Latest Facebook bug exposed up to 6.8 million users’ private photos

By Arif Bacchus Published December 14, 2018

Image used with permission by copyright holder

With the latest Facebook API bug, up to 6.8 million consumers on the social network had their private photos inappropriately exposed to third-party apps. Though the issue has since been fixed, some of the apps had access to photos for the 12 days between September 13 and September 25.

Users impacted had already authorized and granted special permissions to these apps to access content from their Timeline, but the bug led developers to access photos that were uploaded but never yet posted on the Marketplace or Facebook Stories. Though Facebook isn’t specifically giving names, it says up to 1,500 apps from 876 developers were affected. Facebook also notes it had approved photos API access for these apps, issuing an apology promising more change.

Mockup of the alert (Image via Facebook) Image used with permission by copyright holder

“We’re sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug. We will be working with those developers to delete the photos from impacted users,” said Tomer Bar, engineering director at Facebook.

Recommended Videos

Facebook will be alerting impacted consumers with a notification, which will then direct them to the Help Center where they can see if they’ve used any apps that were impacted by the bug. It also is recommended for consumers to individually log into apps to check and see if they’ve wrongfully obtained any photos permissions. A sample notification and interface of what consumers will end up seeing can be seen to the left.

Please enable Javascript to view this content

It is not clear when Facebook first was made aware of this API bug. TechCrunch reports that Facebook discovered and fixed it on September 25, but took its time to investigate so it can warn impacted users. That report also makes it clear that photos shared through Facebook Messenger were not impacted.

This would not the first Facebook-related problem in recent months. Back in November, hackers were attempting to sell 120 million private Facebook messages, though that was related to third-party extensions. Before that, up to 50 million accounts were also compromised due to a flaw in access tokens and the “View As” feature. The social media website also apparently knew about Russia data harvesting on its platform since 2014, according to seized documents.

Topics

Former Digital Trends Contributor

Arif Bacchus is a native New Yorker and a fan of all things technology. Arif works as a freelance writer at Digital Trends…

Computing

Here’s why some PC gamers shouldn’t install the latest Windows 11 update

Overwatch 2 running on the LG OLED 27 gaming monitor.

The latest Windows 11 update, codenamed 24H2, has been a troubled rollout for Microsoft, but one thing's been clear from the beginning: PC gamers should wait to install it. Let's add another issue to the list, shall we?

As spotted by Windows Latest, Microsoft has confirmed in an update to its Windows 11 24H2 problems page, that Windows 11 24H2 is causing issues with its Auto HDR feature. The result of the bug is that incorrect colors are being displayed or, even worse, are breaking games entirely and causing them to not be responsive.

Computing

Someone just got the Intel B570 GPU a month in advance — and it works

ASRock's Arc B570 Challenger GPU.

Although Intel's Arc B580 is already here, the B570 is only set to launch on January 16. However, a German retailer listed the card well ahead of time and, surprisingly, one B570 actually shipped to a customer. The B580 is one of the best graphics cards for budget-conscious gamers, but how will the B570 compare?

Early listings and preorders happen shockingly often. For example, yesterday we found an RTX 5090 PC priced at well over $6,000. However, those listings often don't amount to much, and the items don't ship until their designated release dates -- but not this time.

Computing

We might get a new Steam Deck next month — and Valve isn’t making it

The Steam Deck OLED on a pink background.

I expected to see some new handheld gaming PCs this year at CES, but it looks like something even more exciting is in store. AMD and Lenovo are hosting an event during the week of the show, and it'll have two special guests in attendance: Valve's Pierre-Loup Griffais and Microsoft's Jason Ronald.

I'll be attending the event on January 7, about which Sean Hollister over at The Verge initially shared out the details. There are a couple of reasons why this event could be significant. First, Valve. Since the launch of the Asus ROG Ally, there have been a handful of these types of events featuring spokespeople from AMD, Microsoft, and the company making a handheld -- Lenovo or Asus. Valve hasn't ever been in attendance, and considering Valve makes the Linux-based Steam Deck, it would be odd for the company to have a presence.