Pierluigi Paganini June 30, 2018

Experts discovered a third-party quiz app, called NameTests, that was found exposing data of up to 120 million Facebook users.

A bug on the Nametests.com exposed data of over 120 million users who took personality quizzes on Facebook, the good news is that the flaw was addressed as part of the Facebook’s Data Abuse Bounty Program launched in April.

The issue resided in Nametests.com that shares users’ data with any third-party that requested it.

The flaw was reported by the researchers Inti De Ceukelaire, who explained that when loading a personality test, the website displays personal information loaded from http://nametests.com/appconfig_user.

The data loaded from Nametests.com was wrapped in JavaScript, this means that it could be shared with other websites.

“In a normal situation, other websites would not be able to access this information. Web browsers have mechanisms in place to prevent that from happening.” the researcher wrote in a blog post.

“Since NameTests displayed their user’s personal data in JavaScript file, virtually any website could access it when they would request it,”

The experts set up a website that fetched data about the visitor from the Nametests.com website. In turn, ametests.com provided the access token that could also be used to gain access to the visitor’s posts, photos and friends, depending on the permissions granted.

“NameTests would also provide a secret key called an access token, which, depending on the permissions granted, could be used to gain access to a visitor’s posts, photos and friends. It would only take one visit to our website to gain access to someone’s personal information for up to two months.” De Ceukelaire added.

Below the video PoC published by the expert that shows how NameTests was revealing visitor’s identity even after deleting the app.

In order to prevent such behavior, the user would have had to manually delete the cookies on their device.

The expert also discovered that the user information would continue to be available through the website even after they deleted the application. Users would have had to manually delete the cookies on their devices to prevent their data from being leaked.

The issue was reported to Facebook’s Data Abuse program on April 22 and the company and a fix was rolled out on June 25.

According to Facebook, the bug could “have affected Facebook information people shared with nametests.com”, in response to the incident the tech giant revoked the access tokens for everyone on Facebook who has signed up to use this app

“It was reported by Inti De Ceukelaire and we worked with the app’s developer — Social Sweethearts — to address the website vulnerability he identified which could have affected Facebook information people shared with nametests.com.” reads a post published by Facebook.

” To be on the safe side, we revoked the access tokens for everyone on Facebook who has signed up to use this app. So people will need to re-authorize the app in order to continue using it.”

Facebook awarded the expert with $8,000 instead $4,000 bounty because he chose to donate it to charity.

“I also got a response from NameTests. The public relations team claims that, according to the data and knowledge they have, they found no evidence of abuse by a third party. They also state that they have implemented additional tests to find such bugs and avoid them in the future,” the researcher concluded.

Pierluigi Paganini

(Security Affairs – Facebook, NameTests)

[adrotate banner=”5″]

[adrotate banner=”13″]