box. Uncheck it and you’d be forgiven for thinking your activity would not be sent Redmondwards. Right?

Activity History

Except, er, the slurping appears to be carrying on unabated.

The Redditors reported that if one takes a look at the Activity History in the Privacy Dashboard lurking within their account, apps and sites are still showing up.

The fellows over at How To Geek have speculated the issue may be something to do with Windows’ default diagnostic setting, which is set to Full and will send back app and history unless changed to Basic. Of course, Windows Insiders have no option but to accept Full, although a bit of slurping is likely to be the least of their problems.

A thread at TenForums has also provided a guide to turning the thing off, ranging from tinkering with Group Policies through to diving headlong into the Registry. Neither are options likely to appeal to users who would expect that clearing the “Send data” box would stop data being sent.

Deliberate slurpage, or a case of poor QAand one team not talking to the other aside, it isn’t a great look for Microsoft and users are muttering about potential legal action. Privacy lawyers will certainly be taking a close look – after all, the gang at Redmond are already under scrutiny for harvesting data and telemetry from lucky users of Windows 10.

Google has been on the receiving end of a sueball for slurping location data from user’s phones and providing an over-complicated way to turn off the “feature”.

It is all a bit of a mess and has left users unsure of what is being collected and when. We have contacted Microsoft to find out how it plans to deal with the situation (ideally before 2018’s privacy bogeyman, GDPR, makes an appearance) and will update if a response is forthcoming. ®

Update 13 December 16.45UTC

Microsoft got in touch to insist it is committed to privacy and transparency, but admitted there is indeed a bit of naming problem, with “Activity History” cropping up in both Windows 10 and the Microsoft Privacy dashboard.

Marisa Rogers, Privacy Officer at the software giant, told us: “We are working to address this naming issue in a future update.”

The slurpage collection is of course for your benefit and Rogers added that users have “controls to manage your data.”


Customers who viewed this item also viewed

Breaking down the Marriott data breach

Hackers Data Breach Equifax For 76 Days Before Being Discovered

The 21 biggest data breaches of 2018

Quora Website Data Breach Hits 100 Million Users

Facebook exposed up to 6.8 million users’ private photos to developers in latest data leak

Privacy Policy

Windows 10’s Built-in Antivirus Is Getting A Massive Upgrade

Goodbye to Edge: Microsoft is building a new, faster browser

Posted on

Blunder at a Japanese Cryptocurrency exchange let investors briefly buy bitcoins for free

Blunder at a Japanese Cryptocurrency exchange let investors briefly buy bitcoins for free. – Says BusinessInsider

A blunder at a Japanese cryptocurrency exchange let investors briefly buy bitcoins for free – though none were able to profit from the mistake.

Zaif, a government-registered exchange run by Osaka-based Tech Bureau Corp, said on Tuesday that a system glitch had let seven customers buy bitcoin with no yen value during a 20-minute window last week.

Zaif is one of 16 exchanges registered with the government, which last year allowed a further 16 – including Coincheck – to continue operating pending full registration.


Customers also viewed

Hackers Data Breach Equifax For 76 Days Before Being Discovered

Facebook exposed up to 6.8 million users’ private photos to developers in latest data leak

Nicole Eagan, Darktrace CEO, speaks at Hong Kong RISE: ‘When AI attacks’