Truesee's Daily Wonder

Truesee presents the weird, wild, wacky and world news of the day.

Tuesday, January 19, 2010

 

Facebook has a major flaw

ajc.com

 

Georgians uncover Facebook flaw

Jordan Robertson

Associated Press

6:32 a.m. Tuesday, January 19, 2010

 

San Francisco — A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers’ accounts with full access to troves of private information.

The glitch — the result of a routing problem at the family’s wireless carrier, AT&T — revealed a little-known security flaw with far-reaching implications for everyone on the Internet, not just Facebook users.

In each case, the Internet lost track of who was who, putting the women into the wrong accounts. It doesn’t appear the users could have done anything to stop it. The problem adds a dimension to researchers’ warnings that there are many ways online information — from mundane data to dark secrets — can go awry.

Several security experts said they had not heard of a case like this, in which the wrong person was shown a Web page whose user name and password had been entered by someone else. It’s not clear whether such episodes are rare or simply not reported. But experts said such flaws could occur on e-mail services, for instance, and that something similar could happen on a PC, not just a phone.

“The fact that it did happen is proof that it could potentially happen again and with something a lot more important than Facebook,” said Nathan Hamiel, founder of the Hexagon Security Group, a research organization.

Candace Sawyer, 26, says she immediately suspected something was wrong when she tried to visit her Facebook page this month.

After typing Facebook.com into her Nokia smart phone, she was taken into the site without being asked for her user name or password. She was in an account that didn’t look like hers. She had fewer friend requests than she remembered. Then she found a picture of the page’s owner.

“He’s white — I’m not,” she said with a laugh.

Sawyer logged off and asked her sister, Mari, 31, her partner in a dessert catering company, and their mother, Fran, 57, to see whether they had the same problem on their phones.

Mari landed inside another woman’s page.

Fran’s phone — which had never been used to access Facebook before — took her inside yet another stranger’s page, one belonging to a young woman from Indiana. They sent an e-mail to one of their own accounts to prove it.

They were dumbfounded.

“I thought it was the phone — ‘Maybe this phone is just weird and does magical, horrible things and I have to get rid of it,’ ” Candace Sawyer said.

The women, who live together in East Point, had recently upgraded to the same model of phone and all used the same carrier, AT&T.

 awyer contacted The Associated Press after reporting the problem to Facebook and AT&T.

The problem wasn’t in the phones. It was a flaw in the infrastructure connecting the phones to the Internet.

That illuminates a grave problem.

Generally Web sites and computers are compromised from within. A hacker can get Web pages or computers to run programming code that they shouldn’t. But in this case, it was a security gap between the phone and the Web site that exposed strangers’ Facebook pages to the Sawyers. Misconfigured equipment, poorly written network software or other technical errors could have caused AT&T to fumble the information flowing from the Sawyers’ phones to Facebook and back.

Fortunately, Hamiel said, the vulnerability would be of limited use to a hacker interested in pulling off widespread mayhem, because this hole would let him access only one account at a time. To do more damage the criminal would have to pull off the unlikely feat of gaining full control of the piece of equipment that routes Internet traffic to individual users.

AT&T spokesman Michael Coe said its wireless customers have landed in the wrong Facebook pages in “a limited number of instances” and that a network problem behind those episodes is being fixed.

The Sawyers experienced a different glitch. Coe said an investigation points to a “misdirected cookie.” A cookie is a file some Web sites place on computers to store identifying information — including the user name that Facebook members would enter to access their pages. Coe said technicians couldn’t figure out how the cookie had been routed to the wrong phone, leading it into the wrong Facebook account.

He also said AT&T could confirm only that the problem occurred on one of the Sawyers’ phones, possibly because they had logged off Facebook on the other two before reporting the incident.

Facebook declined to comment and referred questions to AT&T.

Some Web sites would be immune from this kind of mix-up, particularly those that use encryption. A Web browser would have trouble deciphering the encryption on a page that a computer user didn’t actually seek, said Chris Wysopal, co-founder of Veracode Inc., a security company.

Sensitive sites and those used for banking and e-commerce generally use encryption. But most other sites, including some Web-based e-mail services, don’t use it. One way of checking: The Web addresses of encrypted sites begin with “https” rather than “http.” Facebook uses encryption when user names and passwords are entered, to cloak the sign-on from snoops, but after the credentials are entered the encryption is dropped.

It’s unclear how many people were affected by the problem the Sawyers discovered, and whether it was limited to Facebook.

The reason all three women experienced the glitch is a function of the way cellular networks are designed. In some cases, all the mobile Internet traffic for a particular area is routed through the same piece of networking equipment. If that piece of equipment is misbehaving or set up incorrectly, strange things happen when computers down the line receive the data.

Usually that means a Web site simply won’t load, said Alberto Solino, director of security consulting services for Core Security Technologies. In the Sawyers’ case, “somehow they got the wrong user but they could keep using that account for a long period of time. That’s what’s strange,” he said.

The AP tried to contact two of the people whose Facebook pages were exposed to the Sawyers, but the calls and e-mails were not returned. It’s unclear whether they are also AT&T customers, though security experts said that’s likely the case.

Indeed, it was the case in a similar incident in November.

Stephen Simburg, 25, who works in marketing, was home for Thanksgiving in Vancouver, Wash., when he logged onto Facebook from his cellphone. He didn’t recognize the people who had written him messages.

“I thought I had gotten really popular all of a sudden, or something was wrong,” he said. Then he saw the picture of the account owner: A young woman.

He got her e-mail address from the site, logged off and wrote the woman a message. He asked whether he had met her at some point and she had borrowed his phone to check her Facebook account.

“No,” she wrote back, “but I was just telling my family that I ended up in your profile!”

Simburg and the woman figured out they were both using AT&T to access Facebook on their phones. (AT&T had no comment because the incident wasn’t reported to the company.)

“I felt like I had been let down by the phone company and by Facebook,” he said.

He says he has put the incident behind him. But one piece of it remains: He and the young woman are now Facebook friends.

Find this article at:

http://www.ajc.com/news/georgians-uncover-facebook-flaw-277927.html

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 


Comments: Post a Comment

<< Home

Archives

August 2020   July 2020   June 2020   May 2020   April 2020   March 2020   February 2020   January 2020   December 2019   November 2019   October 2019   September 2019   August 2019   July 2019   June 2019   May 2019   April 2019   March 2019   February 2019   January 2019   December 2018   November 2018   October 2018   September 2018   August 2018   July 2018   June 2018   May 2018   April 2018   March 2018   February 2018   January 2018   December 2017   November 2017   October 2017   September 2017   August 2017   July 2017   June 2017   May 2017   April 2017   March 2017   February 2017   January 2017   December 2016   November 2016   October 2016   September 2016   August 2016   July 2016   June 2016   May 2016   April 2016   March 2016   February 2016   January 2016   December 2015   November 2015   October 2015   September 2015   August 2015   July 2015   June 2015   May 2015   April 2015   March 2015   February 2015   January 2015   December 2014   November 2014   October 2014   September 2014   August 2014   July 2014   June 2014   May 2014   April 2014   March 2014   February 2014   January 2014   December 2013   November 2013   October 2013   September 2013   August 2013   July 2013   June 2013   May 2013   April 2013   March 2013   February 2013   January 2013   December 2012   November 2012   October 2012   September 2012   August 2012   July 2012   June 2012   May 2012   April 2012   March 2012   February 2012   January 2012   December 2011   November 2011   October 2011   September 2011   August 2011   July 2011   June 2011   May 2011   April 2011   March 2011   February 2011   January 2011   December 2010   November 2010   October 2010   September 2010   August 2010   July 2010   June 2010   May 2010   April 2010   March 2010   February 2010   January 2010   December 2009   November 2009   October 2009   September 2009   August 2009   July 2009   June 2009   May 2009   April 2009   March 2009   February 2009   January 2009   December 2008  

Powered by Lottery PostSyndicated RSS FeedSubscribe