Peekaboo! Facebook fills photo security hole

Facebook has filled a hole that allowed strangers to view members' photos through the mobile version of the site, a spokesman said Tuesday after being alerted to the problem by CNET News Monday night.

"Today, we learned that certain photos could be viewed by unauthorized users who employed a complicated hack," a spokesman wrote in an e-mail. "Once we were notified of the issue, it was resolved within hours. These photos are no longer available to unauthorized users. We encourage security researchers examining Facebook to practice responsible disclosure."

Basically, someone who knew the serial number of a Facebook user, which is easy to get, and knew a trick for rejiggering the URL, could see private photos of that user. Small photos could also be changed to display in a larger size. The vulnerability only could be exploited with Firefox browsers.

"This week's hole is as good as the March 2008 thing, but easier to do," said Byron Ng, a Vancouver, Canada-based computer technician who notified CNET News of the problem. "And it allows you to target anyone."

CNET News verified the hole before it was fixed and was able to see a private photo of Facebook Founder Mark Zuckerberg, among others.

Facebook had a similar problem with photos being exposed to strangers in March, and has suspended third-party apps that violated the privacy of users who downloaded them. To minimize the risk, the company will soon be launching a program to verify the security of the outside apps.

[thabassman]

yay.

[Harrison912]

I'm glad FaceBook was able to get it fixed. Since I have a web site dedicated to safety and security products, I'm always pleased to hear that security breaches have been repaired.

[khaye0623]

cool

[Girbaudz]

this is my experience, unauthorized photos that i can't delete, came into my facebook album with these code:

href="http://www.facebook.com/photo.php?pid=798692&amp;op=1&amp;o=global&amp;view=global&amp;subj=100000369210946&amp;id=1193979963" class="UIPhotoGrid_PhotoLink clearfix"><img src="http://photos-e.ak.fbcdn.net/hphotos-ak-snc1/hs278.snc1/10525_1265035264689_1193979963_798692_3285736_s.jpg" alt="" class="UIPhotoGrid_Image" onload="this.fb_loaded = true;" title="Let&#039;s Enjoy this game and be one of us. http://fordoloop.com/" /></a></td><td class="UIPhotoGrid_TableCell"><a href="http://www.facebook.com/photo.php?pid=798693&amp;op=1&amp;o=global&amp;view=global&amp;subj=100000369210946&amp;id=1193979963" class="UIPhotoGrid_PhotoLink clearfix"><img src="http://photos-f.ak.fbcdn.net/hphotos-ak-snc1/hs278.snc1/10525_1265035704700_1193979963_798693_575171_s.jpg" alt="" class="UIPhotoGrid_Image" onload="this.fb_loaded = true;" title="Let&#039;s Enjoy this game and be one of us. http://fordoloop.com/" /></a></td></tr></table></div></div></div><div class="has_extra has_extra_1"><div class="photos_tab_header clearfix"><div class="photos_header_breadcrumbs_and_caption"><h3 class="photos_header_breadcrumbs">Girbaudz's Albums</h3><span class="caption">1 Photo Album</span></div><div class="photos_header_actions_and_pager clearfix"><div class="photos_header_actions"><a href="/photo_comments.php?id=100000369210946">View Comments</a><span class="pipe">|</span><a href="/privacy/?view=photos">Album Privacy</a></div><div id="photos_by_wrapper_pager"

[Girbaudz]

please help me delete these photos thank you!