Facebook fixes security flaw after private Zuckerberg photos leaked
Flaw in Facebook's system for reporting inappropriate content apparently used by adults to view pictures of underage users
One of the leaked photographs of Facebook chief executive Mark Zuckerberg with girlfriend Priscilla Chan. Photograph: Facebook
Facebook has scrambled to shut down a security hole that let anyone view photos marked as "private" – and which has apparently been used by adults to view pictures of underage users without their knowledge.
Posts on a bodybuilding site seen by the Guardian suggest that it was used by adults to view pictures of children. Facebook allows people to join if they are aged 13 or over; in practice, many schoolchildren aged 11 create accounts by lying about their birthdate.
The flaw appears to have existed in Facebook since an update to its system in mid-November and lets users view others' private photos by first reporting their profile picture as "pornographic".
However, it was only fixed when the account of Facebook founder and chief executive Mark Zuckerberg was targeted on Tuesday. Personal pictures of Zuckerberg rapidly began circulating on the internet, including an image of his meeting President Obama and other shots of him with his girlfriend Priscilla Chan.
"I did three of these with my real profile then realised I might get banned for doing it, so I switched to a different profile," wrote one poster on a bodybuilding forum where the flaw seems first to have been made public on 27 November.
Once a profile picture was reported as supposedly pornographic, Facebook's reporting system would then give them the opportunity to view the user's other pictures – including, due to the error, private ones. The theory was that other pictures could be reported to Facebook too.
Facebook could not say how many peoples' private pictures had been viewed as a result of the flaw – and it appears that all users of the social network were able to exploit it.
The security lapse is a serious embarrassment for Facebook, coming just a week after it signed a 20-year agreement over privacy issues with the powerful US Federal Trade Commission, which charged that it "deceived consumers by failing to keep privacy promises".
Facebook said in a statement: "Earlier today, we discovered a bug in one of our reporting flows that allows people to report multiple instances of inappropriate content simultaneously. The bug allowed anyone to view a limited number of another user's most recently uploaded photos irrespective of the privacy settings for these photos.
"This was the result of one of our recent code pushes and was live for a limited period of time. Upon discovering the bug, we immediately disabled the system, and will only return functionality once we can confirm the bug has been fixed."
Only last week, Zuckerberg posted an admonished admission on the company blog that "we've made a bunch of mistakes" relating to users' privacy after reaching a settlement with the FTC.
Graham Cluley of Sophos said: "The flaw worked like this. If you're a Facebook user, you can report other users' profile pictures as being 'inappropriate'. For instance, you can say that they contain 'nudity or pornography'.
"However, Facebook then gives an opportunity to select 'additional photos to include with your report' and displays a selection of photographs – which might not be shared publicly."
Cluley observed that the error would have been introduced because Facebook's ethos, depicted in posters on its wall, is "Move Fast and Break Things" – but, he adds, not "Privacy Matters".
"Facebook's programmers are experimenting with new features and are testing them out on the live site without, in this case at least, the code being properly reviewed with privacy in mind," Cluley said.
Facebook said: "The privacy of our user's data is a top priority for us, and we invest significant resources in protecting our site and the people who use it. We hire the most qualified and highly-skilled engineers and security professionals at Facebook, and with the recent launch of our Security Bug Bounty Program, we continue to work with the industry to identify and resolve legitimate threats to help us keep the site safe and secure for everyone."
The FTC settlement "bars Facebook from making any further deceptive privacy claims, requires that the company get consumers' approval before it changes the way it shares their data, and requires that it obtain periodic assessments of its privacy practices by independent, third-party auditors for the next 20 years".
Charles Arthur
guardian.co.uk, Wednesday 7 December 2011 13.45 GMT
© 2011 Guardian News and Media Limited or its affiliated companies. All rights reserved.
http://www.guardian.co.uk/technology/2011/dec/07/facebook-security-flaw-zuckerberg-photographs
Flaw in Facebook's system for reporting inappropriate content apparently used by adults to view pictures of underage users
One of the leaked photographs of Facebook chief executive Mark Zuckerberg with girlfriend Priscilla Chan. Photograph: Facebook
Facebook has scrambled to shut down a security hole that let anyone view photos marked as "private" – and which has apparently been used by adults to view pictures of underage users without their knowledge.
Posts on a bodybuilding site seen by the Guardian suggest that it was used by adults to view pictures of children. Facebook allows people to join if they are aged 13 or over; in practice, many schoolchildren aged 11 create accounts by lying about their birthdate.
The flaw appears to have existed in Facebook since an update to its system in mid-November and lets users view others' private photos by first reporting their profile picture as "pornographic".
However, it was only fixed when the account of Facebook founder and chief executive Mark Zuckerberg was targeted on Tuesday. Personal pictures of Zuckerberg rapidly began circulating on the internet, including an image of his meeting President Obama and other shots of him with his girlfriend Priscilla Chan.
"I did three of these with my real profile then realised I might get banned for doing it, so I switched to a different profile," wrote one poster on a bodybuilding forum where the flaw seems first to have been made public on 27 November.
Once a profile picture was reported as supposedly pornographic, Facebook's reporting system would then give them the opportunity to view the user's other pictures – including, due to the error, private ones. The theory was that other pictures could be reported to Facebook too.
Facebook could not say how many peoples' private pictures had been viewed as a result of the flaw – and it appears that all users of the social network were able to exploit it.
The security lapse is a serious embarrassment for Facebook, coming just a week after it signed a 20-year agreement over privacy issues with the powerful US Federal Trade Commission, which charged that it "deceived consumers by failing to keep privacy promises".
Facebook said in a statement: "Earlier today, we discovered a bug in one of our reporting flows that allows people to report multiple instances of inappropriate content simultaneously. The bug allowed anyone to view a limited number of another user's most recently uploaded photos irrespective of the privacy settings for these photos.
"This was the result of one of our recent code pushes and was live for a limited period of time. Upon discovering the bug, we immediately disabled the system, and will only return functionality once we can confirm the bug has been fixed."
Only last week, Zuckerberg posted an admonished admission on the company blog that "we've made a bunch of mistakes" relating to users' privacy after reaching a settlement with the FTC.
Graham Cluley of Sophos said: "The flaw worked like this. If you're a Facebook user, you can report other users' profile pictures as being 'inappropriate'. For instance, you can say that they contain 'nudity or pornography'.
"However, Facebook then gives an opportunity to select 'additional photos to include with your report' and displays a selection of photographs – which might not be shared publicly."
Cluley observed that the error would have been introduced because Facebook's ethos, depicted in posters on its wall, is "Move Fast and Break Things" – but, he adds, not "Privacy Matters".
"Facebook's programmers are experimenting with new features and are testing them out on the live site without, in this case at least, the code being properly reviewed with privacy in mind," Cluley said.
Facebook said: "The privacy of our user's data is a top priority for us, and we invest significant resources in protecting our site and the people who use it. We hire the most qualified and highly-skilled engineers and security professionals at Facebook, and with the recent launch of our Security Bug Bounty Program, we continue to work with the industry to identify and resolve legitimate threats to help us keep the site safe and secure for everyone."
The FTC settlement "bars Facebook from making any further deceptive privacy claims, requires that the company get consumers' approval before it changes the way it shares their data, and requires that it obtain periodic assessments of its privacy practices by independent, third-party auditors for the next 20 years".
Charles Arthur
guardian.co.uk, Wednesday 7 December 2011 13.45 GMT
© 2011 Guardian News and Media Limited or its affiliated companies. All rights reserved.
http://www.guardian.co.uk/technology/2011/dec/07/facebook-security-flaw-zuckerberg-photographs
