Facebook privacy flaw nailed at Lugano workshop

(PhysOrg.com) -- As if Facebook has not has enough invasion-of-privacy problems, a pair of researchers have come up with one more reason why Facebook cannot rest. Shah Mahmood and Yvo Desmedt, Chair of Information Communication Technology at University College London, want the wide world of Facebook-account users to know that there is a hole in Facebook's settings that allows stalkers, whether they are personal mischief makers or governments, to spy on accounts without the account holder aware that anything is wrong. The technique is called “cloaking” and it works when the attacker deactivates and reactivates accounts, which Facebook allows.

Deactivation is temporary in Facebook; the attacker can reactivate his or her account and keep repeating the on-off switch any number of times. There is no set limit. The victim is not notified of the switch.

The two researchers have revealed Facebook’s privacy loophole in which the attacker temporarily deactivates his or her account to avoid detection and removal from the friend list, but reactivates to spy on the victim’s data. Mahmood and Desmedt's test used a Facebook account under a pseudonym. They asked people to friend them and then they deactivated their account, reactivated for short periods of time, checked their friends' content, and deactivated again. This is what the researchers mean by "cloaking," checking on “friends” regularly by reactivating for ten-minute periods only, and crawling over hundreds of profiles and tracking activities.

The researchers note in their findings how easy it was for them to add over 4300 users and maintain access to their Facebook profile information. "We tested the cloaking attack for 261 days and none of our Facebook friends unfriended during the course."

The loophole appears to be a dream for wanting to nail broader profiles as well, as the security weakness enables attackers to monitor both the individual victim and his or her links. That way, the spies could learn about relationships, political and otherwise, dates the people became Facebook friends, and events they attended. As the authors note, Facebook now has the feature of browsing friendships and this would help the attacker in analyzing the bond between two victims by browsing their friendship which provides information including the month and year when they became Facebook friends, mutual friends, and photos.

As easy as it is to “cloak,” the researchers say the problem can be fixed in a number of ways and they offer several solutions for the loophole. For example, Facebook might move to flag users who activate and deactivate their accounts in a suspicious way, over and over, and these individuals might be monitored. With enough reason, Facebook could even move to ban them from Facebook.

Another suggestion is that users be notified about activation and deactivation actions of “friends.” They could report any suspicious activity back to Facebook.

The Facebook loophole study was presented at the IEEE International Workshop on Security and Social Networking (SESOC 2012) in Lugano, Switzerland on March 19.

© 2011 PhysOrg.com