100 Million Facebook Pages Leaked On Torrent Site 163
Posted
by
CmdrTaco
from the so-many-pokes dept.
from the so-many-pokes dept.
Stoobalou writes "A directory containing personal details about more than 100 million Facebook users has surfaced on an Internet file-sharing site. The 2.8GB torrent was compiled by hacker Ron Bowes of Skull Security, who created a web crawler program that harvested data on users contained in Facebook's open access directory, which lists all users who haven't bothered to change their privacy settings to make their pages unavailable to search engines."
Re:Well (Score:4, Informative)
torrent (Score:4, Informative)
http://www.skullsecurity.org/blogdata/fbdata.torrent [skullsecurity.org]
No, It's Just a List (Score:5, Informative)
You're going to get a URL to pages. If the user has since made them inaccessible, you'll only get what you can from their public profile. Like, you cannot get to my friends list from my public profile. You'll get "potential" usernames to log into Facebook. Big deal. Remember when everyone could make a username for Facebook and that was also their profile URL? Well, now you can guess the most common names and add them to this list like david [facebook.com]. Then you could use ncrack or whatever.
Not a whole lot in this file. Not like he scraped the pages of data and put that in a csv file for research or anything really interesting.
Re:FTFA (Score:5, Informative)
More likely it will precipitate a lawsuit. Why fix the problem when you can sue the pants off someone instead?
Sue for what? Violating Facebook's ToS?
I'm surprised TFA didn't link to the guy's blog. He has a good writeup there
http://www.skullsecurity.org/blog/?p=887 [skullsecurity.org]
The Torrent: http://www.skullsecurity.org/blogdata/fbdata.torrent [skullsecurity.org]
Re:Okay, so... (Score:2, Informative)
The point is you don't have to hack anything, facebook just defaults to posting stuff that a hacker might otherwise have to hack in to get.
For example, did you know that when you add a new email to facebook, it defaults to showing that email?
Re:Okay, so... (Score:3, Informative)
This guy wrote a script to crawl Facebook and download everything he could.
It's not even about that, it's about a guy who wrote a script to collect usernames of everyone on facebook which double as the URL for their profiles. From there you can go and scrape everything you want. You don't even get their public information that they can chose to display on the front page like religion or real name. That's not even on there. No images, just URLs which double as logins.
This story is about a glorified crawler. No actual hacking transpired. No personal information that wasn't already revealed has been revealed. This is not news. In fact, I had to go back to TFS and double-check that kdawson wasn't the editor - that's how terrible this story really is.
It's worse than that. It's about a glorified crawler that was augmented with common names to create a list of possible usernames [slashdot.org] and URLs for Facebook. If you gave me a glorified crawler that collected interesting data inside a csv, I'd actually be a little interested in using it. Hell, anyone can do this in perl by coding for five minutes but it would take days for the thing to complete with a risk of banning from Facebook.
They say this in the article and from the original source [skullsecurity.org]. The summary is more than misleading and there's even less to say "big deal" about than you presupposed.
BFD... (Score:1, Informative)
http://youropenbook.org/
Sensational...ism (Score:5, Informative)
Sensationalism - A manner of over-hyping events, being deliberately controversial, loud, self centred or acting to obtain attention. It is also a form of theatre.
Yep, that's pretty much it.
Just because he found the super-secret directory, http://www.facebook.com/directory/ [facebook.com] and wrote a program that would read it. Of all the evil, nefarious things to do.
Re:Security Research (Score:3, Informative)
I'm sure Facebook will say this is a good thing, and that those users wanted that information made available since that seems to be their default position on security and privacy.
Mark Zuckerberg actually said exactly that in a recent interview (with NPR, google it) when confronted with the question of "why not just make the default 'private'?" he quipped "We think users want to be seen". He is probably right, but there are way more people out there who are clueless about their privacy and mistakenly disclose tons of information than those who are well informed and intentionally disclose tons of information. Assuming the whole world is made up of perfectly informed adults who consent to sharing all of their information is a pretty big reach.
NOT A LEAK, title is -as usual- stupid (Score:3, Informative)
A leak is something that happens when previously hidden information is then made publicly available by someone on the inside.
The information here is available to anyone that wants it, someone just spent some time compiling the data, who had no affiliation with facebook.
The reverse-looker factor (Score:2, Informative)
Just a spam List (Score:3, Informative)
Indeed, just a spam list but with facebook names instead of email addresses.
Shouldn't come as a surprise to anybody, really. The moment you create a searchable profile, you know that is bound to happen.
Re:Security Research (Score:3, Informative)
Another thing is to have two FB accounts. One a public profile for your boss, professors, and others to see which has nothing but some random intelligent comments on it. The other your private one for friends, where all the pictures of you with the beer bong are well secured (as well as they can be on FB) from prying eyes.
Like what the parent stated above, I've not bothered to do this because I feel that if it gets on FB, it will end up public anyways somehow.
Re:Not following their robots.txt? (Score:2, Informative)
Can't you just bypass robots.txt with your ~/.wgetrc file?
I know I have. Put the line:
robots=off
in it.
I also put:
no_parent=on
and
recursive=on
to default to mirroring sites.
Re:Not following their robots.txt? (Score:3, Informative)
Robots.txt is just a convention, not a law, and Facebook's TOS is just CYA grounds for them to terminate your account. If they respond to my GET by sending me a page they just gave me a copy of the page and I am free to disclose the contents of that page.