Bug in Facebook Messenger exposed users' data

Friday, 08 March 2019, 13:20 Hrs
32
cmt right
22
Comment Right
55
cmt right
11
cmt right
Printer Print Email Email
Bug in Facebook Messenger exposed users' data


As Facebook CEO Mark Zuckerberg discussed about making his platform more secure, a bug in Facebook Messenger allowed websites to gain access to users' data, including who they have been chatting with, say researchers.

Now fixed by Facebook, the vulnerability in the web version of Messenger allowed any website to expose who you have been messaging, revealed Ron Masas, researcher with cyber security company Imperva, in a blog post late on Thursday.

The researcher reported the vulnerability to Facebook under their responsible disclosure programme and the social media platform mitigated the issue.

In November 2018, Masas and his team discovered a Facebook bug that allowed websites to extract data from users' profiles via cross-site frame leakage (CSFL) which is known as a side-channel attack performed on an end user's web browser.

"Browser-based side-channel attacks are still an overlooked subject. While big players like Facebook and Google are catching up, most of the industry is still unaware," wrote Masas.

Facebook Messenger has over 1.3 billion users globally.

Zuckerberg on Thursday said he is working to make Facebook "privacy-focused" like WhatsApp.

The "privacy-focused platform" will be built around principles like private interactions, encryption, reducing permanence, safety and interoperability.

Despite Zuckerberg's plan to make Facebook privacy-focused, the latest report suggests that the platform is not immune to vulnerabilities.

In December 2018, Facebook admitted that about 6.8 million users might have put their private photos at risk of being exposed to third-party apps.

The company said that more than 1,500 apps built by 876 developers might have also been affected by the bug that exposed users' unshared photos during a 12-day-period from September 13 to September 25, 2018.

The social networking giant last year came under increased scrutiny of lawmakers around the world after several scandals surrounding security and privacy concerns surfaced



Read More News:



Building AI without women will lead to biased results: Microsoft



Microsoft releases refreshed 'Skype for Web' on Chrome, Edge browsers


Source: IANS
SPOTLIGHT
Google's Gboard gets offline
Google is adding an Artificially Intelligent (AI) offline dictation feature on its Gboard keyb..
Wipro opens third industrial
IT major Wipro Ltd on Thursday opened its centre of excellence for Industrial Internet of Things (..
IBM announces programme
n a bid to recognise the contribution of developers in the open source community, Information ..
Facebook denies cyber attack
Facebook ruled out a cyber attack on its products Whatsapp, Instagram and Messenger, which suf..