14 ms·
Web Scrapers Claim to Sell Personal Data on Facebook Users on a Hacker Forum
- throwaway3975 5y ago“The traders claim to have obtained the data by scraping rather than hacking or compromising individual users’ accounts.”
- 1270018080 5y agoI think they're just riding the Facebook wave for more clicks. This is hardly news.
- rvz 5y agoAnother day, another selling of 1.5B Facebook users on a 'hacking forum'. There seems to be no end to the chaos around the Facebook mafia.
- throwaway78981 5y agoSome might laugh this off as 'oh it's just scraping'. But I remember reading some comments in HN that there are apps that can scan faces and pull personal info including where they live, work etc. So each leak uncovers a person little by little. This vindicates the stance taken by Signal to not even collect metadata. Edit: I mean surreptitiously scan the face of a stranger you see in public and the app will tell you about them. Don't know names of the apps.
- Sephr 5y ago> there are apps that can scan faces and pull personal info including where they live, work etc Note that these services are also powered by scraping public data.
- throwawayy293 5y agohttps://www.wikipedia.org/wiki/Clearview_AI https://www.wikipedia.org/wiki/Clearview_AI already does that too
- dutchbrit 5y agohttps://pimeyes.com https://pimeyes.com does just that, I just posted it here on HN.
- kbenson 5y agoI always want to know what a service like that has found, but I'm also pretty unwilling to upload an image of me to it, given that there's not a lot of public images of me out there that I'm aware of. Then again, maybe if I did check I'd see a bunch of images where I was tagged by other people and that would disabuse me of the notion that images of me online are rare at all...
- TurkishPoptart 5y agoI suspect today's outage (now resolved) was planned in some capacity in order to address what's in TFA here or the story regarding the recent whistleblower.
- Alex3917 5y agoI know everyone on HN loves to hate on Facebook, but the fact that HN's servers are getting crushed when FB is down perhaps shows a revealed preference.
- jjulius 5y agoOr it could be as simple as everyone wants to discuss one of the biggest tech companies suffering such a massive outage, combined with the aforementioned FB-haters basking in this moment.
- Alex3917 5y agoAs the CEO of a social network with more active users than Facebook, I am very confident in my analysis.
- tomrod 5y agoLOL. I haven't come across you before today (so, not sure if this is a joke), but for the past few hours every social network has more active users than Facebook.
- glitchcrab 5y ago> for the past few hours every social network has more active users than Facebook That's literally the joke.
- KoftaBob 5y agoI see what you did there
- BrianOnHN 5y agoFollowing Twitter, HN is top 2 places to check during an outage.
- deleted 5y ago[deleted]
- zohvek 5y agoFacebook is having one hellva last 48 hours I tell you what.
- dheera 5y agoI'm glad I never gave FB my real phone number or birthday. Nobody should. I predicted this would happen some day. It's always just a matter of probability and time.
- slig 5y agoDo you have any friends that might have used any FB app? If so, chances are high they uploaded their contact list and FB has your name and phone number.
- dheera 5y agoI mean, I usually just tell friends to call me on FB messenger (or WeChat) rather than giving them one of my 10+ phone numbers, so FB probably wouldn't have gotten it that way. I'm not on very many people's phone contact lists. The few that do have a virtual number that I can just change. Name, yes, but that's public.
- Loughla 5y agoAnd this is exactly why this is a problem. I have never consented to facebook having my information. I have never had an account linked to anything real about me. I had one in 2004 or so to learn about college parties. I used a pseudonym and deleted in once I graduated. But I guarantee they still have my information because people I know use their app. This is not okay.
- jaywalk 5y agoIf you want to talk about a matter of probability, your real phone number and birthday are almost certainly already out there.
- dheera 5y agoI have a fake birthday I use consistently across most of the internet. I don't have a consistent "real" phone number -- I change it periodically. I then have virtual numbers that redirect to those, which I change from time to time as well.
- animanoir 5y agoI honestly ask myself how the f Zuck has the guts and ego to still talk about a "metaverse" with a company and product so wrong, so poisonous and evil to humanity. I really can't wait to see him in jail already.
- spywaregorilla 5y agoAny particular reason you think a metaverse is incompatible with an evil organization? The evil co. in Ready Player One, the movie, literally imprisoned people and used them for forced labor. (then, somehow, the CEO gets arrested by regular cops, lol).
- iszomer 5y ago> (then, somehow, the CEO gets arrested by regular cops, lol). Because he had a gun in hand not because of his forced labor practices.
- spywaregorilla 5y agoYou're not wrong, but on some level given his freedom to enslave and murder people, it is surprising that in universe he is vulnerable to normal cops
- throw_m239339 5y agoI'm not a big fan of Facebook but the hatred toward that company here is getting out of hand. You want to see Zuck in jail for what crime exactly? How is Twitter, Youtube, TikTok or Reddit any better than Facebook when it comes to being "poisonous" or "evil"? Youtube was literally financing terrorist groups with ad money 10 years ago. Twitter gives a platform to anti-Semites and the Taliban.
- atok1 5y agoFB is inherently evil and must be stopped at all costs. And your last part about giving those two groups a platform: so fucking what? Those groups are much more prestigious than our 'leaders'.
- hn_throwaway_99 5y agoI feel like we need to start differentiating between "public" personal information and more sensitive personal information (like social security numbers or other government ID numbers). The breach lists this info: Name Email Location Gender Phone number User ID So basically, everything I used to be able to get in a phone book. Honestly, at this point all of that information should just be considered public, because it obviously is. If anything I think people are grappling with the fact that the Internet just makes data scraping and processing possible on a scale previously unimaginable, and that's really what people have an issue with, but I don't think there's a great answer to that. I mean, it's one thing to say the front of my house is public info because anyone can come by and take a picture, but it sure feels different when a high resolution photo (or heck, video feed) can be posted online that is instantly available to billions of people.
- spansoa 5y ago> and more sensitive personal information (like social security numbers) Well I consider SSNs public knowledge at this stage. You can reliably dox anyone in the US now and find out their SSNs. Also: I used to have a sticker on my laptop that had my SSN on it, and brought it to conferences, as a PR stunt for my consultancy.
- throwaway78981 5y agoThis isn't true. The phonebook we had had only Name, Phone number and very broad location. Also those days, phone number was just that - a phone number. Nowadays it's a unique identifier for lots and lots of things including government stuff. Some government stuff even uses it for authentication/authorization. Also I guess user ID means it gives access to their fb profile page I guess? From there one can scrape pics etc (public ones).
- micromacrofoot 5y agothe 1.5B number leads me to believe that these aren't all public accounts though, so it's a bit broader than the phone book comparison also at this point there have been enough large leaks that cross-referencing the data can probably paint a very complete picture of many people
- 5y ago
- Finster 5y agoIs this why facebook is down?
- DevKoala 5y agoWhat a broken product. There isn’t 1.5B users with public profiles in FB, so whatever methods these guys used clearly went beyond regular data scrapping.
- deleted 5y ago[deleted]
- mcintyre1994 5y agoDo you have a source for that? Facebook claim 2.9 billion MAUs, half of them having a public profile seems pretty likely to me.
- hikerclimber1 5y agoGood. Hopefully more companies get hacked.
- subsubzero 5y agoFacebook is having a very bad day today, You have this hack announced today, all their sites are apparently down due to a bgp issue they are dealing with, and then the bombshell allegations of them intentionally creating toxicity on their platform to enrich themselves at the expense of society. Zuck's world is slowly collapsing in on him, expect heavy regulation and the beginning of the end of facebook as we know it.
- i_like_apis 5y agoI was with you right up until the end. I don't think fb is going anywhere soon. The whistle-blower situation is interesting though, I see what you mean that there could be regulation inbound... but how can they be regulated?
- driverdan 5y agoThis is not a hack, it's web scraping.
- drclau 5y ago(just a wild theory) Is the downtime (at the time of writing) their way of blocking a known ongoing attack that can't be stopped fast and safely enough by other means? Something like: 1) take everything down, 2) fix the bug, 3) deploy everywhere, 4) start everything up. And, to stop clients from connecting, take down the DNS too. DNS is also a great scapegoat.
- johntiger1 5y agoAlso thinking that these two events are not independent...
- deleted 5y ago[deleted]
- Seredo 5y agoApparently the data was collected through scraping, so probably just a coincidence.
- toast0 5y agoI worked at WhatsApp until 2019; I don't remember any disaster plans where taking everything down was an option (although I'm sure they exist), but dropping BGP sessions is probably not the best way to do it, because it's hard to reverse and hard to inspect the system without BGP. Over in WA land, we'd probably just kill all the frontend servers if needed. For all of FB infrastructure, killing all the loadbalancers would probably work, and also the outgoing proxy hosts, as appropriate. No need to mess with DNS or BGP.
- y4mi 5y agoI agree that it's highly unlikely to be a deliberate action, but your listed mitigations would only help against security issues that impact the web services. It could be the only way to go in the highly unlikely scenario that attackers are able to compromise the management APIs of various infrastructure devices like routers, baremetal servers etc. These APIs are usually on airgapped networks though, which makes this extremely unlikely
- mihaaly 5y agoAnd some wonder why I'm not letting myself forced into dual authentication providing them with real phone number. Actually I am very reluctant to log into Facebook at all, twice a year perhaps seeing old friends making an attempt to communicate with me, then only from private browsing, perhaps VPN too. I do not trust them with any shred of additional info on me to that they do not have already from earlier. I miss a lot of links sent to me pointing to facebook post or something, no, actually I do not miss a little thing, I rather do not care about cute animals or strange people or thoughts, it is invaluable in 99,999% of the cases, for the rest I can take the loss.
- mdoms 5y agoI don't consider my name, date of birth or the city I live in to be personal information.
- guessmyname 5y ago> I don't consider my name, date of birth or the city I live in to be personal information. Of course it is personal information. I think what you are trying to say is that you do not consider this data to be sensitive personal information. Emphasis on sensitive.
- deleted 5y ago[deleted]
- Program_Install 5y agoExpected in all honesty, data these days is a currency to be bartered. I despise facebooks and everything it stands for, I wish people would take themselves more seriously. This need to fill a void with nonsense, is just simply unbecoming. So, suffer the consequences.
- afrcnc 5y agoFake news. Public data scrapped of a Facebook profile is not "personal information" if everyone can already see it
- blitzar 5y agoIts a web scrape ... Public Information of More Than 1.5B Facebook Users Sold on Hacker Forum
- smsm42 5y ago1. You publish your information on a public site designed to disseminate information to as many people as possible. 2. Somebody sees this information and records it. 3. They publish this information on another site. 4. "Hackers stole my private data!!!!" Really?!
- dirigent 5y agoIs there any real reason(s) to use facebook in 2021? Like, why bother? Are there any actual use case of owning facebook account now?
- paul7986 5y agoSearchPeopleFree<dot>com pretty much has a ton on a good majority of people. Get their phone number and if you want learn a lot about them. So it just compiles public information. No opinion whether it's a good or bad thing here from me just pointing it out.
- jrs235 5y agoSo this might explain why I've suddenly gotten a huge increase in SPAM text messages that know my name.
- dqpb 5y agoIs it just me or do attacks on Facebook come in waves?
- suyash 5y agoBest thing everyone who has account in any of FB related properties is to change your password soon as it's back. Then don't use the old password anywhere, if you do, change those too.
- mzs 5y agodoubts about veracity: https://twitter.com/AricToler/status/1445100884740935686 https://twitter.com/AricToler/status/1445100884740935686
- fairity 5y agoInterestingly, the forum that hosted this sales thread, raidforums.com, has apparently been taken down by their registrar for the next 30 days. Source: https://twitter.com/WAK4S/status/1444276266362982400/photo/1 https://twitter.com/WAK4S/status/1444276266362982400/photo/1
- Jessicahorn 5y agoI was frustrated and depressed when i noticed my spouse was cheating on me and there was nothing i could do about it, one day i saw an ad by this hacker and decided to contact him we got to talking and he has been helping me ever since; hacking into phones and intercepting text messages, getting mail passwords, registry hacks e.t.c. right now i am in the final stages of my divorce getting what i deserve all thanks to ACETEAM. you should contact him if you have any hacking related issues contact: aceteamhackers@gmail.com
- 090472594 5y agohttps://www.facebook.com/bro.rin.148553 https://www.facebook.com/bro.rin.148553