Facebook fixes bug that leaked phone numbers

Social networking giant Facebook has fixed a bug that potentially could leak phone numbers of users to application developers, a security vendor said over the weekend.

 

In a blog post, Sophos said the bug in the API (application programming interface) was reported as early as June 2012, and affected the email field in some mobile apps.

 

"Facebook said that when retrieving a user's email address via graph API, app developers were receiving a 10-digit number once for every 1,000 users, more or less, instead of the properly formatted email address the documentation states that the field should return," it said.

 

But Sophos quoted Facebook's Alvin Sng as saying the problem "should now be resolved."

 

"This should now be resolved. Thanks for your patience. The email field will now return 'null' if the user does not have an email address," Sng said.

 

Sophos noted developers had reported high incidences of the bug, including Nathan Cobb, a research investigator with the American Legacy Foundation.

 

It cited a Networkworld report saying the group's smoking cessation app, Ubiquitous, "was returning phone numbers for about one in every 200 users.

 

"Facebook took nine months to fix the API glitch so that it's no longer handing over users' phone numbers on a silver platter," Sophos noted. — TJD, GMA News