A Facebook security hole allowed advertisers and other third parties to access user accounts and personal data, according to a blog post today from internet security firm Symantec. They identify the exposure as having been active for as long as Facebook has offered applications on its platform, beginning in 2007— so, four years.
That unintended access included "profiles, photographs, chat, and the ability to post messages and mine personal information," wrote Symantec's Nishant Doshi, who is credited with finding the issue along with colleague Candid Wueest. "Fortunately, these third-parties may not have realized their ability to access this information."
Facebook today said the problem has been fixed, and there is no evidence that any actual private data was leaked. More from the Symantec post:
Symantec has discovered that in certain cases, Facebook IFRAME applications inadvertently leaked access tokens to third parties like advertisers or analytic platforms. We estimate that as of April 2011, close to 100,000 applications were enabling this leakage. We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties.
Access tokens are like 'spare keys' granted by you to the Facebook application. Applications can use these tokens or keys to perform certain actions on behalf of the user or to access the user's profile. Each token or 'spare key' is associated with a select set of permissions, like reading your wall, accessing your friend's profile, posting to your wall, etc.
More: Here is the Wall Street Journal story, and CNET has a related report here.
