Showing posts with label Privacy Breach. Show all posts

Tuesday, February 4, 2014

Facebook's Android App Is Malicious, Reads SMS - Kaspersky

Not surprising for facebook, we had seen cookies tracking the activity of facebook users. But this one is on mobile where facebook intends to read your SMS using their app for mobile! This is now considered a great breach to privacy and the issue has been confirmed by Kaspersky Labs as well.

facebook's breach into privacy : Photo courtesy : ientry.com

“Over the last few days there has been a constant scrutiny over Facebook having access to your SMS. Buried within the latest update for Facebook’s Android app is a feature that is causing growing concern among some users,” Kaspersky said in a statement today. The social media’s logic behind seeking access to SMS is that if you add a phone number to your account, this allows them to confirm your the number automatically by finding the confirmation code within a text message. This is the same technique used by various apps, including Whatsapp to verify your phone number at the time of installation.

The updated Facebook application now wants to read calendar events plus confidential information which it justifies as it is required to allow the app to show your calendar availability (based on your phone’s calendar) when you’re viewing an event on Facebook. “Two-factor authentication provides an extra level of security, so it’s good to see Facebook providing this option … As a final note, we’d urge people to carefully check the permissions requested by any app when you first install it,” Kaspersky Lab’s Principal Security Researcher David Emm said. Kaspersky added the permissions also grants access to multimedia messages, for which reason is not explicitly given.

Kaspersky mentions that Android still has control over how the permissions of the app are dealt. But the increasing encroachments on to privacy of users seems to be a concern. In response to the issue, facebook mentioned on the website : “Keep in mind that Android controls the way the permissions are named, and the way they’re named doesn’t necessarily reflect the way the Facebook app uses them. We realise that some of these permissions sound scary, so we’d like to provide more info about how we use them.”

So how many will be removing the facebook app from their phones? Please note that this is only part of the latest update on facebook App.

You can find the detailed explanation from Facebook at : https://www.facebook.com/help/210676372433246

We are happy, facebook for taking time to write this out, but this will no way justify the need to read text!

Unknown

- Unknown Updated at: Tuesday, February 04, 2014

Wednesday, November 6, 2013

Apple Reveals The Informations Request From Authorities : No Indian Requests

Apple puts out the sheet of data that was transferred over to the government authorities requesting user data. The Apple team has mentioned that they have provided all legally liable information to the respective authorities and there has been a confirmation that it will continue to publish the information transparently through coming years.

"We have reported all the information we are legally allowed to share," the report, issued Tuesday, states, "and Apple will continue to advocate for greater transparency about the requests we receive."

The report's Account Information Requests table, below (click to make readable), lists the exact number of requests received, acted upon, and other details from the 31 countries from which Apple received such requests. "Some countries are not listed in this report," a note reads, "because Apple has not received any information requests from the government there."

"At the time of this report," Apple notes, "the U.S. government does not allow Apple to disclose, except in broad ranges, the number of national security orders, the number of accounts affected by the orders, or whether content, such as emails, was disclosed. We strongly oppose this gag order, and Apple has made the case for relief from these restrictions in meetings and discussions with the White House, the U.S. Attorney General, congressional leaders, and the courts."

Apple confirms that there has been only very rare incidents where the really private photos and mails were requested. "In very rare cases," the report says about account requests, "we are asked to provide stored photos or email. We consider these requests very carefully and only provide account content in extremely limited circumstances."

Perhaps most important, our business does not depend on collecting personal data. We have no interest in amassing personal information about our customers. We protect personal conversations by providing end-to-end encryption over iMessage and FaceTime. We do not store location data, Maps searches, or Siri requests in any identifiable form. ... Unlike many other companies dealing with requests for customer data from government agencies, Apple's main business is not about collecting information. Adds apple giving the thumbs down to facebook, twitter, and the like.

There has been no reports on the requests from India government yet, but there has been quite a count of phone location requests from India.

Unknown

- Unknown Updated at: Wednesday, November 06, 2013

Thursday, August 22, 2013

Facebook Hacker Khalil Receives $12K from Online Donors

The hacker who broke into Mark Zuckerberg's Facebook Timeline to expose a security lapse will be awarded nearly $12,000 from an online crowdsourced campaign.

The GoFundMe campaign has raised $11,741 for Khalil Shreateh, of Palestine, who claims he was forced to hack into Zuckerberg's page to bring attention to the security vulnerability because Facebook had ignored his earlier warnings.

The bug that Shreateh found allowed him to post on the Timelines of people who weren't his Facebook friends.

The reward for his work was arranged by Marc Maiffret, the chief technology officer of security firm BeyondTrust.

'Khalil Shreateh found a vulnerability in Facebook.com and, due to miscommunication, was not awarded a bounty for his work,' Maiffret wrote on the GoFundMe campaign page. 'Let us all send a message to security researchers across the world and say that we appreciate the efforts they make for the good of everyone.'

Facebook has a 'Bug Bounty' program that pays out at least $500 to hackers who bring software bugs to the company's attention. But the company said Shreateh would not qualify for a reward because he tested the bug against another user.

Joe Sullivan, Facebook's Chief Security Officer, explained the company's decision in a post online.

'We will not change our practice of refusing to pay rewards to researchers who have tested vulnerabilities against real users,' he wrote. 'It is never acceptable to compromise the security or privacy of other people. In this case, the researcher could have sent a more detailed report (like the video he later published), and he could have used one of our test accounts to confirm the bug.'

Shreateh first contacted the Facebook security team after proving the glitch was real by writing on the wall of a friend of the Facebook founder.

But instead of thanking him and fixing the issue, Facebook said it wasn’t a bug.

‘My name is Khalil Shreateh. I finished school with B.A degree in Information Systems . I would like to report a bug in your main site (www.facebook.com) which i discovered it...The bug allow Facebook users to share links to other facebook users , I tested it on Sarah.Goodin wall and I got success post.’

Shreateh, whose first language is Arabic, lives in Palestine and is in no way connected with Zuckerberg’s fellow Harvard alum Goodin. He hoped his ability to post to her page, nonetheless, would help prove his case to Facebook security.

However, instead of repairing the obvious security breach, Facebook replied to Shreateh by saying the issue ‘was not a bug.’

Undeterred, Shreateh used the glitch to hack his way onto Mark Zuckerberg’s Facebook page.

‘Sorry for breaking your privacy,’ he wrote in a since removed post to Zuckerberg, ‘I had no other choice…after all the reports I sent to Facebook team.’

Shreateh went on to recount his attempts to warn the website and posted a grab of the post on his blog.

Minutes later, his pleas were answered. Facebook contacted him demanding to know how he’d hacked their bosses personal page.

‘We fixed this bug on Thursday,’ wrote Matt Jones from Facebook’s security team in a Saturday post on Hacker News.

Facebook has a bounty program designed to bribe hackers into reporting glitches they find rather than exploiting them. Such validated reports are worth $500.