Bug in Facebook DYI tool fixed after data of 6M users exposed

Share this article:
Bug in Facebook DYI tool fixed after data of 6M users exposed
Bug in Facebook DYI tool fixed after data of 6M users exposed

Facebook has addressed a weakness in its "Download Your Information" (DYI) tool, which exposed the contact information of around six million of its users.

The social networking site's security team notified users about the glitch via a blog post Friday, saying that users may have inadvertently had their email addresses and phone numbers shared with other users who had some connection with them.

The DYI tool is meant to help users access information stored in their profile and locate people on Facebook who they may know.

“Because of the bug, some of the information used to make friend recommendations and reduce the number of invitations we send was inadvertently stored in association with people's contact information as part of their account on Facebook,” the company wrote.

Users that downloaded an archive of their Facebook account through the DYI tool may have consequently saved additional information of contacts (email addresses and phone numbers) they wouldn't otherwise have had access to, Facebook said.

It was made aware of the security issue through its bug bounty program, where researchers are paid for reporting vulnerabilities to the company. After the bug was reported last week, Facebook disabled the DYI tool and issued a fix the following day.

The site is in the midst of notifying impacted individuals via email.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Researcher discovers flaw in Amazon Kindle Library

A security expert discovered a vulnerability in Amazon's Kindle Library that could lead to cross-site scripting attacks and account compromises.

JPMorgan Chase might struggle to patch vulnerabilities quickly enough

This summer's attack on the bank's network might have helped hackers detect subtle vulnerabilities they could exploit in the future.

WikiLeaks makes FinFisher surveillance software available to public

Copies of controversial surveillance software, called "FinFisher," were made available for public scrutiny by WikiLeaks.