9 ms·
When Myspace Was King, Employees Abused a Tool Called ‘Overlord’ to Spy on Users
- swixm 7y agoIsn't this expected to happen? Especially back then... It might not fly in this day and age I guess.
- rolltiide 7y agoIt is perfectly normal and easier and prevalent in this day and age https://www.fullstory.com/ https://www.fullstory.com/ One javascript import statement and you are recording your users entire session activity There are whole startups offering this service to other startups
- pavel_lishin 7y agoWe're not talking about the 1300's. If it's unethical now, it was unethical then.
- maxme3 7y agoWhat's the name of the Facebook equivalent?
- ditonal 7y agoGoogle scares me much more, for me, my data on Facebook is nothing compared to the amount of my personal data on Gmail and Docs. Having worked at Google, a regular cog in the wheel engineer getting access to sensitive user data is carefully monitored and logged for appropriate usage, but I also strongly suspect that if a powerful player like Schmidt/Brin wanted to get the dirt on private user data they would have no problem, because there is a strong culture of secrecy that labels any sort of whisteblowing as "leaking", considered the most cardinal of sins by most Googlers.
- rhacker 7y agoIt definitely scares me that someone like Schmidt would have access to that personal data. Brin, Page - meh but I would still rather them not.
- ditonal 7y agoI agree that Schmidt is a good example of someone who's already demonstrated willingness to use his power to bully those he perceives as political opponents, but the principle that access to such an incredibly dangerous power exists, and that existing regulation can barely if at all limit it, is really the problem. Forget any specific individual and ask yourself if we can trust every high level Alphabet exec who could pull some strings and make sure it doesn't get "leaked" that those strings were pulled in decades to come.
- mevile 7y agoWas this meant to be a reply to another comment? How does this answer the question your parent comment asked?
- ditonal 7y agoThis might help you: https://en.wikipedia.org/wiki/Rhetorical_question https://en.wikipedia.org/wiki/Rhetorical_question If Facebook has such a tool, it's certainly not public knowledge. The parent comment was clearly meant to make a point that Facebook could have such a tool, even if it's not public knowledge. I was expanding on that point that Google could as well. Hope that helps.
- exfbthrowaway 7y agoIt was called ‘super’ and it was most famously abused by an intern that blabbed to the press about using it. They then added more restrictions and auditing to ‘super’ which was supposed to be mostly for investigations and user operations teams to help users with their own account issues. Also at that time Zuck’s own account was always super so...
- coderintherye 7y agoAuditing sure, but almost any Facebook software engineer has permission to still take super user actions. The ability to abuse is still there, it's just a question if they actively audit well enough to catch the abuse.
- sonnyblarney 7y ago"but almost any Facebook software engineer has permission to still take super user actions" If this is true, I find it shocking in light of all of the recent allegations especially.
- kerng 7y agoReally? Any intern could just request access and get it, and maybe get caught abusing the access? Not sure if you can share more, but this seems way to easy and auditing is, well, to late.
- gnu8 7y agoAt a real company you have to write up something saying what you are planning on doing before taking any action, eg change control. I don't think that type of thing fits into the "move fast and break things" culture though.
- darkwizard42 7y agoWhen I was at FB you had to go through two confirmation modals and at least from my team (biz intelligence on ads side) it said an email would be sent to my manager if I proceeded. I never worked in a role that required me to go further, but the penalty of losing my job deterred me just fine.
- bduerst 7y agoNot sure about FB, but Uber's was called God View - https://www.theguardian.com/technology/2016/dec/13/uber-employees-spying-ex-partners-politicians-beyonce https://www.theguardian.com/technology/2016/dec/13/uber-empl...
- angel_j 7y agoFacebook
- deanclatworthy 7y agoIf you found this article or the idea interesting, be sure to check out one of the latest episodes [1] of Black Mirror. [1] https://www.imdb.com/title/tt8758202/?ref_=ttep_ep2 https://www.imdb.com/title/tt8758202/?ref_=ttep_ep2
- EpicEng 7y agoUnfortunately I did not find that episode of Black Mirror interesting.
- zapzupnz 7y agoI don't know why you were downvoted. It's perfectly possible to find a concept interesting but some show's execution upon it uninteresting.
- gramstrong 7y agoSometimes it can help to give an explanation instead of just making an opinionated statement. Saying you found it uninteresting doesn't really contribute much to a conversation.
- zapzupnz 7y agoGood point, although there was value enough in the comment. That is, one can extrapolate that just because the episode was related to the topic, that doesn't make it intrinsically interesting in and of itself — as might be implied by the original comment and link.
- rxhernandez 7y agoI found this entire season to be sophomoric. A lot of the previous episodes were dense in subject matter that's not too often explored; the subject matter in this season has all been going on for the past decade or two and you would have to have not been paying any attention to the news while maintaining absolutely no interest in transgender topics for this to be meaningful. !!!!!! SPOILERS FOLLOW !!!!!! Episode 1 - "a guy explores his gender in a video game and finds that he enjoys a gender different than the one he's playing in real life. His friend finds that he enjoys his friend in that gender despite not being gay." Big deal? People have been doing this in real life without the aid of video games for decades now. Episode 2 - "a guy gets addicted to social media and (potentially) kills his significant other because he was paying attention to his social media while driving. He coerces the CEO of said social media into talking to him, CEO pays him some lip service after "triangulating" who this guy is through minimal information. Guy dies. Life goes on." I mean what's surprising here? Who hasn't looked up a blind date with Google to figure out whether or not they're a psycho? Laymen already have this information easily accessible to them. I've done a background check on myself, out of curiosity, and I found my address, phone number and email by just looking up the city I'm from and my name. Social media profiles are even easier to find. Or was it the fact that the CEO paid convincing lip service to some guy and then doesn't follow through with it? Or was it that life goes on after you die? Big whoop? Episode 3 - I mean why bother, it was just another feel good episode on a topic black mirror already explored.
- AdmiralAsshat 7y agoNever mentioned in the article, but I'd wager that "overlord" is a reference to the StarCraft unit.
- ssully 7y agoI am a big fan of StarCraft, but I am sure that Overlord was just used for it's dictionary definition in this case.
- AdmiralAsshat 7y agoI suppose it would depend on the program's primary purpose. If it was the equivalent of "God mode" and the spying power was just one of many abilities, then yes, the dictionary definition of "overlord" would make sense. If the explicit purpose was spying on users, however, the StarCraft unit reference seemed more apt because the Overlord unit is often used in early game to do recon, often before the other player has had a chance to build anti-air defenses, such that the Zerg player can "spy" on the other bases without their being able to do anything about it.
- deleted 7y ago[deleted]
- lhotkins 7y ago“Let them view users’ passwords”... sigh
- ytNumbers 7y agoThose young employees had so much power that they acted like they were the "Kings of MySpace". It's no surprise shenanigans ensued. It reminds me of some other youngsters back then who called themselves "The Kings of MySpace": https://www.youtube.com/watch?v=2N1lIl3pGac https://www.youtube.com/watch?v=2N1lIl3pGac
- arkadiyt 7y agoThis is all too common. I teach "Security 101" onboarding to new hires at my company and this is one of my slides: - Google Engineer Stalked Teens, Spied on Chats: http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats http://gawker.com/5637234/gcreep-google-engineer-stalked-tee... - Lyft Investigates Allegation That Employees Abused Customer Data: https://www.theinformation.com/articles/lyft-investigates-allegation-that-employees-abused-customer-data https://www.theinformation.com/articles/lyft-investigates-al... - Uber Employees Allegedly Use Data to Stalk Exes, Celebs: http://www.newser.com/story/235409/lawsuit-uber-employees-use-data-to-stalk-celebs-exes.html http://www.newser.com/story/235409/lawsuit-uber-employees-us... - Facebook Investigating Claim That Employee Used 'Privileged Access' to Cyber-Stalk Women: https://gizmodo.com/facebook-investigating-claim-that-employee-used-privile-1825666305 https://gizmodo.com/facebook-investigating-claim-that-employ... - Snapchat Employees Abused Data Access to Spy on Users: https://www.vice.com/en_us/article/xwnva7/snapchat-employees-abused-data-access-spy-on-users-snaplion https://www.vice.com/en_us/article/xwnva7/snapchat-employees... I suspect the vast majority of these abuse cases never make it to the public.
- walshemj 7y agoMaybe you should add the Case in the UK where some one bribed some BT call centre employee to look up address of the parents of some one in witness protection. Parents where then killed by a hitman - bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that.
- stordoff 7y ago> During the investigation of the Stirland murders, police found that corrupt BT workers had given out details of where the couple had moved. As a direct result, Gunn was able to track them down. Of note, not witness protection: > The couple declined to join a witness protection programme and instead decided to leave their Nottingham council estate. > The pair, originally from Nottingham, were forced into hiding when Mrs Stirland's son, Michael O'Brien, murdered a man connected to a criminal gang in 2003. [the son was in jail: https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickbarkham https://www.theguardian.com/uk/2004/aug/11/ukcrime.patrickba...] https://www.theguardian.com/uk/2008/feb/22/ukcrime1 https://www.theguardian.com/uk/2008/feb/22/ukcrime1 > bent employees got done on various conspiracy charges - tarrif is something like 10 -20 years for that. At least two of the employees got a suspended sentence: > Kelly and Pickering later admitted computer misuse and were given suspended jail sentences. Both were sacked by BT. http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.stm http://news.bbc.co.uk/1/hi/england/nottinghamshire/4821810.s... I can't find what happened to the first - the one who had direct contact with the gang.
- txt 7y agoMyspace had alot of issues when it came to security. At one point I was discovering multiple exploits every week that gave me access to any account I wanted. Most were patched up in a few days, using some temp workaround that would end up creating a new hole to explore lol, it was the wild west for me. Now I never used it to pull sensitive data or any type of illegal activities such as fraud etc..BUT I may have had quite a few sites that suddenly had millions of active users browsing them. ;] Im sure if I hopped on some of my old machines, I could post some interesting code from those days...
- cesarb 7y ago> Myspace had alot of issues when it came to security. Obligatory: "The MySpace Worm" https://samy.pl/myspace/ https://samy.pl/myspace/
- fortran77 7y agoBack in Web 1.0 (1999 or so) I worked for what was then a large Social Network. There was no security. Any engineer could look at anything. When the thing went belly-up (it was acquired and then ended) the servers were scrapped without even being wiped. Someone probably bought them at WeirdStuff.
- billpg 7y agoI'm trying to think what was around back then that could be described as a social network. Geocities?
- tyingq 7y agoAIM, MSN, Tripod, and others could have been considered social networks in that era.
- hackinthebochs 7y agoBlackplanet.com perhaps? If not the original social network, then certainly one of the first.
- fortran77 7y agoOne fact about it: It was the only one that worked well on a WebTV. It turns out we had a lot of people in prisons using it, because some prisons had gotten WebTVs not knowing that the inmates could use it. The Management didn't care, as long as there were pageviews. (Which I was directed to inflate by our CFO.)
- annadane 7y agoFacebook, Myspace, Snapchat... is it that hard to, you know, not do asshole things when you sign on in a position of responsibility working for these companies?
- busymom0 7y agoAs much as we would love that to happen in a fair and just world, human beings are flawed creatures and majority would abuse their position of power when given so. Time and time again, this has been proved to be true.
- calibas 7y agoI think the potential for abuse would be extremely tempting for anybody and also make those positions very attractive to the wrong kind of person. In a more honest world, these companies would be bending over backwards to prove that they can be trusted, instead we're asked to trust them largely on faith alone.
- finnthehuman 7y agoEveryone thinks they’re justified doing evil. That’s just humanity. I don’t trust myself with access, nobody should. I have to get my software signed by a different department to deploy it. (Yeah, sure, I do have disaster recovery access but unless the org is collapsing, it gets rotated out of service and audited.)
- aaronmgdr 7y agoI worked at a small company that had a kinda internal business social network tool where the devs and customer service people could do this. We called it superadmin. Eventually we anonymized the actual posts and employee names but for a while we could literally see everything. Technically afterward we still could if we had prod db rights and just connected straight to that.
- anbop 7y agoWhen used benevolently this is an important tool for seed stage startups to gauge product market fit. I used to silently join user interactions in real time and observe them. really helped improve the product quickly
- finnthehuman 7y ago“It’s OK when I do it”?
- rurp 7y agoThis does not sound ethical at all and seems to reinforce the point that we should default to being suspicious of any company that holds our data.
- DrJokepu 7y agoDid you tell the users that you're observing them?
- lanrh1836 7y agoLiterally every company has a tool like this. It’s more a question on what is a company doing to define and enforce justifiable usage among employees. At a well known “unicorn” I worked at a few years ago someone was reportedly fired for looking up celebrity accounts.
- wil421 7y agoI’ve heard rumors from friends and family that people get fired at hospitals for looking up celebrities all the time.
- Haga 7y agoIf you date sb at fb or Google, you know what you get yourself into..
- lwhi 7y agoNot surprising. This is the number one reason why we should be wary of producing these platforms. Security and privacy can only be looked after—in the way most people want—if the potential for human interest is _completely_ removed.
- oneluv1464 7y agoDon't waste your time and resources for bogus hackers, Tom's is a reliable hacker everybody should contact, His a Straightforward and honest man. I contacted one hacker who i found his review online to hack my husband phone for me,after i sent him money he went black and radio silent and i was perplex and anxious which compelled me to tell a friend of mine and She shared her testimony how Hack Tom's helped increase her Credit Score that she applied for Mortgage loan and it was granted. The convince me and gave me courage to give Hack Tom's trial. ( Reliablecybersolution58àtgmailcom or whatsapp +1 662 727 5740) After 30 minutes,I was enables to monitor all the activities on my husband phone including call history, location, E-mails, Document,Photo, Video, Social Apps like WhatsApp, Skype, Facebook, Instagram, Snapchat, Kik, Tinder, Line and more on his phone. the good news is it completely untraceable, undetectable and it has a 195 days life span and his fast in delivery. I PROMISE TO TELL THE WHOLE WORLD ABOUT HACK TOM'S FOR SAFE ME FROM UNFAITHFUL AND UNHEALTHLY MARRIED.