Pierluigi Paganini April 05, 2018

Third-party scrapers have exploited an issue in the Facebook ’s search function that allows anyone to look up users via their email address or phone numbers.

Facebook revealed on Wednesday that 87 million users have been affected by the Cambridge Analytica case, much more than 50 million users initially thought.

Facebook is the middle of a storm, Mark Zuckerberg admitted public data of its 2.2 billion users has been compromised over the course of several years by third-party actors that gathered information on its users.

Third-party scrapers have exploited an issue in the Facebook’s search function that allows anyone to look up users via their email address or phone numbers.

Users name come up in Facebook searches is they don’t explicitly disable this security setting.

“Until today, people could enter another person’s phone number or email address into Facebook search to help find them. This has been especially useful for finding your friends in languages which take more effort to type out a full name, or where many people have the same name.” reads a blog post published by  CTO Mike Schroepfer.

“However, malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery. Given the scale and sophistication of the activity we’ve seen, we believe most people on Facebook could have had their public profile scraped in this way. “

Zuckerberg confirmed the extent of the scraping activity during a call with the press:

“I would assume if you had that setting turned on that someone at some point has access to your public information in some way.” explained Zuckerberg.

Zuckerberg blamed himself for what has happened to his company and promtly announced further improvements in term of privacy and security.

When asked if he still considered himself the best person to run the company, he said, “Yes.”

Pierluigi Paganini

(Security Affairs – Zuckerberg, privacy)

[adrotate banner=”5″]

[adrotate banner=”13″]