Facebook Hack Revealed Any User's Private Email Address

A Facebook bug bounty hunter recently discovered a serious security vulnerability that allowed him to view the private email address of every Facebook user.

The security researcher, Tommy DeVoss, discovered the bug on Thanksgiving Day and reported it to Facebook. After going back and forth with the site for several weeks, he was finally awarded $5,000. through the site’s Bug Bounty program.

The security flaw stemmed from the Facebook Groups tool that allowed admins to invite any Facebook member to take on an admin role.

These admin invitations were sent to the recipients' private email addresses, and DeVoss discovered that when he canceled pending invitations, he was taken to a page where he could view the full email addresses of the people he'd invited.

As DeVoss pointed out, this hole in Facebook's security could’ve caused massive problems for the site.

"The hack allowed me to harvest as many e-mail addresses as I wanted from anybody on Facebook. It didn't matter how private you thought your e-mail address was - I could have grabbed it", DeVoss said.

"Harvesting email addresses this way contradicts Facebook's privacy policy and could lead to targeted phishing attempts or other malicious purposes."

It's heartening that so many security researchers do the right thing and report these hacks when they find them. However, some don't, and that's always the concern with giving Facebook so much of your personal information.

https://threatpost.com/clever-facebook-hack-reveals-private-email-address-of-any-user/122723/

http://facecrooks.com/Internet-Safe...vealed-Any-User’s-Private-Email-Address.html/

Cool.

Haha 5 grand... imagine how much some blackhatters would pay for that incredible bug.

I'm sure many people gathered a lot of data this way.

He could have sold it for way more.........

hippo123 said:

He could have sold it for way more.........

Click to expand...

He could have been making himself the most ultra targeted email lists ever.

Especially on profiles public with their likes. It's amazing the potential...

wow that is great!! lol

Nice read and indeed a white hacker.

5k is an insult.

I'll make a prediction for 2017...The year of the Great Facebook Hack.

People on here would have paid so much more for that..

These kind of people are very stupid. They do stupid things for fame and shitty 5k.

Plus the majority are using their 100% real emails with Facebook! No bullshit emails. You have the perfect direct line to anyone famous or whatever. Can find out what agencies are managing what pages, etc.

This guy is a huge clown.

More about FB from "Facecrooks"...

Facebook Is Buying Your Private Data From Third-Party Brokers

Most savvy Facebook users understand that the social media giant traffics in our data. The things you tell the site help it target advertising to you, and thus make more money. However, according to a bombshell report from ProPublica this week, Facebook is also buying your private data from third-party brokers. The information it buys includes financial data like your income, credit card usage, and even what kind of restaurants you like to frequent.

Facebook has admitted that it obtains user data “from a few different sources,” though the vast majority of users don’t understand exactly what that means. According to the report, Facebook gathers “detailed dossiers” from third-party data brokers on users’ offline lives. The site says that it doesn’t fully disclose this to users because all of that information is already available — but that excuse doesn’t pass muster with some experts.

"They are not being honest," Jeffrey Chester, executive director of the Center for Digital Democracy, told ProPublica. "Facebook is bundling a dozen different data companies to target an individual customer, and an individual should have access to that bundle as well."

Facebook can't get its hands on enough data, so it's not surprising that it actually purchases more of our private info. But it's still troubling that the site seemingly tries to hide that fact from users.

from propublica...



“Our approach to controls for third-party categories is somewhat different than our approach for Facebook-specific categories,” said Steve Satterfield, a Facebook manager of privacy and public policy. “This is because the data providers we work with generally make their categories available across many different ad platforms, not just on Facebook.”

Satterfield said users who don’t want that information to be available to Facebook should contact the data brokers directly. He said users can visit a page in Facebook’s help center, which provides links to the opt-outs for six data brokers that sell personal data to Facebook.

Limiting commercial data brokers’ distribution of your personal information is no simple matter. For instance, opting out of Oracle’s Datalogix, which provides about 350 types of data to Facebook according to our analysis, requires “sending a written request, along with a copy of government-issued identification” in postal mail to Oracle’s chief privacy officer.

Users can ask data brokers to show them the information stored about them. But that can also be complicated. One Facebook broker, Acxiom, requires people to send the last four digits of their social security number to obtain their data. Facebook changes its providers from time to time so members would have to regularly visit the help center page to protect their privacy.

One of us actually tried to do what Facebook suggests. While writing a book about privacy in 2013, reporter Julia Angwin tried to opt out from as many data brokers as she could. Of the 92 brokers she identified that accepted opt-outs, 65 of them required her to submit a form of identification such as a driver’s license. In the end, she could not remove her data from the majority of providers.

ProPublica’s experiment to gather Facebook’s ad categories from readers was part of our Black Box series, which explores the power of algorithms in our lives. Facebook uses algorithms not only to determine the news and advertisements that it displays to users, but also to categorize its users in tens of thousands of micro-targetable groups.

https://m.facebook.com/help/494750870625830

Many bugs can look underpaid to members here. Bug to verify any Facebook page : $3000 . It is obvious that such pages can sell for good amount and if you have a stock, you are already rich . One thing we should remember is that these bugs are anyway going to he patched as if you do not report it some other researcher will.