Profiles of 100 millions Facebook's users released on torrent

[Renk]

A hacker named Ron Bowes has created a web crawler program that very legally harvested public data on users contained in Facebook's open access directory, which lists all users who haven't bothered to change their privacy settings to make their pages unavailable to search engines.

Bowes' directory now contains 171 million entries, relating to more than 100 million individual users - more than 20% of Facebook's recently trumpeted half billion user base.

This directory (2.8 GB) has now been released on bittorent. Although this directory does not contain very big amount of data of each user (28 Bytes in mean), it contains URL for each user's profile page so that many others personnal details can be accessed. Moreover, accessing a user's page from the list will also enable to click through to friends' profiles - even if those friends have made themselves non-searchable.

*torrent link removed!*


This has to correlate with a study Sophos repported in december 2009:

46% of users happy to reveal all to complete strangers

IT security and data protection firm Sophos has today released the results of its latest probe into how easy it is to steal identities via Facebook.

Sophos created two fictitious users with names based on anagrams of the words "false identity" and "stolen identity". 21-year-old "Daisy Felettin" was represented by a picture of a toy rubber duck bought at a $2 shop; 56-year-old "Dinette Stonily" posted a profile picture of two cats lying on a rug. Each sent out 100 friend requests to randomly-chosen Facebook users in their age-group.

Within two weeks, a total of 95 strangers chose to become friends with Daisy or Dinette - an even higher response rate then when Sophos first performed the experiment two years ago with a plastic frog. Worse still, in the latest study, eight Facebookers befriended Dinette without even being asked.

"We assumed things would be better in 2009 but the situation is worse. This really is a wake-up call," said Paul Ducklin, Head of Technology, Asia Pacific at Sophos in Sydney who conducted the study. "Our honeymoon period with social networking sites ought to be over by now - but many users still have a 'couldn't care less' attitude to their personal data."

89% of the 20-somethings and 57% of the 50-somethings who befriended Daisy and Dinette also gave away their full-date-of-birth. Nearly all the others suppressed their year of birth, but this is often easy to calculate or to guess from other information given out. Even worse, just under half of the 20-ish crowd, and just under a third of the 50-ish crowd, gave away personal information about their friends and family.

"People aren't just handing over their own life story to criminals," warned Ducklin. "They're betraying people close to them, too, by helping those cybercrooks build up a detailed picture of their life and their milieu. This is an identity scammer's dream."

Facebook users at risk of "rubber duck" identity attack

[Instab]

sad but not a surprise

[Resurrection]

Its just a list of names isnt it???


What's to worry???

[Instab]

Its just a list of names isnt it???


What's to worry???

have't seen it but if it's the whole profile it's much more than just names

[Resurrection]

Like I said,its just a collection of publicly avaialble names of that site...

I just checked the info...

The hacker used a crawler to pull everything from Facebook's open access directory...

If you search a name,you'd get the same info that you'd get from searching that name in facebook...No private info...

[Renk]

Like I said,its just a collection of publicly avaialble names of that site...

I just checked the info...

The hacker used a crawler to pull everything from Facebook's open access directory...

If you search a name,you'd get the same info that you'd get from searching that name in facebook...No private info...

No private info for sure, and for this reason the process is not illegal.

But now the infos linked to these name could be far more easily known, registered, compiled, organized in data base, allowing rapid multicriteria search on individuals based on elements belonging to their personnal lifes. What did the hacker, is to show as legal and simple it was to built (and maybe sell) a collection of orgnized data about milllions of indiividual, without their explicit consent and without infringening any laws.

[naughtydog]

i think people are paranoid when it comes to security of personal details on facebook. being on there in the first place puts you "at risk" so why be there and complain later? -rhetorical...

[yoco]

And they say I should join FB! Give me a break!

[Renk]

<facebook>[/I]) in the first place puts you "at risk" so why be there and complain later? -rhetorical...

This is precisely the problem: Because the vast majority is not aware of the risks in terms of permanent disclosure to potentially anybody of their personal (homely, etc) data.

[anon]

Facebook has profile paranoia settings somewhere, and those let you create a public profile or not, control what non "friends" can see, etc.

People should use that more often instead of relying on the defaults.

[slikrapid]

well, wasn't facebook explicitly demanding genuine personal info when registering an account? that's the first step towards the intrusion of privacy and many 'obeyed' (even if it can be circumvented) partly for trusting the company, partly in fear of losing the account and whatnot

imo this privacy issue is somewhat misguiding, on one side you have companies/corporations (facebook, paypal) that demand your data in order to verify your identity and later possibly exploit it, companies that collect it in disguise for legal & other attacks (riaa & co., scam sites, criminals and/or organized crime), companies that want to know everything about you in order to sell you some product or advertise it (their terms of agreement getting your consent), governments wanting to impose restrictions & monitoring of user activity with easy access to user identities (justifying it with fighting cybercrime, yet they fail at domestic ones even with years of previous experience) and on the other side if one wants to use social networks or simply communicate over the internet, a certain amount of private information has to be involved if this communication is to be maintained in a trustworthy/honest way and it seems that a certain level of 'self-disclosure' is an inherent human characteristic too

so this issue gets officially underrepresented (or misrepresented) when its discussed from a governmental or corporate point of view (or point of interest) and overemphasized when dealing with inherent human tendencies and possibly (intentionally) overlooked when dealing with the (in)security of transactions for example

what would roughly be desirable is:

- to limit the first level of info access and sharing (companies/governments) as it is not generally needed (it stops at ISP level and is strictly forbidden to pass around for whatever reasons), only in special cases, which would require adequate (transparent) legal steps before put in motion
- to keep the majority of internet communication anonymous per default (very short term ip logs mandatory) and make corporate data collecting thats focused on getting personal identity info a criminal activity
- any special situation cases need to be transparent (like official representatives, investigations,...)
- to educate on the importance of privacy in general (not only on the internet), like fi. consumer & civil rights that afaik aren't being taught in public schools (similarly to the lack of legal education, yet one is expected to obey it!)

seems like the lack of certain educational topics is an intentional way of keeping people in ignorance (or fear or obedience), which makes it easier for the various companies to exploit them - this issue grows even larger considering how governments constantly play into corporate interests (its yet another big business) and so on

[Owyn]

intrusion of privacy

these "Profiles" just a bunch of data already available to everyone, it's like saying "omg google stole the internet and now has it!!!"

educate on the importance of privacy

some people just don't understand what privacy is and then they write and read such articles

[Sazzy]

OH NO, someone put a lot of information into a file that was already knowingly published on the internet! The horror.

[desodorante]

OH NO, someone put a lot of information into a file that was already knowingly published on the internet! The horror.

LOL!

these "Profiles" just a bunch of data already available to everyone, it's like saying "omg google stole the internet and now has it!!!"


some people just don't understand what privacy is and then they write and read such articles

LOL!

I remember back when Fotolog was the hip "social" page. It totally lacked privacy settings, and the whole purpose was to be an attention whore. I do not remember anyone whining like they do with facebook.
It is simple, the information is yours, there is no safer place to save it than your mind . If you choose to put it somewhere else, be aware that it will not be as safe as it is there. It is a choice.
On the other side we know Facebook does not care about any of their users and their privacy, because it is a business, they want money, not friends. But given that almost everyone knows and fully understands that, I repeat, it is your choice to use or not.
I have a Marketing Degree people, and I can tell you this: businesses exist to essentially make money; no consumers=no money=no business.
Forget about the whole "I am a victim of advertising/trends/materialism propaganda", the system may be cruel, unfair and decadent, but this is something you still own: you decide whether to buy something or not!

[naughtydog]

Look at that....