CERT-In Advisory
CIAD-2019-0036
Malicious third-party SDKs leaked personal data from Facebook and Twitter users
Original Issue Date: November 27, 2019
Severity Rating: High
Overview
It has been reported that personal data of Facebook and Twitter users were improperly accessed by a pair of malicious SDKs used in certain third-party apps.
Description
FThe software development kit (SDK) are software, that are embedded into third-party applications, allow users to sign in using their
social network credentials and help app programmers to monetize their products through targeted advertising.
It is reported that Facebook and Twitter notified some companies about malicious SDKs that allowed certain third-party apps to collect
users¿ data from their apps without their permission.
It is learnt that these apps violated Facebook's Platform Policy by installing software in their apps that caused user's Facebook
information to be sent to two companies viz., OneAudience and Mobiburn.
The information sent to these companies is dependent on what a user may have shared with the app developer, to access their profile
information, such as name, email, gender, language, time zone, Facebook user ID, profile URL etc.
It is learnt that Facebook plans to notify people whose information they believe was likely shared in violation of their policy.
Twitter revealed that an SDK developed by OneAudience contains a privacy-violating component which may have passed some of its users'
personal information (email, username, last Tweet) to the OneAudience servers. Twitter does not have evidence to suggest that this was
used to take control of a Twitter account, but it is possible that an attacker could use the SDK to do it.
Recommendations
- Exercise caution before giving access of social media accounts to any third-party app. Check the App permissions of a third-party
application before using it.
- Remove any third-party applications from your account that you don't recognize or use anymore and regularly review authorized apps.
- Users may receive spam and phishing emails as a result of this incident and they need to stay alert against these kinds of mails.
- Do not open attachments and never click on a URL contained in an unsolicited e-mail, even if the link seems benign.
References
Twitter
https://help.twitter.com/en/sdk-issue
https://help.twitter.com/en/managing-your-account/connect-or-revoke-access-to-third-party-apps
The Register
https://www.theregister.co.uk/2019/11/26/facebook_twitter_data_loss/
CNBC
https://www.cnbc.com/2019/11/25/facebook-and-twitter-says-users-gave-improper-access-to-personal-data.html
Security Affairs
https://securityaffairs.co/wordpress/94401/social-networks/facebook-twitter-warn-rogue-sdk.html
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|