Beware: Hackers are able to gain access to names, phone numbers, pictures, and more in Facebook data using just a mobile phone number.
The vulnerability in the social network was discovered by researcher Reza Moaiandin.
Moaiandin, a technology director at Salt.agency, a UK-based company, managed to breach Facebook by exploiting a little-known privacy setting in a feature called “Who can look me up?” The feature is set to “Everyone/Public” by default, even in cases where the user has decided not to display their mobile number through their public profile.
The result was that Moaiandin could find Facebook users by typing their phone number into the social network. He could also get their names, profile pictures, and the locations that were on their profiles. This process can be programmed and automated through Facebook's API.
It should be mentioned that the best protection against these types of security issues is to not post anything that you don't want to be used against you.
Facebook can easily block automated data collection using Moaiandin's technique.
Moaiandin first shared the security issue on Facebook in April before going public last week.
What the researcher is emphasizing is that there is a privacy issue, not just a security vulnerability. In response, Facebook issued a statement that appears to downplay the issue, claiming that the percentage of data collection is not large, as it is limited by controls.
“Protecting the privacy of people who use Facebook is very important to us. We have the world’s leading network monitoring tools in place to ensure data security, and we have strict rules governing how developers can use our APIs to build their products,” a Facebook spokesperson said.
"Developers are able to access information that people have chosen to leave public," he added.
“Everyone who uses Facebook has control over the information they share, and that includes the information contained within their profiles. Our Privacy Basics has a number of helpful guides that explain how our members can secure their accounts,” the social network spokesperson added
See the post that mentions the Facebook bug.
