Another slap in the Facebook

Symantec has discovered that third parties have accidently had access to Facebook users’ accounts including profiles, photographs, chat, as well as the ability to post messages and mine personal information.

Symantec estimates that as of April 2011, close to 100,000 applications were enabling this leakage, and over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties.

Symantec’s Nishant Doshi had this to say in the Symantec blog:

Fortunately, these third-parties may not have realized their ability to access this information. We have reported this issue to Facebook, who has taken corrective action to help eliminate this issue.

Facebook applications are Web applications that are integrated onto the Facebook platform. According to Facebook, 20 million Facebook applications are installed every day.

Symantec has discovered that in certain cases, Facebook IFRAME applications inadvertently leaked access tokens to third parties like advertisers or analytic platforms. We estimate that as of April 2011, close to 100,000 applications were enabling this leakage. We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties.

Access tokens are like ‘spare keys’ granted by you to the Facebook application. Applications can use these tokens or keys to perform certain actions on behalf of the user or to access the user’s profile. Each token or ‘spare key’ is associated with a select set of permissions, like reading your wall, accessing your friend’s profile, posting to your wall, etc.

Needless to say, the repercussions of this access token leakage are seen far and wide. Facebook was notified of this issue and has confirmed this leakage. Facebook notified us of changes on their end to prevent these tokens from getting leaked.

There is no good way to estimate how many access tokens have already been leaked since the release Facebook applications back in 2007. We fear a lot of these tokens might still be available in log files of third-party servers or still being actively used by advertisers. Concerned Facebook users can change their Facebook passwords to invalidate leaked access tokens. Changing the password invalidates these tokens and is equivalent to “changing the lock” on your Facebook profile.

The news comes at a time of increasing wall spam for Facebook users.

I’ve seen Facebook spam by the ton in recent days, a lot of it on the walls of some of my friends in the security world. This doesn’t speak badly of them, in my opinion.

It simply means it’s incredibly easy to hijack someone’s wall.

–Bill Brenner