100 Million Facebook Pages Leaked On Torrent Site 163
Stoobalou writes "A directory containing personal details about more than 100 million Facebook users has surfaced on an Internet file-sharing site. The 2.8GB torrent was compiled by hacker Ron Bowes of Skull Security, who created a web crawler program that harvested data on users contained in Facebook's open access directory, which lists all users who haven't bothered to change their privacy settings to make their pages unavailable to search engines."
FTFA (Score:4, Insightful)
perhaps the existence of a stalker's online black book might finally persuade less security-minded Facebook users to get their arses in gear.
More likely it will precipitate a lawsuit. Why fix the problem when you can sue the pants off someone instead?
Leaked? (Score:5, Insightful)
Re:Well (Score:3, Insightful)
It's 2.8 gigs as it is, imagine how big it would get if 100 million pics were added to it ;-)
Obvious next step (Score:3, Insightful)
Download the file and make sure I'm not in there. Onward and upward.
Security Research (Score:1, Insightful)
I'll bet there are about 100 million people who would like to test the security of Ron Bowes' nuts against a swift kick. I mean, he should be aware of the Extreme Pain vulnerability by now, and he should have taken the most basic security precautions by now, like wearing a cup. If not, well, he deserves what he gets, right?
Re:And now more people will know about it (Score:0, Insightful)
Okay, so... (Score:5, Insightful)
This guy wrote a script to crawl Facebook and download everything he could. So? Nothing is revealed here that we couldn't find manually ourselves by just looking at a person of interest's profile.
This story is about a glorified crawler. No actual hacking transpired. No personal information that wasn't already revealed has been revealed. This is not news. In fact, I had to go back to TFS and double-check that kdawson wasn't the editor - that's how terrible this story really is.
Where's the Pr0n? (Score:5, Insightful)
Would someone create a list that only contains public profiles with NSFW images?
Thanx
How do you "leak" public information? (Score:2, Insightful)
After my initial outrage spike, I realized that the only reason this guy ended up with this information is because these people INTENTIONALLY POSTED it.
See if anyone you know is on this list and educate them.
Re:Leaked? (Score:5, Insightful)
They might as well have said "millions of home telephone numbers LEAKED via paper-based archive deposited randomly on doorsteps ALL ACROSS TEH COUNTRY!!!"
Worthless headline; it should read "Facebook name and URL database created from already public information, nothing to see here, move along"
Re:Security Research (Score:4, Insightful)
I doubt there is a significant overlap between the people who follow computer security and online privacy issues and the people who still leave their Facebook profiles open for search indexing. I would venture a guess that most of the people harvested will never know, or care. I mean, after all, it doesn't even really sound like this guy did anything more than Google already did anyway.
Re:FTFA (Score:5, Insightful)
In this case I think it is a more of a matter of 'yeah so?'. I put my information on that website *SO* I could be found. Everyone else who links to me is doing the *EXACT SAME THING*. The whole point of this site as sold is to link you to your friends and family. Thats it. How do you find people? Oh yeah you search for them.
The usual internet problems exist. Do not put up there what you do not want other to know.
I am sure there are dozens of ways to abuse the information that is up there. But guess what *YOU HAVE DECIDED* to put it up there...
That you expect some sort of privacy from an application that by its nature is about being open and sharing whatever stupid thing you are doing is backwards.
If you do not want to be found facebook is not the place to be. It shares everything no matter what your 'settings' are. You have by its nature shared with at least 2 parties. Your friends and facebook. If you want to keep a secret you do not tell people who are known to tell others.
Re:And now more people will know about it (Score:5, Insightful)
and get more information from those people. You stay classy slashdot.
Rest assured that the blackhats who want this information already know about it. As another user suggested, one potential abuse of this information would be to choose targets for social engineering attacks. But those who would exploit it did not just now hear about it. If anything it's the public that is often left behind.
If you don't want to see that reality then we cannot have a conversation about this. If you can see that reality, then I have one question for you: how do you propose we solve the bigger problem of raising awareness of the dangers and misuses of such databases without some publicity? The users who least understand how these things can be abused are generally the ones who are most actively making their personal information publically available. Everyone else either doesn't share the need for personal exhibition, uses false data, or takes a deliberate and calculated risk with any real data made available.
While I think it's an empty vanity personally, I'm not against someone making a public exhibit of themselves if that's what they wish to do. What I would like to see, however, is for those people to do this with a full awareness of how it could be used against them. The deck is somewhat stacked against them because the black hats thoroughly study how to misuse information, whereas the average user just wants to communicate with friends. That can change, and it really should.
News flash: 400 million user profile pages leaked! (Score:4, Insightful)
Your Anger May Be Misdirected (Score:5, Insightful)
I'll bet there are about 100 million people who would like to test the security of Ron Bowes' nuts against a swift kick. I mean, he should be aware of the Extreme Pain vulnerability by now, and he should have taken the most basic security precautions by now, like wearing a cup. If not, well, he deserves what he gets, right?
+5 Insightful? Why is it that we regard Tavis Ormandy as someone trying to expose the insecurity of Microsoft when he releases a how-to exploit Windows hack [slashdot.org] but when a security researcher attempts to reveal how insecure Facebook's "Directory" service can be we attack him as the creator of that service and not Facebook?
I believe your anger would be better directed at Facebook. After all, this is posted in his blog for the world to see while a malware author could have just taken this list and run ncrack on it without anyone knowing.
I would also like to point out that, as mentioned many times in this thread, this is just a list. Not even real names but just usernames of people on Facebook. That means that if you find your username on this list, you can restrict your settings so that no one can see your public profile. Then if someone uses this URL list to look you up they get nothing.
So a security researcher tries to wake up Facebook users and he's the guy you want to kick in the nuts? Very curious.
Re:Okay, so... (Score:4, Insightful)
> Until this data dump, the only people doing data mining were Facebook &
> their partners.
Do you seriously believe that no one has ever written such a script before?
Re:Security Research (Score:4, Insightful)
Purely playing Devil's advocate here ....
So, Facebook made this stuff public by default. The individual users didn't change their settings to make it private (either they didn't know, or didn't care). This guy collects all of the information which is open to him, and publishes it.
I'm not saying I agree with scraping all of this information, but I place much more of the blame on Facebook for their shitty privacy policies and making a change to the data which made it public by default.
This is a logical conclusion of having that much information public by default. It's scary to get that information on 170 million people, but, as TFA points out, this is hardly illegal.
I'm sure Facebook will say this is a good thing, and that those users wanted that information made available since that seems to be their default position on security and privacy.
Re:Your Anger May Be Misdirected (Score:5, Insightful)
> I believe your anger would be better directed at Facebook.
Why is there any need for anger at all? These users made their pages public. This guy created a list of public Facebook pages. So what?
Hopefully.... (Score:3, Insightful)
The real world is(relatively) harmless because(outside of East Germany, and the UK) persistent, comprehensive surveillance is extremely expensive and/or time consuming. Only people with stalkers, secret agents, or private investigators on their tail need worry.
On the internet, which masterfully makes data collection and mining much easier, comprehensive surveillance, and making something of the results, is relatively trivial. Hence the concern.
Re:Leaked? (Score:5, Insightful)
Re:Security Research (Score:3, Insightful)
I have no difficulty at all believing that 100 million people chose to disclose that much information. (the information being a link to their public Facebook profile). Why do you imagine that everyone wants to be secretive?
Re:FTFA (Score:3, Insightful)
"I'm surprised TFA didn't link to the guy's blog. He has a good writeup there
http://www.skullsecurity.org/blog/?p=887 [skullsecurity.org] [skullsecurity.org]"
That is because Stoobalou wanted you to go to think.co.uk to read the story, spend 30-60 seconds looking for a link to the original source(viewing ads the whole time, he hopes)...kind of like EVERY other story he has posted.
I agree. He could at least provide the link somewhere. What a tease.