Facebook Reveals New Data Leak Incident Affecting Groups' Members

Facebook today revealed yet another security incident admitting that roughly 100 app developers may have improperly accessed its users' data in certain Facebook groups, including their names and profile pictures.

In a blog post published Tuesday, Facebook said the app developers that unauthorizedly access this information were primarily social media management and video streaming apps that let group admins manage their groups more effectively and help members share videos to the groups, respectively.

For those unaware, Facebook made some changes to its Group API in April 2018, a month after the revelation of the Cambridge Analytica scandal, limiting apps integrated with a group to only access information, like the group's name, the number of members and the posts' content.

To get access to additional information like names and profile pictures of members in connection with group activities, group members had to opt-in.

However, it seems like Facebook once again failed to protect its users' information despite the company changing its Group API access parameters back in April 2018.

In an ongoing review, Facebook said it found that the developers of some apps retained the ability to access Facebook Group member information from the Groups API for longer than the company intended.

Though Facebook did not disclose the total number of users affected by the leak or if the data also involved other information beyond just names and profile pictures, the company did assure its users that it stopped all unauthorized access to the data and that it found no evidence of abuse.

"Although we've seen no evidence of abuse, we will ask them to delete any member data they may have retained, and we will conduct audits to confirm that it has been deleted," the company said.

Facebook also believes that the number of app developers that actually accessed this data is smaller and decreased over time, as it says that of roughly 100 app developers retaining user data access through Groups API since the last 18 months, "at least 11 partners accessed group members' information in the last 60 days."

In July, Facebook agreed to pay a $5 billion fine as a settlement with the Federal Trade Commission (FTC) over the Cambridge Analytica scam and also accepted a 20-year-long agreement with the FTC that enforces new guidelines for how the social media handles its users' privacy and their data.

"[T]he new framework under our agreement with the FTC means more accountability and transparency into how we build and maintain products," Facebook said.

"As we continue to work through this process, we expect to find more examples of where we can improve, either through our products or changing how data is accessed. We are committed to this work and supporting the people on our platform."

In the recent news surrounding the social media giant, Facebook sued Israeli mobile surveillance firm NSO Group late last month for its involvement in hacking WhatsApp users, including diplomats, government officials, human rights activists, and journalists, using its well-known spyware called Pegasus.

Source : The Hacker News