6 ms·

Facebook is using doublespeak here. > It is important to understand that malicious actors obtained this data not through hacking our systems but by scraping it

Facebook is using doublespeak here. > It is important to understand that malicious actors obtained this data not through hacking our systems but by scraping it from our platform prior to September 2019. .. a couple paragraphs later :: > We believe the data in question was scraped from people’s Facebook profiles by malicious actors using our contact importer prior to September 2019. Gee, that sounds a lot like someone abused your contact importer tool to do something you didn't intend for it to do. Which is also the definition of other "hacks", like SQL injection

jszymborski 6y ago
right, they make it sound like it was publicly available data, but it was data unintentionally made public. Sort of like saying "people scraped publicly available information from our website" when someone grabs passwords from a public-facing MongoDB database without a password.
- throwaway1777 6y ago
  The data was from people’s public profiles, it’s not unintentionally public. the issue was making it scrapable.
  - kristofferR 6y ago
    No, the phone numbers and emails weren't publicly posted (globe icon), they were just meant to discover contacts.
    - MertsA 6y ago
      You can choose to make your email on your profile public. Take a look at the number of emails exposed vs. the number of phone numbers exposed, there's a reason why it's a small portion, most people don't make that public. This was just an attacker abusing "Who can look you up using the phone number you provided?" for users where this was set to the default of "Everyone" and then scraping the public details for the profile that popped up.
  - quantumsequoia 6y ago
    This is incorrect. Private phone numbers not publicly shown on your profile via the UI are included. Mark Zuckerberg's own phone number was included, and you can bet he would never intentionally release that nor is he likely to misconfigure his privacy settings and leak it due to user error
TechBro8615 6y ago
It reminds me of their Cambridge Analytica defense. Create an Open API, make all the data available to anyone who signs up for an API key, document and market the methods for extracting the data, define its boundaries and limitations, build a platform around it, and then claim you're the victim when one of your users does something bad with the data you gave them.
bredren 6y ago
I thought the same thing. Is there another explanation for what this might mean? Scraping to me is what google does, exploring links, saving and parsing data. The contact importer presumably sourced data from iOS, google, outlook or similar address books. You shouldn’t normally get data out that way, was it returning unexpected results from partial matches? Maybe you could view a profile page by uploading an address book with partial, stubbed data. This page that then normally wouldn’t have been accessible to the user then was and those and any connected profiles were then crawled and scraped? It seems to me you used to be able to view an otherwise private profile if the person had extended a friend request.
kristofferR 6y ago
Facebook also claimed that the only leaked data was "old data", phone numbers from 2019...
- VectorLock 6y ago
  2 years is nothing in the age of mobile numbers that people port and keep for practically decades.
HappyTypist 6y ago
Facebook has some of the worst and most disgusting ethics in tech. I feel repulsed that they are in the same industry I work in.
omnimike 6y ago
> Gee, that sounds a lot like someone abused your contact importer tool to do something you didn't intend for it to do. From the article it appears that the contact importer is an API endpoint which returns a set of Facebook profiles given a set of phone numbers. In that sense, it did exactly what the developer intended. If I write a script to query google.com and get a response back you could say I'm not using google search as intended, but most software engineers would laugh at me if I claimed to have "hacked" Google in this way.
- tyingq 6y ago
  See this from Sep, 2019: https://www.forbes.com/sites/zakdoffman/2019/09/12/new-instagram-hack-exclusive-facebook-confirms-user-accounts-and-phone-numbers-at-risk/?sh=5867eea62200 https://www.forbes.com/sites/zakdoffman/2019/09/12/new-insta... "Facebook confirmed to me that the vulnerability was genuine, that the exploit would enable a “bad actor” to connect phone numbers and user details, and that it has prompted changes to be made. They pointed out to me that the exploit process is “complex,” but nonetheless did leave the platform open to abuse and put users at risk."
- bostonsre 6y ago
  > In that sense, it did exactly what the developer intended. Not sure they envisioned someone enumerating phone numbers and pulling all data. But that would be hilarious if they claim that's what they intended and that was a feature.
  - quantumsequoia 6y ago
    There's a difference between an unintended use case and unintended behavior
- xmodem 6y ago
  At a certain level the question is academic, and lawyering over definitions only distracts from the bigger picture. I trusted Facebook with my mobile number. They permitted bad actors to mis-use their service, and now bad actors have that number. Facebook should be held accountable. Whether it was through SQL injection or a poorly-thought-out API is academic.
kerng 6y ago
Yeah, seems like the definition of hacking what happened there. I mean Facebook could have at least rate limit or block this, but they had no mitigation. They even admit of having fixed it afterwards.

jszymborski 6y ago

right, they make it sound like it was publicly available data, but it was data unintentionally made public. Sort of like saying "people scraped publicly available information from our website" when someone grabs passwords from a public-facing MongoDB database without a password.

throwaway1777 6y ago
The data was from people’s public profiles, it’s not unintentionally public. the issue was making it scrapable.
- kristofferR 6y ago
  No, the phone numbers and emails weren't publicly posted (globe icon), they were just meant to discover contacts.
  - MertsA 6y ago
    You can choose to make your email on your profile public. Take a look at the number of emails exposed vs. the number of phone numbers exposed, there's a reason why it's a small portion, most people don't make that public. This was just an attacker abusing "Who can look you up using the phone number you provided?" for users where this was set to the default of "Everyone" and then scraping the public details for the profile that popped up.
- quantumsequoia 6y ago
  This is incorrect. Private phone numbers not publicly shown on your profile via the UI are included. Mark Zuckerberg's own phone number was included, and you can bet he would never intentionally release that nor is he likely to misconfigure his privacy settings and leak it due to user error

TechBro8615 6y ago

It reminds me of their Cambridge Analytica defense. Create an Open API, make all the data available to anyone who signs up for an API key, document and market the methods for extracting the data, define its boundaries and limitations, build a platform around it, and then claim you're the victim when one of your users does something bad with the data you gave them.

bredren 6y ago

I thought the same thing. Is there another explanation for what this might mean? Scraping to me is what google does, exploring links, saving and parsing data. The contact importer presumably sourced data from iOS, google, outlook or similar address books. You shouldn’t normally get data out that way, was it returning unexpected results from partial matches? Maybe you could view a profile page by uploading an address book with partial, stubbed data. This page that then normally wouldn’t have been accessible to the user then was and those and any connected profiles were then crawled and scraped? It seems to me you used to be able to view an otherwise private profile if the person had extended a friend request.

kristofferR 6y ago

Facebook also claimed that the only leaked data was "old data", phone numbers from 2019...

VectorLock 6y ago
2 years is nothing in the age of mobile numbers that people port and keep for practically decades.

HappyTypist 6y ago

Facebook has some of the worst and most disgusting ethics in tech. I feel repulsed that they are in the same industry I work in.

omnimike 6y ago

> Gee, that sounds a lot like someone abused your contact importer tool to do something you didn't intend for it to do. From the article it appears that the contact importer is an API endpoint which returns a set of Facebook profiles given a set of phone numbers. In that sense, it did exactly what the developer intended. If I write a script to query google.com and get a response back you could say I'm not using google search as intended, but most software engineers would laugh at me if I claimed to have "hacked" Google in this way.

tyingq 6y ago
See this from Sep, 2019: https://www.forbes.com/sites/zakdoffman/2019/09/12/new-instagram-hack-exclusive-facebook-confirms-user-accounts-and-phone-numbers-at-risk/?sh=5867eea62200 https://www.forbes.com/sites/zakdoffman/2019/09/12/new-insta... "Facebook confirmed to me that the vulnerability was genuine, that the exploit would enable a “bad actor” to connect phone numbers and user details, and that it has prompted changes to be made. They pointed out to me that the exploit process is “complex,” but nonetheless did leave the platform open to abuse and put users at risk."
bostonsre 6y ago
> In that sense, it did exactly what the developer intended. Not sure they envisioned someone enumerating phone numbers and pulling all data. But that would be hilarious if they claim that's what they intended and that was a feature.
- quantumsequoia 6y ago
  There's a difference between an unintended use case and unintended behavior
xmodem 6y ago
At a certain level the question is academic, and lawyering over definitions only distracts from the bigger picture. I trusted Facebook with my mobile number. They permitted bad actors to mis-use their service, and now bad actors have that number. Facebook should be held accountable. Whether it was through SQL injection or a poorly-thought-out API is academic.

kerng 6y ago

Yeah, seems like the definition of hacking what happened there. I mean Facebook could have at least rate limit or block this, but they had no mitigation. They even admit of having fixed it afterwards.