Facebook vulnerability could have let websites obtain users' interests

Another Facebook vulnerability risked personal user information

Facebook says it has fixed a privacy bug that allowed websites to read likes and interests on users' profiles without them knowing about it.

He realized that just by looking for an iframe inside the search results page, he could just easily determine if a search query has returned a positive or negative result.

Facebook fixed the issue in May and there's no indication that the flaw was successfully exploited by hackers.

Masas told ZDNet that an attacker could use a technique called "tab under" to force the opening of the Facebook Search page inside a background tab, which keeps the user's focus on the main malicious page -which could be disguised as an online game, movie streaming portal, or news article.

Ankush Johar, Director at Infosec Ventures explained, "Although CSRF flaws have a big prerequisite to work that the user must be logged in to the website while he/she visits the infected page, what makes the Facebook vulnerability risky is, unlike other websites, most of the users are always logged into Facebook in their browsers thus putting everyone at massive risks".

Facebook is not the only company which has faced this type of issue and it seems no one took advantage of this particular vulnerability. Notably, because these searches would appear to be conducted by the user, whose login and browser had been authenticated by Facebook, search results wouldn't be affected by the user's privacy settings.

SAP Makes Waves on Buying Qualtrics
It doesn't say, why does the customer feel a certain way about your brand, about your products, and about their experience. Qualtrics expects 2018 revenue in excess of $400 million and forecast a forward growth rate of more than 40 percent.

This is the latest revelation in Facebook's bug-filled year. This could also be used to search for a user's post with certain keywords among other complex tasks, all of which are usually visible to only those who are in the friend list of the user. The bug allowed websites to obtain private information about Facebook users and their friends through unauthorized access to a company API, playing off a specific behavior in the Chrome browser.

A video demonstrating how the hack works shows a pop-up window where the attackers type in the questions.

These search queries, even if they didn't expose fine-grained details, they did expose second-hand information that could reveal, when pieced together, the identity of a user and his friends circle.

"We appreciate this researcher's report to our bug bounty program".

The company awarded Imperva $8,000 in two separate bug bounty rewards.

Related News:

  • Labor in bid to extend My Health opt-out

    Labor in bid to extend My Health opt-out

    Once the opt-out period ends the government will begin creating records for 17 million Australians, whether they want one or not. Earlier in the week, Labor and the Greens teamed up to pass a motion calling for the government to extend the opt-out period.
    Canada in talks with Pakistan over possibly taking in Asia Bibi

    Canada in talks with Pakistan over possibly taking in Asia Bibi

    Pakistan yesterday rubbished rumours about Christian woman Aasia Bibi's travel overseas after her acquittal in a blasphemy case. Bibi's conviction stemmed from a 2009 incident when she was asked to fetch water while out working in the fields.
    At least 8 killed in Saudi-led airstrike on Yemen's Hodeidah: Houthis

    At least 8 killed in Saudi-led airstrike on Yemen's Hodeidah: Houthis

    Three port employees reached by telephone said the rebels had also begun to mine entryways to the port overnight. Rebel-controlled media reported two air strikes but made no mention of casualties.
  • Silva pushes Sri Lanka to lead over England in 2nd test

    Silva pushes Sri Lanka to lead over England in 2nd test

    Leach took three wickets on a mixed day for England's spinners and says the tourists are confident they can win the Test. According to worldwide cricket rules an umpire can dock five runs if he feels the batsman ran a short run deliberately.
    Researchers Have Created an Artificial Sun, And It’s Way Hotter

    Researchers Have Created an Artificial Sun, And It’s Way Hotter

    Though development of fusion technology began roughly 60 years ago, it has yet to create a viable energy source. China is reportedly working on an artificial sun in a bid to create an alternative source of power on earth.
    EE announces plans to launch 5G in Edinburgh

    EE announces plans to launch 5G in Edinburgh

    This will help 5G make the biggest difference - even with the biggest crowds often witnessed at these locations. BT Group PLC on Tuesday said its unit EE will launch 5G mobile technology in 16 United Kingdom cities in 2019.
  • Oil demand is under increasing threat from electric cars and cleaner fuels

    Oil demand is under increasing threat from electric cars and cleaner fuels

    Electricity will account for a quarter of energy used by end users such as consumers and industry by 2040, it said. He added: "To be successful, this will need an unprecedented global political and economic effort".
    Facebook management apparently ordered to ditch their iPhones for Android

    Facebook management apparently ordered to ditch their iPhones for Android

    Cook has made critical comments about the 87 million Facebook users who had their data unknowingly accessed by a political firm. After it was criticised by Apple CEO Tim Cook, it appears that the management isn't taking his remarks too lightly.
    Odell Beckham catches 2 touchdowns as Giants outlast 49ers

    Odell Beckham catches 2 touchdowns as Giants outlast 49ers

    METAIRIE, La. (AP) - Saints coach Sean Payton said the Saints have signed veteran receiver Brandon Marshall. Nothing that transpired changes much of anything for the Giants as their sad season moves on.
  • The John Lewis Christmas ad 2018

    The John Lewis Christmas ad 2018

    The firm said reports Sir Elton had been paid £5m were "wildly inaccurate" and said some of his fee went to his charitable trust. A spokesperson from John Lewis told Express.co.uk: "So this Christmas, we will be selling pianos, so you can buy the gift".
    LeBron James surpasses Wilt in NBA's all-time scoring list

    LeBron James surpasses Wilt in NBA's all-time scoring list

    As we have seen in the first few games with the Lakers , Walton has elected to go with Chandler at the five to close out games. A three-game suspension pressed Ball into the starting lineup, where he's remained for the past 12 games.
    Google went down after traffic was routed through China and Russian Federation

    Google went down after traffic was routed through China and Russian Federation

    He said he suspected nation-state involvement because the traffic was effectively landing at state-run China Telecom. Google's search, cloud hosting and corporate-focused G-Suite collaborative tools were among services disrupted.


Most liked

Premier League clubs vote in favour of using VAR next season
Referee Matt Conger from New Zealand uses VAR at the World Cup during the match between Nigeria and Iceland. Video review is set to debut in the English Premier League next season.

The trailer for the new Dumbo film is... disturbing
As the trailer hints, Dreamland isn't all that dreamy - and Vandevere isn't as charming as he'd like everyone to believe. Burton is known for putting in a dark twist to movies that people presume he has made for a younger audience.

Congrats! Cristiano Ronaldo reportedly proposes to long-time girlfriend
Willian then went on to say, "He is one of the best players in the world at the moment". Djokovic will next face Alexander Zverev on Wednesday.

Xiaomi opens Android Pie Beta program for Mi A2 Lite
However, the MIUI 10 Global stable update for the Redmi Note 4 is still based on Android Nougat and some features are missing. Xiaomi's latest launch, the Redmi Note 6 Pro , is also getting MIUI 10 stable update in countries where it was launched.

Agra woman bleeds to death after gruesome monkey attack
The incident is far from uncommon, in a country where monkey attacks are a common occurrence, second only to dogs. Dhirendra Jumas, the baby's uncle, told the BBC the family was heartbroken and the baby's mother is distraught.

Frozen Super-Earth discovered orbiting nearby Barnard’s star
However, if the planet has a substantial atmosphere the temperature could be higher and conditions potentially more hospitable. A frozen "super-Earth" discovered six light years from Earth could be capable of harbouring life, scientists have said.

Wayne Rooney to captain England in farewell friendly match against the USA
Speaking about his time at Man United, Goal quoted Rooney as saying: "Of course you miss it. The more important thing is that within the England group, we value what he has done.

Black Friday Week PS4 discounts announced
Select DualShock 4 wireless controllers available for $39.99 USD (MSRP) / $49.99 CAN (MSRP) at participating retailers . Sony's video game service will be on sale with discounts on the 12-month subscription.

How to watch the DP World Tour Championship without Sky Sports
Molinari holds a lead of more than one million points in the race and only Tommy Fleetwood , the defending champion, can stop him.

Pakistan confirms it discussed Asia Bibis case with Canada
Tehreek-e-Taliban have no parliamentary seats.Their powerbase is on the streets and killing Asia Bibi has been their cause. It comes amid mounting concern that Mrs Bibi , a Pakistani Christian facing.

Saudi Arabia seeks death penalty for five over Jamal Khashoggi death
Others have argued it's hard to believe the killing would have taken place without Crown Prince Mohammed bin Salman's knowledge. The prosecutor told reporters in Riyadh that investigations were still ongoing to locate the remains of the slain journalist.

Scientists said if the social network for health
With those data in hand, Hunt then looked at seven outcome measures including fear of missing out, anxiety, depression, and loneliness.

Blues facing two-year transfer ban after breaking Federation Internationale de Football Association rules
Federation Internationale de Football Association guidelines forbid the signing of foreign players under the age of 18. Traore was sold to Lyon for £8.8 million in June 2017 after 16 first-team appearances for Chelsea .

Shahid Afridi leaves Pakistan red faced with comments on Kashmir
He said that another report on the state of human rights in Kashmir was being compiled by a committee of the European Parliament. Humanity is a big thing. "Any death, be it from any community, is painful", Afridi said in the video uploaded on social media.

Global oil market to lapse into surplus in 2019 as demand slows
Together with Russian Federation and other non-OPEC producers, OPEC had agreed in June to boost supply after pressure from U.S. Every dollar per barrel change in crude oil prices impacts the import bill by Rs 823 crore ($0.13 billion).