Two Facebook fans generated a load of free publicity for their new blog when, in their maiden post, disclosed a vulnerability in the social-networking website that could enable outsiders to view parts of profiles that are set to private.
On its FBHive blog, which went live Monday, the pair revealed a bug in Facebook that can allow non-friends to view personal data on other members.
"With a simple hack, everything listed in a person's 'Basic Information' section can be viewed, no matter what their privacy settings are," they wrote. "This information includes networks, sex, birthday, hometown, siblings, parents, relationship status, interested in, political views and religious views."
The "interested in" section refers to whether a member is using Facebook to connect with friends, romantic partners, etc.
The two hackers did not explain how they were able to pry their way in but promised to release details in the next few days. As proof of their exploit, though, they displayed the "Basic Information" sections of Facebook founder Mark Zuckerberg, Digg founder Kevin Rose and Boing Boing blogger Cory Doctorow.
Security experts said that though this hack does not allow for the spread of malware, it could help perpetrate identity theft.
"You can't consider the information up there totally trusted and private," John Harrison, group product manager at Symantec Security Response, told SCMagazineUS.com on Monday. "I think people need to think twice about the information they put out there."
For example, Harrison said he lists his incorrect birth date on his Facebook profile.
He added that Facebook offers users granular privacy options and recommended that members recheck their settings.
Facebook reportedly closed the hole, but a spokesperson there could not be reached. The operators of FBHive, which promises to discuss Facebook news and rumors on the new blog, also could not be reached.
On its FBHive blog, which went live Monday, the pair revealed a bug in Facebook that can allow non-friends to view personal data on other members.
"With a simple hack, everything listed in a person's 'Basic Information' section can be viewed, no matter what their privacy settings are," they wrote. "This information includes networks, sex, birthday, hometown, siblings, parents, relationship status, interested in, political views and religious views."
The "interested in" section refers to whether a member is using Facebook to connect with friends, romantic partners, etc.
The two hackers did not explain how they were able to pry their way in but promised to release details in the next few days. As proof of their exploit, though, they displayed the "Basic Information" sections of Facebook founder Mark Zuckerberg, Digg founder Kevin Rose and Boing Boing blogger Cory Doctorow.
Security experts said that though this hack does not allow for the spread of malware, it could help perpetrate identity theft.
"You can't consider the information up there totally trusted and private," John Harrison, group product manager at Symantec Security Response, told SCMagazineUS.com on Monday. "I think people need to think twice about the information they put out there."
For example, Harrison said he lists his incorrect birth date on his Facebook profile.
He added that Facebook offers users granular privacy options and recommended that members recheck their settings.
Facebook reportedly closed the hole, but a spokesperson there could not be reached. The operators of FBHive, which promises to discuss Facebook news and rumors on the new blog, also could not be reached.
