IBGerm

IDG News Service – Social networking sites MySpace and Facebook have apparently fixed coding errors that could have allowed an attacker access to all of their users’ data and photos.

The simple coding errors are alarming considering the extent to which social networks have gone to reassure their users that their data will be safe. The problem involved the way the sites handle requests for data from other domains, known as the "cross-domain policy."

Sites such as MySpace and Facebook typically block other domains from requesting and receiving data for privacy reasons, except for their own vetted  subdomains.

Facebook disallowed access from other applications on its main domain, but a developer in the Netherlands, Yvo Schaap, found that Facebook would allow data to be given out from one of its subdomains. 

Since the subdomain also hosted all of Facebook’s data, it would be possible to steal data by luring a victim to a URL with a Flash application rigged to grab the data if the victim had their auto-login enabled, which most people do, according to Schaap’s blog.

A "more invasive and hidden exploit could harvest all the user’s personal photos, data and messages to a central server without any trace, and there is no reason why this wouldn’t be happening already with both Facebook and MySpace data," Schaap wrote on his blog.

He also found the problem on MySpace, which allowed a domain called "farm.sproutbuilder.com" to access data. A Flash application could be uploaded to that site, which would then be allowed access to the data if a victim visited a malicious URL.

MySpace disagreed with the severity of the error, saying it would have only exposed information that was already public. The problem was with the sproutbuilder domain, and it has since been fixed, a spokeswoman said in an e-mailed statement.

"No public MySpace data was exposed and the vulnerability was never exploited," the statement read.

A look at Facebook’s latest crossdomain.xml file shows that the bug appears to have been fixed. MySpace also appears to have taken "farm.sproutbuilder.com" out of its cross-domain list.

In an e-mailed statement, Facebook said it "worked with the researcher who identified this issue to fix it. We have not received any reports that it was ever exploited."

 

I am not one to cry chicken little that the sky is falling but people need to stop and take warning about what they post on the social networking sites like   MySpace(people still use that one?) as well as Tweeter and Facebook. At the very least limit correctly those that can see your post, tweets etc… I have read two funny articles in the past few weeks about a gut that tweeted he was going on vacation and didn’t secure all his personal information. Guess what!, he got robbed while he was away. Read here.  Now I just read that the newly appointed head of Britain’s Secret Service (MI6) had to step down because his wife posted vacation pictures of them as well as didn’t limited who could see the posts and who her friends were. Everyone in the world knew this guys friends and some higher level stuff. Big security breach. Read here. People wise up! Take heed now! Just my two and a half cents!!.

 

===============================================================================================