Skip to main content

Digital Lifestyle > News

Thu, 05 Nov 2009 Developer finds major coding errors in Facebook, MySpace

Simple problems may have exposed users' data for an unknown length of time

Jeremy Kirk

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

Social-networking sites MySpace and Facebook have apparently fixed coding errors that could have allowed an attacker access to all of their users' data and photos.

The simple coding errors are alarming considering the extent to which social networks have gone to reassure their users that their data will be safe. The problem involved the way those sites handle requests for data from other domains, known as the "cross-domain policy."

Sites such as MySpace and Facebook typically block other domains from requesting and receiving data for privacy reasons, except for their own vetted subdomains.

Facebook disallowed access from other applications on its main domain, but a developer in the Netherlands, Yvo Schaap, found that Facebook would allow data to be given out from one of its subdomains.

Yvo Schaap discovered the Facebook issues.

Since the subdomain also hosted all of Facebook's data, it would be possible to steal data by luring a victim to a URL with a Flash application rigged to grab the data if the victim had their auto-login enabled, which most people do, according to Schaap's blog.

A "more invasive and hidden exploit could harvest all the user's personal photos, data and messages to a central server without any trace, and there is no reason why this wouldn't be happening already with both Facebook and MySpace data," Schaap wrote on his blog.

He also found the problem on MySpace, which allowed a domain called "farm.sproutbuilder.com" to access data. A Flash application could be uploaded to that site, which would then be allowed access to the data if a victim visited a malicious URL.

A look at Facebook's latest crossdomain.xml file shows that the bug appears to have been fixed. MySpace also appears to have taken "farm.sproutbuilder.com" out of its cross-domain list.

Facebook and MySpace could not be immediately reached for comment.

Check out our new Macworld Mobile site.

Follow Macworld UK on twitter: www.twitter.com/macworlduk

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Latest News


More news...