RSSPersonal data of 170 million Facebook users exposed, collected, and shared without any hacking
By Ed Oswald | Published July 29, 2010, 5:40 PM
Using publicly available information on Facebook, a researcher has been able to gather personal details of nearly 170 million users of the service, or about a third of all users. The data includes names, addresses, e-mails, phone numbers, and birthdays: essentially anything that was not marked as private is now part of this file.
The file has now ended up on The Pirate Bay, and so far has seen over 10,000 downloads. This could mean hackers would have an easy way to obtain personal information necessary for identity theft and other malicious uses.
Skull Security researcher Ron Bowes was the man behind the work. He did not hack into the service at all but rather scraped the data from Facebook's open directory. While it's a violation of the social networking site's terms of service, nothing is stopping anyone from doing it.
Bowes has decided to make the file a torrent, even though he acknowledged that the more info an attacker had on a person, the higher likelihood of a security breach. His move is somewhat curious considering he arguably could be held liable for attacks as a result of his actions.
Even so, the incident could prove to be a wake up call for those sharing data on Facebook. "I am of the belief that, if I can do something then there are about 1,000 bad guys that can do it too," he told the BBC News Thursday.
"For that reason, I believe in open disclosure of issues like this, especially when there's minimal potential for anybody to get hurt. Since this is already public information, I see very little harm in disclosing it," he argued.
Facebook Spokesperson Andrew Noyes told several media outlets that this was public information and no private information had been disclosed as a result of Bowes' work. The quick downplay of the data leak is probably due to the drubbing the social networking site has taken when it comes to privacy as of late.
To ensure that your own data is not at risk, users of Facebook should take the following steps. Click on "Privacy Settings" under the Account menu option. Ensure that information is not set for "Everyone" to view. Alternatively, the user can also uncheck "Enable Public Search" which would take the account out of the directory Bowes used to do the data mining.
The Skull Security website was inaccessible as of Thursday afternoon.
Its not a hack, its not a bug, thats how its set up to make it easy for advertisers to spy on face book users thats how it makes its money. Advertisers call it a service police call it ..criminal investigation, a public service. The only difference police need a court order to spy,advertisers don't.
Score: -1
|All the "bad guys" in the world have extremely easy access to our names....it's called a phone book.
Get over it people.
Score: -2
|how about the lists of people we know and all their information as well.
Score: -1
|How about the list of names...and the list of names? (They're all in FB, so their names were part of the list anyway...)
Really not worth even talking about. Phone books have been around for ages... names, phone numbers, hell...even addresses.
Talk about dangerous!
Score: -1
|Phone books usually don't list first names.
Score: -1
|"Phone books usually don't list first names."
This must have happened within the last five years or so. I admit I haven't looked at a phone book in ages, but I know for a fact the majority of the listings had first and last, or at the very least, the first initial.
Does it matter? You have the phone number and address. A quick Google or UWP search will turn up the rest...
Score: -1
|"I am of the belief that, if I can do something then there are about 1,000 bad guys that can do it too,"
well he just gave the information to every "bad guys" in the planet, maybe in the universe as well :P
I would say this isn't the work of a security expert, but of a moron...
Score: -1
|Well, people publish too much private info and don't care about the consequences...
Score: 1
|i do think certain measures should be introduced that stops an individual accumulating so many details, 170 Million,
i think "Bowes" was trying to say that even on a public system there should be some counter measures in place,
just because it's a social network, does not mean the company does not have a DUTY to put in place some deterrents, even basic encryption techniques could easily be deployed,
"Bowes" accumulated 170 Million details, not by copying each individual page details, not by developing some AutoBot to collect this information, but just by accessing the system, behind the interface and grabbing files.
I'm sorry, shouting out social network is hardly a valid reason, this imo is awful.
and I'm quite shocked by all the responses here on Betanews to be quite frank.
Social network = no security measures.
how narrow-minded you people that have posted here so far are.
FaceBook should deploy basic countermeasures at least to deter would be spammers, otherwise what message is facebook sending out to the world.
170 Million detail's, the spammers out there has just increased there profits now by how much.... thankyou very much facebook.
and in case people are thinking that "Bowes" is responsible for the leak, please don't be so gullible, if "Bowes" has done it, then how many other's have done it, the only difference is, "Bowes" has made the leak public, how long has Spammers been getting these files, 6 months, 12 months, ever since Facebook was created.
in my opinion "Bowes" should be credited, for bringing such a situation into public eyes.
although sharing the info on Torrent sites is completely un-ethical (and I do not condone that in anyway)
but I can understand "Bowes" frustration, thousand of people has been accessing this information from facebook for how long.....
there is no excuse...... no justification...... to be able to get to these files so easily.....
Facebook infrastructure clearly needs a security overhaul, basic countermeasures and behind the scenes encryption could completely null this situation with the exception to the professional hackers.
facebook wasn't even hacked for crying out loud, the security on my current windows xp pro with built in firewall is more secured than facebook..... LOL... a utter joke.
social network should not mean someone can grab 170 million people's detail just like that.
Score: 0
|*yawn*
They got names. They got a snippet of "friends". That's it. It's public because it is *supposed* to be.
The only reason this would be a Bad Thing was if it was data that wasn't supposed to be public. As usual, the "end-of-the-world"ers are blowing this way out of proportions and getting all their signs ready to go shouting on street-corners.
Score: -1
|"Friends, and a few snippets here and there" wake up "Tool"
we are talking about 170 Million names and details in the hands of one person (or small group).....
unless of course you think that's ok "Tool", maybe you do,
if you do as it does seem that way, clearly my bar is a lot higher than yours, my attitude is facebook as with others who offer the same service owe to there users some form of basic protection, make the criminals work for the information, not just give it away.
I think you would be a good representative for facebook in this situation "Tool"
"Plausible Deniability" the old reliable tactic that big companies love to use,
didn't think that would be your style personally though.......
Your not being funded by Spammer companies on the side are you "Tool"?.....Emm
Score: 0
|First, if you're going to quote me, do it right.
"They got names. They got a snippet of "friends". "
Not, "Friends, and a few snippets here and there".
Keep trying, though.
That was barely worth the effort... Care to try again?
They got names. Nothing the the criminals would *need* to work for to begin with. Ever heard of a *PHONE BOOK*??
"basic protection"
Check out there privacy settings. Yeah, I know...that might involve actually *using* the product/service you're ranting against... They offer a hell of a lot more than "basic" protection.
Score: -2
|"The data includes names, addresses, e-mails, phone numbers, and birthdays: essentially anything that was not marked as private is now part of this file."
as opposed too
"They got names. Nothing the the criminals would *need* to work for to begin with"
we're both keep trying yeah.
and read the bit carefully, anything that was marked as NOT PRIVATE.
get it now, perhaps you should try not to be so judgemental on everyone, not everyone is lucky enough to have your vast brain power, people in general only use a service, facebook should go out there way to protect everyone who use there service, even people who don't understand the full implications of there choices concerning security, which sequels what, most of them...
you really do seem to be underplaying the importance of this situation, perhaps a phone-call at 1.33am to your sister from a stranger who got the number through this source would wake you up.
would you honestly look into your sisters eye's and say to her "it's your fault for not understanding how to use facebook properly"....i really do hope not!!!
Score: 0
|Hop on the net. Go somewhere *other* than BN. You might find that sometimes BN gets it wrong.
"perhaps a phone-call at 1.33am to your sister from a stranger who got the number through this source would wake you up."
The same number that's in the phone book? Yeah...I'd be *real* pissed @ FB for that one...
Being reasonable != underplaying. You however, seem to have some keen desire to blow this way the hell out of proportion. What....not enough "friends"?
Score: -2
|no need to resort to personal insults, says a lot about a person who resorts to personal attacks...
Score: -1
|See your first response.
It does indeed...
-PC_"Tool"
Score: -1
|erm...
Has anybody seen this...?
http://youropenbook.org/
Score: -2
|Ok first of all, this article is a lie.
The torrent contains, *drum roll* NAMES. Thats it.
The script downloads, NAMES, from the directory service.
Second, unless he's a user, he's not agreeing to the TOS of the website.
Third, theres nothing that isn't already public that is being stated that might be in the file.
Fourth! Application developers get way more access to your private info on facebook than the directory service does. You have a friend you don't know? They get access to your email, your phone number, that isn't part of the directory service.
GET YOUR FACTS STRAIGHT!
Score: 1
|Whats the fuzz about FB is just not a private network it's a social network.. Why should you set all your data private when "rolling" around on FB while nobody is able to find you... It's all about getting connected to others no more no less. And for those who don't like it... stay away from FB easy as that!
Score: 0
|OK, he violated TOS and he put the data he mined on a torrent. But he's a "researcher". Riiiight. And the people who've flagged his back accounts are just "financial administrators".
Score: -5
|"To ensure that your own data is not at risk, users of Facebook should take the following steps."
Too late. If they bothered to read their own article they would know that all public information has already been downloaded and distributed. That would be like installing a fire alarm after the building has burned down.
Score: 3
|But you get that free FarmVille crap!
Score: 1
|And DesktopDating and what not fraudulent offers from your friends playing Farmville.
Score: 1
|OMG Facebook is revealing the stuff I asked them to make public WTF!!!!!!!!
Score: 3
|The problem is, it is not that someone asked to make it public, it's that it is public by default.
Score: 0
|Public?? On a *SOCIAL NETWORKING* site??
*gasp* *choke* *cough* *spit*
Will the horrors never end?!!?!?
You "end-of-the-world"ers really need to get a friggin' life.
Score: 1
|OMG you are an idiot. Your stuff may be public but what about your friends stuff they wanted to keep privat and now your profile shows your privat friends stuff as well ?
Score: -3
|Actually, you are the idiot ....his point is still valid it's a public site. If your friends have their stuff private it still is private.
Score: 0
|Actually if a person posts a pic of your friend and tags them, it's instantly viewable to you... Even if their album is set to private.
Score: -1
|s/Personal/Public/
Anyone can collect this information even without the torrent. Not a big deal. If this causes some people to reconsider their privacy settings, that's great, but there is no NEW reason to be any more concerned than before.
The article has the right tone, but the title makes it sound different.
Score: -1
|this file has been downloaded by spamers 10000 already, and counting. Have a nice spam days.
Score: 2
|