Facebook says a vulnerability that lets attackers find a Facebook profile given an email address is still active after being “erroneously closed out”
A video shared with researchers and Motherboard shows a tool linking email addresses to Facebook accounts. — Joseph Cox
Related Coverage
- Brace yourselves. Facebook has a new mega-leak on its hands Ars Technica · Dan Goodin
- Data-scraping tool can link millions of Facebook profiles to email addresses Engadget
Discussion
-
@josephfcox
Joseph Cox
on x
New: tool allegedly available online links email addresses to Facebook accounts in bulk, according to a video shared with researchers and Motherboard. Video shows churning through emails, finding the associated account. Privacy risk, Facebook acting on it https://www.vice.com/...
-
@underthebreach
Alon Gal
on x
HUGE: A source just tipped me off about a vulnerability that lets attackers find the profiles of almost any Facebook account using an email list. Facebook knows about the vulnerability and won't fix it even though it affects almost every Facebook user! https://www.youtube.com/...…
-
@underthebreach
Alon Gal
on x
The source mentions that a tool that utilizes the vulnerability is being actively exploited to generate tens of millions of matched profiles a day and is appended to the existing 533m Facebook phone numbers leak to create one massive database for malicious purposes.
-
@motherboard
@motherboard
on x
A tool lets a user see which email address is linked to a Facebook account even if the Facebook user didn't publicly advertise their address, according to a video sent to various researchers and Motherboard. https://www.vice.com/...
-
@josephfcox
Joseph Cox
on x
Here is a screenshot of the tool in action, churning through tens of thousands of email addresses and linking them to Facebook accounts. This shouldn't be possible, Facebook investigating [my redactions on image] https://www.vice.com/... https://twitter.com/...
-
@jason_koebler
Jason Koebler
on x
Hackers are circulating a tool that scrapes private email accounts associated with Facebook accounts en masse, researchers worry this can be tied to other dumps and will be bad: https://www.vice.com/...
-
@drs1969
Dr. David Smith
on x
Fuuuuuuuuuuuk. if this is correct. Every GDPR country should hit FB to the maximum extent possible. Lift off and nuke 'em from orbit. It's the only way to be sure. https://twitter.com/...
-
@ashk4n
Ashkan Soltani
on x
Looks like there might be yet another *active* vuln that permits someone to reveal the private email addr of @Facebook users The researcher claims the attack is similar to a previously disclosed/patched ‘Page Role’ vuln and that he's been able to harvest ~6000 accounts in ~3min h…
-
@underthebreach
Alon Gal
on x
Too little, too late, and only when contacted by journalists but we achieved another step towards privacy! “...taking initial actions to mitigate this issue while we follow up to better understand their findings” - Facebook spokesperson https://twitter.com/...
-
@ashk4n
Ashkan Soltani
on x
.@Facebook confirms this vulnerability is still active as they “erroneously closed out this bug bounty report before [fixing]” (ht @josephfcox) Unclear how long it was actively exploited, how many users affected, and if they will notify users and @FTC? https://www.vice.com/... ht…
-
@carolecadwalla
Carole Cadwalladr
on x
This looks...not good. @UnderTheBreach is the Israeli cybercrime researcher who discovered last week's breach of 533 million Facebook users https://twitter.com/...
-
@lorenzofb
Lorenzo Franceschi-Bicchierai
on x
NEW: There's another Facebook vulnerability that allows people to scrape data off the platform. A tool allegedly available online links email addresses to Facebook accounts in bulk. https://www.vice.com/...