Canuck cracks Facebook to access private profiles

by Stevie Smith - Mar 28 2008, 11:08

A security hole thought to have been closed on Facebook appears to be lingering as an ongoing problem for the hugely popular social networking Web site.

Facebook security hole not quite closed claims Canadian computer engineer. Credit: Facebook.

Brought to Facebook’s attention in February, following the initial discovery by Vancouver resident and computer technician Byron Ng, the exploit in question allowed non-approved Facebook users to see private photographs posted on other people’s personal profile pages.Typically, given the unending obsession with Hollywood celebrities, private pictures of perpetually-partying millionaire heiress Paris Hilton and one of her younger brothers were subsequently unearthed through the security hole. According to Facebook, any such privacy breaches allowing outside access to personal content have since been closed, but that’s a claim that Mr. Ng has recently taken issue with.Specifically, while the error would appear to have been fixed in the main, Mr. Ng says he -- and anyone else familiar with the glitch -- is still able to access private Facebook photo albums via their unique URL addresses.“If you saved what you saw before you can still look at it,” he commented in a report published by the Vancouver Sun. “It’s just lazy programming, I guess.”According to Mr. Ng, the exploit granted access through the ‘tagging’ system employed by Facebook users to assign certain descriptive words (names, events, etc.,) to posted images for convenient recall on a collective basis.While there is obviously concern as to the potential privacy holes that glitches such as this one can create, Facebook does not offer any form of guarantee that personal content won’t be viewed by outside members of the service not pre-approved as friends by individual users.“…we cannot and do not guarantee that User Content you post on the Site will not be viewed by unauthorized persons,” Facebook states in its user agreement. “We are not responsible for circumvention of any privacy settings or security measures contained on the Site.”

Talkback

Add your comment (no registration required)

page: 1

Captain JackMar 28th, 2008 - 13:35:14

You dont need to know the URL to access private photos.

If someone has commented on a photo of a friend of yours. You can go to your friends Photo page, select View Comments, find that picture and then you have access to that entire photo album whether that person is a friend of yours or not. It doesnt matter if they didnt want you to see the rest of the album. Someone commented on one photo of your friend and now you can see the rest of the album.

Report this comment

XXXMonkeyMar 31st, 2008 - 13:22:20

Not if the profile user has restricted access to their photo content, which I believe this glitch violated.

Report this comment

ImvuMay 6th, 2008 - 05:07:44

Thanks to all the media attention these days around those leaks on FB, everything got closed. I can't access someone's profile in (so far I know, I haven't tried any new methods, basically cause my old way, YESTERDAY actually still worked and today they fixed it) any possible way to check their possible photos.

Report this comment

josephApr 14th, 2009 - 00:56:50

i found that the site www.spyonfacebook.com still has the active exploit to view the private facebook profiles

Report this comment

page: 1

Add your comment (no registration required)

Internet

Canuck cracks Facebook to access private profiles

Talkback

Latest

Latest Articles on Monsters&Critics

In The Tech Herald

Site

The Fine Print