3 ms·

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Facebook%22+%22

Since this is already out there as a known issue, and concerns Google too, check out: https://www.google.com/search?q=%22wants+to+be+friends+on+Facebook%22+%22If+you+don%27t+want+to+receive+these+emails+from+Facebook+in+the+future%22 https://www.google.com/search?q=%22wants+to+be+friends+on+Fa... And you'll find at the time of writing 250.000 more results where the "wants to be friends" email with the auto-login link is posted on blogs. Many of these blogs are also hacked, in that they redirect you to Russian dating sites if you visit the homepage. An example of such a blog with password reset email is: http://papajimummyji.blogspot.com/ http://papajimummyji.blogspot.com/ An example of a spam-redirecting blog is: http://demiansyahhh.blogspot.com/ http://demiansyahhh.blogspot.com/ (possibly unsafe) For some more Facebook reset emails see: https://www.google.com/search?q=%22You+recently+asked+to+reset+your+Facebook+password.%22+%22this+message+was+sent+to%22 https://www.google.com/search?q=%22You+recently+asked+to+res... EDIT: Twitter emails are also exposed: https://www.google.com/search?q=%22Forgot+your+Twitter+password%3F+Get+instructions+on+how+to+reset+it.%22+site%3Ablogspot.com https://www.google.com/search?q=%22Forgot+your+Twitter+passw... Youtube emails: https://www.google.com/search?q=%22YouTube+sends+email+summaries+like+these+so+you+can+keep+up+with+your+channel+subscriptions.%22+site%3Ablogspot.com https://www.google.com/search?q=%22YouTube+sends+email+summa... Twoo emails: https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+Braunplein+18%2C+9000+Ghent%2C+Belgium+BE0834322338%22+site%3Ablogspot.com https://www.google.nl/search?q=%22Massive+Media+NV%2C+Emile+... And likely more web services.

windsurfer 14y ago
It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.
- shiftpgdn 14y ago
  Somebody at the Google is certainly watching this thread and cleaning house.
- blauwbilgorgel 14y ago
  Yeah that was weird. I found another that still returns 233.000 results for me: https://www.google.com/search?q=%22wants+to+be+friends%22+%22facebook%22+%22If+you+don%27t+want+to+receive%22+site:blogspot.com https://www.google.com/search?q=%22wants+to+be+friends%22+%2... I must have made a typo at "don%27t". I corrected the first query and it now returns 238.000 results for me again. Perhaps some Blogspot sites got hacked/ their users phished (I noticed suspicious posting activity dating back to November 2011), which would explain how they got access to the emails. Or these accounts are all fake (selling likes) and they use Blogspot to create online persona's and manage their accounts.
acarlucci 14y ago
It's something like this (I don't know if you already knew): 1. Try to search this http://goo.gl/dHHsU http://goo.gl/dHHsU on Google. You'll find (at the time of writing) 90.300 results. 2. Find an URL like this https://twitter.com/account/confirm_email/[username]/[XXXXX-XXXXX-XXXXXX] https://twitter.com/account/confirm_email/[username]/[XXXXX-... 3. Change the URL like this https://twitter.com/account/not_my_account/[username]/[XXXXX-XXXXX-XXXXXX] https://twitter.com/account/not_my_account/[username]/[XXXXX... Twitter "not_my_account" vulnerability: - Information disclosure vulnerability: you'll see the email of the Twitter user [username] - DoS vulnerability: you can click on the "I did not sign up for this account" button. After that, the Twitter user [username] email will be removed from the [username] account.

windsurfer 14y ago

It's 47 minutes later and for your searches, I'm seeing 5 results and 309 results. Spooky.

shiftpgdn 14y ago
Somebody at the Google is certainly watching this thread and cleaning house.
blauwbilgorgel 14y ago
Yeah that was weird. I found another that still returns 233.000 results for me: https://www.google.com/search?q=%22wants+to+be+friends%22+%22facebook%22+%22If+you+don%27t+want+to+receive%22+site:blogspot.com https://www.google.com/search?q=%22wants+to+be+friends%22+%2... I must have made a typo at "don%27t". I corrected the first query and it now returns 238.000 results for me again. Perhaps some Blogspot sites got hacked/ their users phished (I noticed suspicious posting activity dating back to November 2011), which would explain how they got access to the emails. Or these accounts are all fake (selling likes) and they use Blogspot to create online persona's and manage their accounts.

acarlucci 14y ago

It's something like this (I don't know if you already knew): 1. Try to search this http://goo.gl/dHHsU http://goo.gl/dHHsU on Google. You'll find (at the time of writing) 90.300 results. 2. Find an URL like this https://twitter.com/account/confirm_email/[username]/[XXXXX-XXXXX-XXXXXX] https://twitter.com/account/confirm_email/[username]/[XXXXX-... 3. Change the URL like this https://twitter.com/account/not_my_account/[username]/[XXXXX-XXXXX-XXXXXX] https://twitter.com/account/not_my_account/[username]/[XXXXX... Twitter "not_my_account" vulnerability: - Information disclosure vulnerability: you'll see the email of the Twitter user [username] - DoS vulnerability: you can click on the "I did not sign up for this account" button. After that, the Twitter user [username] email will be removed from the [username] account.