Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

100 Million Facebook Pages Leaked On Torrent Site

CmdrTaco posted more than 4 years ago | from the so-many-pokes dept.

Security 163

Stoobalou writes "A directory containing personal details about more than 100 million Facebook users has surfaced on an Internet file-sharing site. The 2.8GB torrent was compiled by hacker Ron Bowes of Skull Security, who created a web crawler program that harvested data on users contained in Facebook's open access directory, which lists all users who haven't bothered to change their privacy settings to make their pages unavailable to search engines."

Sorry! There are no comments related to the filter you selected.

Well (1, Funny)

Spazztastic (814296) | more than 4 years ago | (#33055930)

My only question is: Does it include pictures? That may be a deal breaker...

Re:Well (4, Informative)

Gi0 (773404) | more than 4 years ago | (#33055960)

No. This torrent contains: * The URL of every searchable Facebook user's profile * The name of every searchable Facebook user, both unique and by count (perfect for post-processing, datamining, etc) * Processed lists, including first names with count, last names with count, potential usernames with count, etc * The programs I used to generate everything

Re:Well (3, Insightful)

Jedi Alec (258881) | more than 4 years ago | (#33055976)

It's 2.8 gigs as it is, imagine how big it would get if 100 million pics were added to it ;-)

Re:Well (-1, Offtopic)

Spazztastic (814296) | more than 4 years ago | (#33056004)

It's 2.8 gigs as it is, imagine how big it would get if 100 million pics were added to it ;-)

That's what she said!

No, It's Just a List (5, Informative)

eldavojohn (898314) | more than 4 years ago | (#33056010)

If you go to the originator [skullsecurity.org] , here's all it contains:

This torrent contains:

* The URL of every searchable Facebook user's profile
* The name of every searchable Facebook user, both unique and by count (perfect for post-processing, datamining, etc)
* Processed lists, including first names with count, last names with count, potential usernames with count, etc
* The programs I used to generate everything

You're going to get a URL to pages. If the user has since made them inaccessible, you'll only get what you can from their public profile. Like, you cannot get to my friends list from my public profile. You'll get "potential" usernames to log into Facebook. Big deal. Remember when everyone could make a username for Facebook and that was also their profile URL? Well, now you can guess the most common names and add them to this list like david [facebook.com] . Then you could use ncrack or whatever.

Not a whole lot in this file. Not like he scraped the pages of data and put that in a csv file for research or anything really interesting.

Re:No, It's Just a List (1)

Sockatume (732728) | more than 4 years ago | (#33056080)

No good for attacking any individual user, plenty useful for anyone looking to streamline their search for soft targets for social engineering attacks.

Re:No, It's Just a List (1)

Sockatume (732728) | more than 4 years ago | (#33056182)

(Which is to say, it's hardly a threat in itself, but it highlights one.)

Re:No, It's Just a List (1)

Spad (470073) | more than 4 years ago | (#33056600)

Not like he *published* anything really interesting.

Just a spam List (2, Informative)

Alien1024 (1742918) | more than 4 years ago | (#33056988)

Indeed, just a spam list but with facebook names instead of email addresses.

Shouldn't come as a surprise to anybody, really. The moment you create a searchable profile, you know that is bound to happen.

muhahaa (0, Troll)

Dyinobal (1427207) | more than 4 years ago | (#33055936)

now I can put my evil plan into action muhahahahahahhahahha

frist psot (-1, Troll)

Anonymous Coward | more than 4 years ago | (#33055938)

facebook is pants

Re:frist psot (1)

hkgroove (791170) | more than 4 years ago | (#33057380)

that was my facebook password before I deleted my account after someone changed it to "no it's not"

And now more people will know about it (1, Flamebait)

Hojima (1228978) | more than 4 years ago | (#33055948)

and get more information from those people. You stay classy slashdot.

Re:And now more people will know about it (0, Insightful)

Anonymous Coward | more than 4 years ago | (#33056046)

Yeah, right, because if this story shows anything at all it's that Security Through Obscurity works... Moron.

Re:And now more people will know about it (5, Insightful)

causality (777677) | more than 4 years ago | (#33056258)

and get more information from those people. You stay classy slashdot.

Rest assured that the blackhats who want this information already know about it. As another user suggested, one potential abuse of this information would be to choose targets for social engineering attacks. But those who would exploit it did not just now hear about it. If anything it's the public that is often left behind.

If you don't want to see that reality then we cannot have a conversation about this. If you can see that reality, then I have one question for you: how do you propose we solve the bigger problem of raising awareness of the dangers and misuses of such databases without some publicity? The users who least understand how these things can be abused are generally the ones who are most actively making their personal information publically available. Everyone else either doesn't share the need for personal exhibition, uses false data, or takes a deliberate and calculated risk with any real data made available.

While I think it's an empty vanity personally, I'm not against someone making a public exhibit of themselves if that's what they wish to do. What I would like to see, however, is for those people to do this with a full awareness of how it could be used against them. The deck is somewhat stacked against them because the black hats thoroughly study how to misuse information, whereas the average user just wants to communicate with friends. That can change, and it really should.

Re:And now more people will know about it (3, Interesting)

Mark Hood (1630) | more than 4 years ago | (#33056418)

and get more information from those people. You stay classy slashdot.

Rest assured that the blackhats who want this information already know about it.

I agree - and while it's good that more people know about this so they can protect themselves, it wasn't the case that every black hat knew about this already - there'll be a load of script kiddies giving it a go now, so the chances of getting hacked went up.

That said, the people who had a genuine malicious intent were more than likely doing this behind the scenes, while the 'kiddies' tend to go for vandalism and defacement. I'd rather that if I got hacked, it just said 'ask me about teh spam' on my wall, than it silently installed a data-tracking app or something...

But really, what's the issue here? That someone went to the trouble of scraping every public name and profile off the site, or that it wasn't Google?

Mark

PS Why doesn't Chrome recognise Google as a properly spelled word?

Re:And now more people will know about it (1)

ikarous (1230832) | more than 4 years ago | (#33056756)

While I think it's an empty vanity personally, I'm not against someone making a public exhibit of themselves if that's what they wish to do. What I would like to see, however, is for those people to do this with a full awareness of how it could be used against them. The deck is somewhat stacked against them because the black hats thoroughly study how to misuse information, whereas the average user just wants to communicate with friends. That can change, and it really should.

I agree that people need to be more concerned about privacy, but I don't think believe that the situation is without hope. My admittedly anecdotal experience leaves me with the impression that people are slowly becoming aware of the potential consequences of freely sharing information on public social networking sites. The easiest way to raise awareness with individual people, I've found, is to simply point to one of the plentiful news stories detailing a case where some individual was passed over for a job opportunity because of some mostly innocuous posting on Facebook or MySpace.

That strategy may not work with teenagers who have little yet to lose, but it usually makes their elders think twice about what they publish online.

Re:And now more people will know about it (4, Interesting)

causality (777677) | more than 4 years ago | (#33056396)

and get more information from those people. You stay classy slashdot.

I'm not crazy about making a second reply to this one post but I wanted this to be said.

I have some disagreement with this being modded -1 Flamebait. I don't think his intention was to start a flamewar, though I admit that's possible and an AC has already responded that way. Still, this is a genuinely held sentiment. A lot of people really do feel this way. It's as though they think that not talking about this problem and not making such information available will make it go away. That amounts to burying one's head in the sand.

I'd rather call it out and explain why this is false and shortsighted than bury the comment under negative moderations. Making the comment disappear for all users who are not browsing at -1 will surely reduce the audience of that one comment. What it won't do is persuade others who mistakenly feel the same way. So I don't think this is Flamebait. I think this is a false perception that can be corrected with a true perception.

FTFA (3, Insightful)

EricWright (16803) | more than 4 years ago | (#33055950)

perhaps the existence of a stalker's online black book might finally persuade less security-minded Facebook users to get their arses in gear.

More likely it will precipitate a lawsuit. Why fix the problem when you can sue the pants off someone instead?

Re:FTFA (5, Informative)

TubeSteak (669689) | more than 4 years ago | (#33056016)

More likely it will precipitate a lawsuit. Why fix the problem when you can sue the pants off someone instead?

Sue for what? Violating Facebook's ToS?

I'm surprised TFA didn't link to the guy's blog. He has a good writeup there
http://www.skullsecurity.org/blog/?p=887 [skullsecurity.org]

The Torrent: http://www.skullsecurity.org/blogdata/fbdata.torrent [skullsecurity.org]

Re:FTFA (5, Insightful)

Anonymous Coward | more than 4 years ago | (#33056220)

In this case I think it is a more of a matter of 'yeah so?'. I put my information on that website *SO* I could be found. Everyone else who links to me is doing the *EXACT SAME THING*. The whole point of this site as sold is to link you to your friends and family. Thats it. How do you find people? Oh yeah you search for them.

The usual internet problems exist. Do not put up there what you do not want other to know.

I am sure there are dozens of ways to abuse the information that is up there. But guess what *YOU HAVE DECIDED* to put it up there...

That you expect some sort of privacy from an application that by its nature is about being open and sharing whatever stupid thing you are doing is backwards.

If you do not want to be found facebook is not the place to be. It shares everything no matter what your 'settings' are. You have by its nature shared with at least 2 parties. Your friends and facebook. If you want to keep a secret you do not tell people who are known to tell others.

Re:FTFA (4, Interesting)

timeOday (582209) | more than 4 years ago | (#33056920)

The usual internet problems exist. Do not put up there what you do not want other to know.

I am sure there are dozens of ways to abuse the information that is up there. But guess what *YOU HAVE DECIDED* to put it up there...

The problem is that's not true. It is becoming increasingly easy to correlate all the information others have incidentally posted about you, and put together a pretty good picture of you, even if you personally have posted nothing at all.

I have no facebook account. Yet yesterday I got an email facebook invite from somebody I've never heard of, and it said "here are 9 other friends of this person you may know." I *do* know 7 of the 9, through different business dealings that have nothing to do with each other. They're sure not people who "friended" me, since we don't have that kind of relationship. It's creepy.

Re:FTFA (2, Interesting)

pinkushun (1467193) | more than 4 years ago | (#33056364)

Well if Facebook's TOS includes them housing your profile data, does compiling publicly visible information into a torrent, shared and owned by everyone, breach their TOS?

Do Facebook even have any claims to that data, if it is publicly visible in the first place?

torrent (3, Informative)

digitalsushi (137809) | more than 4 years ago | (#33055962)

Re:torrent (2, Interesting)

Anonymous Coward | more than 4 years ago | (#33056028)


I'm bringing it on to a 1 Gbit, 10 TB/month seedbox...
Enjoy.

I'm rooting for you (1)

stephanruby (542433) | more than 4 years ago | (#33056304)

You only need 500 kazillion more leechers, and you'll be almost as big as Google/Yahoo.

Re:I'm rooting for you (0)

Anonymous Coward | more than 4 years ago | (#33056362)

(gp here) I've just passed a 40-1 ratio on that torrent. :)

Leaked? (5, Insightful)

ikarous (1230832) | more than 4 years ago | (#33055972)

Misleading headline is misleading. These public profiles haven't been leaked. They've simply been aggregated.

Re:Leaked? (5, Insightful)

jeffmeden (135043) | more than 4 years ago | (#33056138)

They might as well have said "millions of home telephone numbers LEAKED via paper-based archive deposited randomly on doorsteps ALL ACROSS TEH COUNTRY!!!"

Worthless headline; it should read "Facebook name and URL database created from already public information, nothing to see here, move along"

Re:Leaked? (0)

Anonymous Coward | more than 4 years ago | (#33057286)

Made me laugh. Good analogy.

Re:Leaked? (4, Insightful)

ElectricTurtle (1171201) | more than 4 years ago | (#33057508)

You, sir, have written the only thing that need be said in this discussion. Congratulations are in order.

Re:Leaked? (0)

Anonymous Coward | more than 4 years ago | (#33056260)

I concur. Slashdot editors fail again.

Leaked password (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#33056266)

looks like CmdrTaco's password was leaked to kdawson, who then used it to post this story!

hrm, is kdawson the new CowboyNeal?

Re:Leaked? (2, Funny)

holiggan (522846) | more than 4 years ago | (#33056300)

You mean "curated"

Re:Leaked? (1)

ikarous (1230832) | more than 4 years ago | (#33056356)

I prefer aardvarks.

Re:Leaked? (-1, Troll)

Anonymous Coward | more than 4 years ago | (#33056536)

I'm metamoderating this and, while the absurdity is amusing, I'm not getting the joke. Offtopic for you.

Re:Leaked? (1)

pinkushun (1467193) | more than 4 years ago | (#33056404)

Maybe they meant 'leaked' as in not through the Facebook channels or without their knowledge. Leaked is a strong word in this case.

Re:Leaked? (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#33056416)

Fucking stupid sentences are fucking stupid.

This isn't 4chan, take your meme shit back to the pedophile hole where it (and inevitably, you) belong.

Re:Leaked? (4, Funny)

ikarous (1230832) | more than 4 years ago | (#33056512)

Fucking stupid sentences are fucking stupid.

This isn't 4chan, take your meme shit back to the pedophile hole where it (and inevitably, you) belong.

I have attempted to do as you suggest, but I'm afraid I've been unable to locate either feces of meme or a perforated pedophile. Nevertheless, I appreciate your advice.

Re:Leaked? (1)

Surt (22457) | more than 4 years ago | (#33057122)

You're supposed to perforate your own pedophile for this purpose, and help out with the grand pedophile perforation project.

Obvious next step (2, Insightful)

Pojut (1027544) | more than 4 years ago | (#33055984)

Download the file and make sure I'm not in there. Onward and upward.

Re:Obvious next step (2, Interesting)

betterunixthanunix (980855) | more than 4 years ago | (#33056240)

Same here; I killed my Facebook account 3 years ago, but who knows how long these guys have been aggregating their data, or who else might have been posting information about me.

Security Research (1, Insightful)

chebucto (992517) | more than 4 years ago | (#33055992)

I'll bet there are about 100 million people who would like to test the security of Ron Bowes' nuts against a swift kick. I mean, he should be aware of the Extreme Pain vulnerability by now, and he should have taken the most basic security precautions by now, like wearing a cup. If not, well, he deserves what he gets, right?

Re:Security Research (3, Insightful)

bsDaemon (87307) | more than 4 years ago | (#33056146)

I doubt there is a significant overlap between the people who follow computer security and online privacy issues and the people who still leave their Facebook profiles open for search indexing. I would venture a guess that most of the people harvested will never know, or care. I mean, after all, it doesn't even really sound like this guy did anything more than Google already did anyway.

Re:Security Research (1)

linzeal (197905) | more than 4 years ago | (#33056462)

Who uses real information online anyways?

Re:Security Research (1)

bsDaemon (87307) | more than 4 years ago | (#33056716)

Sometimes you need to prove you real identity, such as to verify an SSL certificate or OpenPGP key. But there is a difference between establishing you are who you say you are and telling the entire known universe about every time you went on a weekend drinking binge at on frat row.

Your Anger May Be Misdirected (4, Insightful)

eldavojohn (898314) | more than 4 years ago | (#33056320)

I'll bet there are about 100 million people who would like to test the security of Ron Bowes' nuts against a swift kick. I mean, he should be aware of the Extreme Pain vulnerability by now, and he should have taken the most basic security precautions by now, like wearing a cup. If not, well, he deserves what he gets, right?

+5 Insightful? Why is it that we regard Tavis Ormandy as someone trying to expose the insecurity of Microsoft when he releases a how-to exploit Windows hack [slashdot.org] but when a security researcher attempts to reveal how insecure Facebook's "Directory" service can be we attack him as the creator of that service and not Facebook?

I believe your anger would be better directed at Facebook. After all, this is posted in his blog for the world to see while a malware author could have just taken this list and run ncrack on it without anyone knowing.

I would also like to point out that, as mentioned many times in this thread, this is just a list. Not even real names but just usernames of people on Facebook. That means that if you find your username on this list, you can restrict your settings so that no one can see your public profile. Then if someone uses this URL list to look you up they get nothing.

So a security researcher tries to wake up Facebook users and he's the guy you want to kick in the nuts? Very curious.

Re:Your Anger May Be Misdirected (4, Insightful)

John Hasler (414242) | more than 4 years ago | (#33056354)

> I believe your anger would be better directed at Facebook.

Why is there any need for anger at all? These users made their pages public. This guy created a list of public Facebook pages. So what?

Re:Your Anger May Be Misdirected (1)

Captain Hook (923766) | more than 4 years ago | (#33056938)

> Why is there any need for anger at all? These users made their pages public. This guy created a list of public Facebook pages. So what?

Technically, these users failed to hide their profiles, or to lock the privacy settings back down after Facebook opened them all back up earlier in the year. In fact, even if they did lock their privacy settings back down after facebook opened them all up the last time, the script might have just scrapped the information in the time inbetween.

You make it sound like the users made a conscious, informed decision to allow everyone to see everything when that is far from the only possible explaination.

Re:Your Anger May Be Misdirected (1)

Jeff DeMaagd (2015) | more than 4 years ago | (#33057492)

For the most part, I agree, this is all information you can get with Google.

However, Facebook's privacy settings are change often and can be confusing. The blame really should go to Facebook at least for that.

Re:Your Anger May Be Misdirected (0)

Anonymous Coward | more than 4 years ago | (#33056502)

maybe cause one isnt a 12 year old wanna be leeter hiding behind "castle grayskull security" posting this shit on bit torrents?

Re:Security Research (3, Insightful)

gstoddart (321705) | more than 4 years ago | (#33056346)

I'll bet there are about 100 million people who would like to test the security of Ron Bowes' nuts against a swift kick.

Purely playing Devil's advocate here ....

So, Facebook made this stuff public by default. The individual users didn't change their settings to make it private (either they didn't know, or didn't care). This guy collects all of the information which is open to him, and publishes it.

I'm not saying I agree with scraping all of this information, but I place much more of the blame on Facebook for their shitty privacy policies and making a change to the data which made it public by default.

This is a logical conclusion of having that much information public by default. It's scary to get that information on 170 million people, but, as TFA points out, this is hardly illegal.

I'm sure Facebook will say this is a good thing, and that those users wanted that information made available since that seems to be their default position on security and privacy.

Re:Security Research (2, Informative)

jeffmeden (135043) | more than 4 years ago | (#33056440)

I'm sure Facebook will say this is a good thing, and that those users wanted that information made available since that seems to be their default position on security and privacy.

Mark Zuckerberg actually said exactly that in a recent interview (with NPR, google it) when confronted with the question of "why not just make the default 'private'?" he quipped "We think users want to be seen". He is probably right, but there are way more people out there who are clueless about their privacy and mistakenly disclose tons of information than those who are well informed and intentionally disclose tons of information. Assuming the whole world is made up of perfectly informed adults who consent to sharing all of their information is a pretty big reach.

Re:Security Research (1)

gstoddart (321705) | more than 4 years ago | (#33056964)

"We think users want to be seen". He is probably right, but there are way more people out there who are clueless about their privacy and mistakenly disclose tons of information than those who are well informed and intentionally disclose tons of information.

Oh, I think it entirely unlikely that 100 million people chose to disclose that much information.

I blame Facebook constantly changing things, and user apathy/lack of understanding in this case.

This is just one more example of why I don't use Facebook. But, the guy who scraped it was doing something in a gray area, but neither illegal nor against the ToS. Because Facebook themselves made this data public and left it up to the user to lock it down.

Re:Security Research (1)

natehoy (1608657) | more than 4 years ago | (#33056360)

As long as Ron Bowes didn't uncheck the pre-selected checkbox "you allow random people to come up to you and give your nuts a swift kick", sure.

Look, I've been using Facebook for a couple of years now. Facebook is finally pretty forthcoming about telling their users what's accessible to the public in your profile. There's even a "see your profile as {friend|friend-of-friend|public} sees you" button so you can easily review who sees what.

It's pretty easy to mark things as "friends only", though I prefer the simpler step of not putting shit on Facebook that I don't want to become public knowledge in the first place. I still have mostly everything set as "friends only", but in case there is a leak I want to not have to care.

Having said that, I'm struggling with what Ron did that is considered kick-to-the-nuts-worthy. He published a list of URLs to people's Facebook pages that point to information that is set to be viewable by the public. From what I can see, he hasn't extracted any of the actual information. He's providing less information than Google would, and isn't caching anything.

I haven't owned a landline in almost a decade - I like not being in the phone book. But I'm not at all uncomfortable with this list, because it doesn't expose one goddamned thing about me that isn't already exposed by my specific request.

If anything, maybe a few Facebook neophytes will go through the handful of mouseclicks it takes to set some of their information as "Friends Only" at which point the URL will point to an empty (or at least less full) page and the user will be safer from strangers knowing every detail about their dog's bowel movements or their Farmville score.

Re:Security Research (1)

mlts (1038732) | more than 4 years ago | (#33056764)

The trick with FB is to have the default security settings set to only allow a certain group of friends see your wall, settings, personal info, pictures, and other stuff. This gives you two advantages:

1: Nobody sees your personal information unless you explicitly add them to the group. So if your professor or boss demands friend access, they can get it, but it won't give them much information.

2: You can remove people from seeing what you are doing without unfriending them. This way, someone you don't feel like speaking to can be off your list, and if that was a mistake, they can be re-added without the business of two-way re-friending them.

Re:Security Research (1)

natehoy (1608657) | more than 4 years ago | (#33057274)

Very true. I haven't gone to the trouble of setting up groups of friends, because the kind of information I share on Facebook is stuff I really don't feel the need to "segregate".

I always assume Facebook is selling everything I post or say to someone I don't like, so anything that I feel the need to keep in a smaller circle of friends is either emailed or said in person.

Re:Security Research (0)

Anonymous Coward | more than 4 years ago | (#33057048)

This just proves that a 100 million people are lazy or don't care, if they didn't take the time to fix their account and got pissed off that he did this then it's there own fault. It also shows that facebook ToS is complete crap, but I think we all knew that.

enjoy! (0)

Anonymous Coward | more than 4 years ago | (#33056032)

my profile is undoubtedly among them, along with several hundred pictures that I've posted. Personally, I don't care too much about any information you're able to glean from it because I've been rather careful about the information I've posted there.
 
However I do pity those whose friends don't understand the necessity for discression in public.

Re:enjoy! (1)

djsmiley (752149) | more than 4 years ago | (#33056166)

No pictures, just url's and text...

which means no many people will bother reading through it all....

However if he posted everyones pics, i'm sure people would love to look through it ;')

Re:enjoy! (1)

shadowknot (853491) | more than 4 years ago | (#33056386)

Can you imagine how huge it would be though? I'm currently working a digital forensics case in which a computer and a couple of USB flash drives have been seized and I've already got >6GB of images to go through with extraction only partially done, 100 million FB profiles with at least one image (often many more) would be fracking enormous.

Re:enjoy! (0)

Anonymous Coward | more than 4 years ago | (#33056380)

However I do pity those whose friends don't understand the necessity for discression in public.

Discression in public? You can get a ticket for that, can't you?

Okay, so... (4, Insightful)

Revotron (1115029) | more than 4 years ago | (#33056048)

This guy wrote a script to crawl Facebook and download everything he could. So? Nothing is revealed here that we couldn't find manually ourselves by just looking at a person of interest's profile.

This story is about a glorified crawler. No actual hacking transpired. No personal information that wasn't already revealed has been revealed. This is not news. In fact, I had to go back to TFS and double-check that kdawson wasn't the editor - that's how terrible this story really is.

Re:Okay, so... (2, Informative)

Anonymous Coward | more than 4 years ago | (#33056118)

The point is you don't have to hack anything, facebook just defaults to posting stuff that a hacker might otherwise have to hack in to get.

For example, did you know that when you add a new email to facebook, it defaults to showing that email?

Re:Okay, so... (0)

TubeSteak (669689) | more than 4 years ago | (#33056120)

This guy wrote a script to crawl Facebook and download everything he could. So? Nothing is revealed here that we couldn't find manually ourselves by just looking at a person of interest's profile.

This story is about a glorified crawler. No actual hacking transpired. No personal information that wasn't already revealed has been revealed.

One piece of information is an anecdote.
170 million pieces of information are data.

Until this data dump, the only people doing data mining were Facebook & their partners.
Now anyone can.

If you don't see the value in this aggregation of information, you're not looking very hard.

Re:Okay, so... (3, Insightful)

John Hasler (414242) | more than 4 years ago | (#33056324)

> Until this data dump, the only people doing data mining were Facebook &
> their partners.

Do you seriously believe that no one has ever written such a script before?

Re:Okay, so... (0)

Anonymous Coward | more than 4 years ago | (#33056156)

I agree. Because 100 million click monkey's didn't change their profile......

Re:Okay, so... (2, Informative)

eldavojohn (898314) | more than 4 years ago | (#33056224)

This guy wrote a script to crawl Facebook and download everything he could.

It's not even about that, it's about a guy who wrote a script to collect usernames of everyone on facebook which double as the URL for their profiles. From there you can go and scrape everything you want. You don't even get their public information that they can chose to display on the front page like religion or real name. That's not even on there. No images, just URLs which double as logins.

This story is about a glorified crawler. No actual hacking transpired. No personal information that wasn't already revealed has been revealed. This is not news. In fact, I had to go back to TFS and double-check that kdawson wasn't the editor - that's how terrible this story really is.

It's worse than that. It's about a glorified crawler that was augmented with common names to create a list of possible usernames [slashdot.org] and URLs for Facebook. If you gave me a glorified crawler that collected interesting data inside a csv, I'd actually be a little interested in using it. Hell, anyone can do this in perl by coding for five minutes but it would take days for the thing to complete with a risk of banning from Facebook.

They say this in the article and from the original source [skullsecurity.org] . The summary is more than misleading and there's even less to say "big deal" about than you presupposed.

Re:Okay, so... (1)

Skeptic Ace (1274870) | more than 4 years ago | (#33056712)

Your right.

The only hack here is CmdrTaco's account by a one Mrs. kdawson, wanted in a string of internet highway robberies.

Re:Okay, so... (1)

BobMcD (601576) | more than 4 years ago | (#33057316)

This story is about a glorified crawler. No actual hacking transpired. No personal information that wasn't already revealed has been revealed. This is not news.

To quote one of the genius minds of our era, 'no shit, Sherlock'. The cases of 'actual hacking' that transpire on a regular basis can be counted on one hand. Nearly all the major 'hackers' have in their hit lists mundane crap exactly like this. Do you think dumpster diving, social engineering, and using lists of common passwords are somehow any more romantic than scraping public pages?

Grow up. Security is about a lot more than terminals in a green font.

Where's the Pr0n? (5, Insightful)

ArcherB (796902) | more than 4 years ago | (#33056068)

Would someone create a list that only contains public profiles with NSFW images?

Thanx

Re:Where's the Pr0n? (1)

Abstrackt (609015) | more than 4 years ago | (#33056114)

Would someone create a list that only contains public profiles with NSFW images?

Thanx

Sure, but they're all goatse.

Re:Where's the Pr0n? (1)

monkeySauce (562927) | more than 4 years ago | (#33056410)

Sure, I'm working on it right now. The site will be up shortly.

http://wangbook.com/ [wangbook.com]

Enjoy!

How do you "leak" public information? (1, Insightful)

goldspider (445116) | more than 4 years ago | (#33056096)

After my initial outrage spike, I realized that the only reason this guy ended up with this information is because these people INTENTIONALLY POSTED it.

See if anyone you know is on this list and educate them.

Re:How do you "leak" public information? (1)

natehoy (1608657) | more than 4 years ago | (#33056432)

Yup, this is less harmless than scanning the telephone book and making it available via a Torrent.

Anyone who gets the slightest bit upset about this should be hand-delivering Molotov Cocktails to www.anywho.com right now. They disclose your STREET ADDRESS AND PHONE NUMBER.

Well, if you're listed in it, that is. Personally, I'm not. One of the reasons why I dropped my landline ten years ago, actually. I saw that excellent security documentary with Steve Martin about the dangers of being listed in the phone book.

Re:How do you "leak" public information? (3, Funny)

twoshortplanks (124523) | more than 4 years ago | (#33056972)

I saw that excellent security documentary with Steve Martin about the dangers of being listed in the phone book.

That wasn't Steve Martin, that was Arnold Schwarzenegger. If I remember correctly it wasn't just a pain for Linda Hamilton, but her roommate and date had an even worse time of too.

Re:How do you "leak" public information? (1)

natehoy (1608657) | more than 4 years ago | (#33057228)

Oh, yeah, there were two documentaries about that. I'd forgotten. Silly me!

I think it's because neither documentary ever had a sequel.

Blizzard Real ID scandal (0)

Anonymous Coward | more than 4 years ago | (#33056134)

Makes it pretty scary when you read this article in accordance with http://asnowstormbyanyothername.blogspot.com/ (Blizzard Real ID blog) Facebook is an evil big brother watching over the world.

hmph (1)

shentino (1139071) | more than 4 years ago | (#33056152)

Considering that this information was already in the hands of a company whose CEO doesn't give two shits about privacy anyway I say no harm done.

Re:hmph (1)

John Hasler (414242) | more than 4 years ago | (#33056274)

Considering that these pages HAD ALREADY BEEN MADE PUBLIC BY THE USERS anyway I say no harm done.

Fucking moron (-1, Troll)

Anonymous Coward | more than 4 years ago | (#33056230)

He's just trying to get attention/work. And look, he's getting it. The attention anyway. Somebody please DoS this jack off. Or....even better, Maltego style data mine his ass, put up a torrent for all of his information and while were at it lets sign him up with a few thousand spammers....and report all his comments as spam, etc.

BFD... (1, Informative)

Anonymous Coward | more than 4 years ago | (#33056246)

http://youropenbook.org/

Sensational...ism (5, Informative)

RobM9999 (191476) | more than 4 years ago | (#33056250)

Sensationalism - A manner of over-hyping events, being deliberately controversial, loud, self centred or acting to obtain attention. It is also a form of theatre.

Yep, that's pretty much it.

Just because he found the super-secret directory, http://www.facebook.com/directory/ [facebook.com] and wrote a program that would read it. Of all the evil, nefarious things to do.

News flash: 400 million user profile pages leaked! (3, Insightful)

thePowerOfGrayskull (905905) | more than 4 years ago | (#33056298)

News flash: 400 million user profile pages can be found online at facebook.com.

Re:News flash: 400 million user profile pages leak (1, Interesting)

Anonymous Coward | more than 4 years ago | (#33056446)

zomg... somebody also already made a searchable version of the data...

http://www.google.com/search?q=site%3Afacebook.com

This seems more like an awareness campaign (1)

Jetrel (514839) | more than 4 years ago | (#33056308)

Most of the other post talk about how this is not a big deal and in the grand scheme of things it’s not but what he is doing is showing the world how venerable your information is on the web and FB. There are tons of people that really just don’t understand what it means when you post things like your address, email address, phone number, and full name for the world to see. Take this mix it with your likes and updates of your daily activities and you have a damn good profile for someone to steal your identity.

Think about it, there are family tree applications on FB which is a gate way to getting someone’s mother’s maiden name. While I think him posting all this information on the web is callous he certainly is taking steps to show the world exactly how venerable you are when you openly participate in sites like this.

Hopefully.... (2, Insightful)

fuzzyfuzzyfungus (1223518) | more than 4 years ago | (#33056424)

I hope that this will serve as a viable reply to the persistent "but you have no expectations of privacy in public in the real world, why worry online?" crowd.

The real world is(relatively) harmless because(outside of East Germany, and the UK) persistent, comprehensive surveillance is extremely expensive and/or time consuming. Only people with stalkers, secret agents, or private investigators on their tail need worry.

On the internet, which masterfully makes data collection and mining much easier, comprehensive surveillance, and making something of the results, is relatively trivial. Hence the concern.

Re:Hopefully.... (1)

Gordonjcp (186804) | more than 4 years ago | (#33057138)

(outside of East Germany, and the UK) persistent, comprehensive surveillance

Neither of these countries have any more comprehensive, persistent surveillance. Well, the former East Germany did, but it hasn't existed for 18 years. The whole "27 million CCTV cameras in the UK" was from an entirely fictitious article in one of the more rabid right-wing tabloid papers.

Re:Hopefully.... (1)

fuzzyfuzzyfungus (1223518) | more than 4 years ago | (#33057166)

I was (mostly) joking. The licence plate tracking system they have for enforcing congestion charges in London(among other uses) is pretty spiffy...

Is really legal to distribute dumps like this one? (0)

Anonymous Coward | more than 4 years ago | (#33056514)

I use to write scripts like this to fetch and format (mainly in CSV or DICT RFC-2229) information from various online dictionaries and encyclopedias for personal use, and i always thought that it would be illegal to distribute my dumps due to the ToS and commercial licenses of the sites.

For this reason i always distribute only the scripts to let any potential user to fetch the information at his own risk. But this guy is distributing names and other info available in a commercial web site with a restrictive ToS. Is it really legal?

It would be legal to do the same thing with, for example, Encyclopedia Britannica (i mean, dump the entire web into a mySQL database and distribute its contents in a webpage)?

How is this a leak? (3, Interesting)

EmagGeek (574360) | more than 4 years ago | (#33056530)

How is it a leak if all of these pages are available publicly anyway?

Re:How is this a leak? (1)

Mr. Freeman (933986) | more than 4 years ago | (#33057428)

It's not. But this guy can get a lot of attention by claiming that he "exposed some new privacy threat". Privacy settings are all the rage right now and you can get a lot of attention with almost no work if you play your cards right.

Making a script to go search google and pull public profiles then calling it "OMG PRIVACY ISSUES!!" is one such example.

Don't get it (0)

Anonymous Coward | more than 4 years ago | (#33056542)

Clearly not a leak since it's an optional feature (blaming facebook for not informing it enough like always ?). There's also nothing really special about that 'crawler', go grab it yourself http://www.facebook.com/directory/. I imagined real crawler using many available search engines to find your friends.. one step ahead of Facebook.

NOT A LEAK, title is -as usual- stupid (3, Informative)

xmousex (661995) | more than 4 years ago | (#33056606)

A leak is something that happens when previously hidden information is then made publicly available by someone on the inside.

The information here is available to anyone that wants it, someone just spent some time compiling the data, who had no affiliation with facebook.

Phone book (1)

sh3rp (1771896) | more than 4 years ago | (#33056622)

It's called a phonebook. Figure it out.

The ultimate "you must be new here" (1)

Torodung (31985) | more than 4 years ago | (#33056630)

FTFA:

...but perhaps the existence of a stalker's online black book might finally persuade less security-minded Facebook users to get their arses in gear.

A fine sentiment, but you must be new here. As in planet earth. Born yesterday.

Cue "I wanna be famous [youtube.com] ." or even the alternate: NSFW [youtube.com] song (first time I saw that one!).

Think of it this way, Facebook might keep a John Hinkley from ever happening again. Naw, I'd have to have been born yesterday to believe that. ^_^

--
Toro

LOL oF Kill somebody important oF

What about: (4, Interesting)

phyrexianshaw.ca (1265320) | more than 4 years ago | (#33056704)

What about those of us who CHOOSE to make their profile completely public and full of information about themselves?

The reverse-looker factor (2, Informative)

qwerty8ytrewq (1726472) | more than 4 years ago | (#33056802)

the news here perhaps isthat the marketing script-kiddies now have the data in a form they can go to spam-town with. Not really a leak, but an accessible-format conversion. I look forward to the statistics being crunched in amusing ways... % of "female" people who have the words "sex" and "city" and "2" and "terrible" in their data...98%

Wow! I'm somebody now! (1)

Orion Blastar (457579) | more than 4 years ago | (#33056992)

The new Phone Book is here the new Phone Book is here and my name is on it, so I am somebody now! [youtube.com] Er ah Facebook Whitepages I guess? Oh yeah the words are backwards because it is a parallel universe that developed English a bit differently than ours did.

Anyway right now some Sniper is looking in the Facebook Phone Book and finds "Blastar, Orion" and then decides to look me up and get his rifle and start shooting at me. :) LOL

100 Million Sensational Slashdot Headlines! (1)

Domini (103836) | more than 4 years ago | (#33057248)

Yet another blown out of proportion Slashdot headline which panders to the crazies.

Nothing to see here, please move along.

PS: I would be first to condemn Facebook. I don't like their management and lack of customer focus. But this headline is probably the reason I'll delete my Slashdot account just like I've deleted my Facebook account.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?