Third-party Facebook apps expose 540 million users’ details

A year after the Cambridge Analytica data sharing scandal, researchers have discovered publicly exposed data stores belonging to two more third-party developed Facebook apps.

The cyber risk team at security firm UpGuard found one data store originating from the Mexico-based media company Cultura Colectiva of 146GB, containing more than 540 million records, detailing comments, likes, reactions, account names, Facebook IDs and more.

A separate backup from a Facebook-integrated app called “At the Pool” was also found exposed to the public internet via an Amazon S3 bucket, containing columns for Facebook user IDs, friends, likes, music, passwords and more for 22,000 users.

However, the discovering team said the passwords are presumably for the “At the Pool” app rather than for the user’s Facebook account, but said the passwords were stored in plain text, which would put users at risk who had reused the same password across accounts.

The UpGuard team also notes that the app appears to have ceased operation in 2014, adding that this offers little consolation to the app’s users whose names, passwords, email addresses, Facebook IDs, and other details were openly exposed for an unknown period of time. 

Despite Facebook making some effort to reduce third party access to users’ data in the wake of the Cambridge Analytica scandal, its discoveries show that the “data genie cannot be put back in the bottle” and that data about Facebook users has been spread far beyond the bounds of what Facebook can control today.

“Combine that plenitude of personal data with storage technologies that are often misconfigured for public access, and the result is a long tail of data about Facebook users that continues to leak,” they said in a blog post.

The “At the Pool” data was taken offline while UpGuard was still investigating its likely origins. The investigators do not know whether that was  a coincidence, if there was a hosting period lapse, or if a responsible party became aware of the exposure at that time.

On the other hand, UpGuard said the Cultura Colectiva data was secured only on 3 April 2019 after Facebook was contacted by Bloomberg for comment, despite notifying the company on 10 January and following up four days later. UpGuard also notified Amazon Web Services on 29 January, who contacted Culture Colectiva.

The discoveries highlight the “inherent problem of mass information collection”, which is that it does not naturally go away, and a derelict storage location may or may not be given the attention it requires, the UpGuard team said.

For app developers on Facebook, they said, part of the platform’s appeal is access to some slice of the data generated by and about Facebook users.

For Cultura Colectiva, data on responses to each post allows them to tune an algorithm for predicting which future content will generate the most traffic.

“The data exposed in each of these sets would not exist without Facebook, yet these data sets are no longer under Facebook’s control,” the UpGuard team said.

“In each case, the Facebook platform facilitated the collection of data about individuals and its transfer to third parties, who became responsible for its security. The surface area for protecting the data of Facebook users is thus vast and heterogenous, and the responsibility for securing it lies with millions of app developers who have built on its platform.”