5 ms·
540M Facebook Records Exposed
- badwolf 8y agoSeems it was 3rd party apps data stored in ... openly accessible S3 buckets. -_-
- nvr219 8y agoIsn't this the most common reason for these leaks? Does Amazon not have screaming red banners saying "this is gonna be openly accessible?"
- badwolf 8y agoIt seems just about every "data breach" like this turns out to be an S3 bucket left open to anyone, or a MongoDB instance left with default settings/etc... With how easy it has become to vacuum up such huge amounts of data, this type of "breach" really needs to stop :(
- themattress 8y agoNo screaming red banner, but each bucket does indeed get marked with large orange rectangle that reads “Public”. It’s easily noticeable. In my limited experience, a lot of the open buckets problem comes from the fact that access to * is the path of least resistance vs a proper IAM and bucket config. When feature work is on the line ain’t nobody got time for that :/
- wangchungtonite 8y agoA lot of devs likely using aws in this manner are also not likely using the web interface an instead operating from cli pipelines where it’s easy to miss
- sbr464 8y agoRecently (past couple of years) I’ve noticed you’ll also get emails notifying of any publicly accessible buckets.
- jasonlotito 8y agoNot red, but yes, they make it clear and obvious what this means. People don't do this by accident. It's 100% willful.
- kakarot 8y agoWho stands to gain for freely releasing this data?
- statguy 8y agoAlso, aren't the buckets private by default?
- kerng 8y agoAmazing how a third party can harvest that amount of data and Facebook is freely handing it out... they really have no control over the data they process and handle. It's been shown again and again. It seems Facebook should be forced to disable any kind of data sharing with 3rd parties since they obviously cannot make it work. They have enough issues with the security of internal data handling procedurs already that they have to fix, before giving data to third parties.
- SlowRobotAhead 8y ago>It seems Facebook should be forced to disable any kind of data sharing with 3rd parties since they obviously cannot make it work. That is a massive part of their model, so that will never happen. The alternative of course is to stop giving them data.
- anonytrary 8y agoThird parties can always just resort to web-scraping if API support is dropped. If you consistently scrape public pages on Facebook, you can amass a trove of data within a year. By supporting an API, Facebook offers a controlled avenue for this to happen, which people pay for because it's easier than scraping. It will still happen if this doesn't exist, though.
- mindfulplay 8y agoIt's the 21st century and I think it's time to stop calling these'records'.
- nvr219 8y ago540M Facebook compact discs exposed
- debaserab2 8y agoWhat do you call them?
- torqueTorrent 8y agoAlas, the 21st century provides the opportunity to address the growing scourge of using sounds or combinations of letters that communicate meaning without being divisible into smaller units capable of independent use.
- anonytrary 8y agoThese things are very hard to stop. First law of the internet says that if you have a public website, it will be scraped and turned into structured data. Over the years, Facebook has been adding more options to make profiles private, etc. but there are still loopholes around these things with 3rd party "delegated" authentication.
- torqueTorrent 8y agoThey were moving so fast that they broke things, badly!
- jakequist 8y agotl;dr - Somebody scraped massive amounts of FB data over a number of years and then abandoned it on a public S3 bucket.
- testplzignore 8y agoThe "540 million records" wording seems misleading (probably intentionally by UpGuard and/or TechCrunch). The screenshot on https://www.upguard.com/breaches/facebook-user-data-leak https://www.upguard.com/breaches/facebook-user-data-leak leads me to think that this is 540m object records of various types (posts, comments, etc), not records of 540m distinct users like some readers would think. It sounds like a lot, but it's not. You could probably scrape that much data from public Facebook pages in a few days without even being logged in, especially a few years ago. Heck, you could say right now that Reddit has billions of user records exposed if you define them that way. The Hacker News first page itself links to thousands of user records :)
- collingreene 8y agohttps://www.facebook.com/data-abuse https://www.facebook.com/data-abuse - as mentioned in the article this scenario (non-fb companies mishandling fb user data) is exactly the reason Facebooks data abuse bounty program exists. Hopefully the finders of this submitted to the program.
- dang 8y agohttps://news.ycombinator.com/item?id=19565408 https://news.ycombinator.com/item?id=19565408