3 ms·

OK it's not surprising that rogue insiders – whether it's a regular ads employee, manager, or a site-reliability engineer – can attempt this kind of tampering.

by danso 7y ago

OK it's not surprising that rogue insiders – whether it's a regular ads employee, manager, or a site-reliability engineer – can attempt this kind of tampering. It is surprising that FB – who, if anything, is excellent at data and tracking – seems to lack seemingly basic access controls and detection mechanism to prevent this. According to BuzzFeed, FB only launched an internal investigation after BF asked questions about this employee: > A company spokesperson confirmed that an unnamed employee was fired after inquiries from BuzzFeed News sparked an internal investigation. The employee in question was based in the company’s Austin office, according to information obtained by BuzzFeed News. The article doesn't say exactly [0], but potentially a BF reporter might have noticed that scammy ad accounts that BuzzFeed previously reported on [1] – which FB then banned in response – were inexplicably active again. But why doesn't FB have an internal flag/bit for these egregiously scammy ad accounts (and their unique identifiers) in their systems? A flag that would trigger an automated notice/audit when that account was reactivated for any reason, by any employee? [0] It's possible the article under discussion was completely sparked by insider leaks to the BF reporter, e.g. "chat messages obtained by BuzzFeed News". I'm just saying that it's possible that the rogue activity potentially seems to have been observable by any outsider, i.e. completely observable and preventable if Facebook had proper access control. [1] https://www.buzzfeednews.com/article/craigsilverman/facebook-subscription-trap-free-trial-scam-ads-inc https://www.buzzfeednews.com/article/craigsilverman/facebook...

AJ007 7y ago
Remember when Google got in trouble for helping advertisers sell illegal drugs and even Larry Page knew a what was going on? I doubt Facebook cares. https://www.wired.com/2013/05/google-pharma-whitaker-sting/ https://www.wired.com/2013/05/google-pharma-whitaker-sting/
- danso 7y ago
  Actually this story did make me think about an even older article about Google [0]: in 2010, when a site reliability engineer was fired after allegedly spying on teens' Google accounts. At the time, it really underscored to me how much power – and potential to abuse it – that insider employees have. Particularly site reliability and security engineers, who inherently need to have this kind of power and access do do their jobs: > "If you're an SRE, for instance, on Gmail, you will have access to mailboxes because you may have to look into the databases," the former Google SRE—who did not work with Barksdale—explained to us by phone. "You'll need access to the storage mechanisms," he explained, pointing out that in order to determine the cause of a technical issue with Gmail, an SRE might have to access emails stored on Google's servers to see if data is corrupted. I'm assuming in the years since, Google's SRE have mechanisms in place to audit and log the use of sudo-level access and powers. Twitter, on the other hand, seems to not have implemented this, at least as of 2015 [0] I can imagine FB having decent auditing and logging when it comes to internal access of private data of user accounts. But not when it comes to ad accounts, considering the level of scammy activity these ad accounts had when BuzzFeed News reported on them [2] [0] https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... [1] https://news.ycombinator.com/item?id=21467921 https://news.ycombinator.com/item?id=21467921 [2] https://www.buzzfeednews.com/article/craigsilverman/facebook-subscription-trap-free-trial-scam-ads-inc https://www.buzzfeednews.com/article/craigsilverman/facebook...
dboreham 7y ago
Also surprised. I've been involved with designing and implementing "customer service portal" functionality for a couple of services that were quite small, and yet this is something we very much considered. For example we added rate limiting such that even though a CSR could override user account state via the portal, they couldn't do it that much without triggering a block on their ability to do it again.
imron 7y ago
> OK it's not surprising that rogue insiders – whether it's a regular ads employee, manager, or a site-reliability engineer – can attempt this kind of tampering. In this case, it was a "contractor". Next time, it will be an "intern" etc etc.
- lainga 7y ago
  "On Sunday, an unidentified wrecker sent by the Imperialist powers to humiliate Facebook..."

by danso 7y ago

AJ007 7y ago

Remember when Google got in trouble for helping advertisers sell illegal drugs and even Larry Page knew a what was going on? I doubt Facebook cares. https://www.wired.com/2013/05/google-pharma-whitaker-sting/ https://www.wired.com/2013/05/google-pharma-whitaker-sting/

danso 7y ago
Actually this story did make me think about an even older article about Google [0]: in 2010, when a site reliability engineer was fired after allegedly spying on teens' Google accounts. At the time, it really underscored to me how much power – and potential to abuse it – that insider employees have. Particularly site reliability and security engineers, who inherently need to have this kind of power and access do do their jobs: > "If you're an SRE, for instance, on Gmail, you will have access to mailboxes because you may have to look into the databases," the former Google SRE—who did not work with Barksdale—explained to us by phone. "You'll need access to the storage mechanisms," he explained, pointing out that in order to determine the cause of a technical issue with Gmail, an SRE might have to access emails stored on Google's servers to see if data is corrupted. I'm assuming in the years since, Google's SRE have mechanisms in place to audit and log the use of sudo-level access and powers. Twitter, on the other hand, seems to not have implemented this, at least as of 2015 [0] I can imagine FB having decent auditing and logging when it comes to internal access of private data of user accounts. But not when it comes to ad accounts, considering the level of scammy activity these ad accounts had when BuzzFeed News reported on them [2] [0] https://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats https://gawker.com/5637234/gcreep-google-engineer-stalked-te... [1] https://news.ycombinator.com/item?id=21467921 https://news.ycombinator.com/item?id=21467921 [2] https://www.buzzfeednews.com/article/craigsilverman/facebook-subscription-trap-free-trial-scam-ads-inc https://www.buzzfeednews.com/article/craigsilverman/facebook...

dboreham 7y ago

Also surprised. I've been involved with designing and implementing "customer service portal" functionality for a couple of services that were quite small, and yet this is something we very much considered. For example we added rate limiting such that even though a CSR could override user account state via the portal, they couldn't do it that much without triggering a block on their ability to do it again.

imron 7y ago

> OK it's not surprising that rogue insiders – whether it's a regular ads employee, manager, or a site-reliability engineer – can attempt this kind of tampering. In this case, it was a "contractor". Next time, it will be an "intern" etc etc.

lainga 7y ago
"On Sunday, an unidentified wrecker sent by the Imperialist powers to humiliate Facebook..."