Shortly after the massive Facebook data leak, in which data –including phone numbers, Facebook IDs, full names and dates of birth – of 500 million users was leaked, the social media is facing a new privacy “crisis”: a tool that can link Facebook accounts associated with email addresses, even if users choose settings so that their emails are not visible publicly.
Read also: Facebook: Millions of users' data leaked - How to see if your data was exposed
On April 20, a video showing a researcher demonstrating a tool called “Facebook Email Search v1.0,” which (according to the researcher) could link Facebook accounts to up to 5 million email per day. The researcher — who said he posted the video after discovering a security flaw that Facebook said it didn’t believe was “important” enough to fix — fed the tool a list of 65,000 email addresses and watched what happened next.
See also: Ireland's Data Protection Commission (DPC) investigates Facebook data leak
The researcher said in the video – while crunching the list of addresses from the tool – the following: “As you can see from the output log here, I’m getting significant results from these. I’ve spent $10 to buy 200-odd Facebook accounts. And within three minutes, I was able to do this for 6,000 email accounts.”
Facebook, for its part, stated the following: “It appears that we incorrectly ‘closed’ this premiums bug report before reporting the issue to the appropriate team. We appreciate the researcher sharing the information and taking action to mitigate this issue, while we monitor developments to better understand the findings.”
Additionally, a Facebook spokesperson declined to answer a question about whether the company told the researcher that it did not consider the bug important enough to fix. However, the spokesperson said that Facebook engineers believe they have mitigated the leak by “weakening” the technique demonstrated in the video.
Proposal: UK: Will authorities have access to Facebook messaging services?
The researcher – whose identity remains confidential – pointed out that Facebook Email Search exploited a front-end vulnerability that he himself recently reported to Facebook, but the company did not consider it important enough to fix.
Additionally, the researcher noted: "Earlier this year, Facebook had a similar vulnerability that was eventually fixed. This is essentially the exact same vulnerability. And for some reason, despite the fact that I reported it to Facebook, the company told me outright that they would not take action on it."
Facebook has come under fire not only for providing tools that help collect vast amounts of data, but also for the way it tries to promote the idea that it does “little harm” to its users. A Facebook email accidentally sent to a reporter for Dutch publication DataNewsinstructed its PR people to “characterize this as an industry-wide issue and normalize it, pointing out that this is something that happens regularly.” Facebook also distinguished scraping from hacks and data leaks.
at this time if someone has exploited this flaw to create a massive database, but it certainly wouldn't be surprising. Finally, the researcher stressed that he believes this is a fairly dangerous vulnerability and that's why he would like to help fix it.
