Social-networking sites MySpace and Facebook have apparently fixed coding errors that could have allowed an attacker access to all of their users' data and photos.
The simple coding errors are alarming considering the extent t o which social networks have gone to reassure their users that their data will be safe. The problem involved the way those sites handle requests for data from other domains, known as the "cross-domain policy."
Facebook disallowed access from other applications on its main domain, but a developer in the Netherlands, Yvo Schaap, found that Facebook would allow data to be given out from one of its subdomains.
He also found the problem on MySpace, which allowed a domain called "farm.sproutbuilder.com" to access data. A Flash application could be uploaded to that site, which would then be allowed access to the data if a victim visited a malicious URL.
A look at Facebook's latest crossdomain.xml file shows that the bug appears to have been fixed. MySpace also appears to have taken "farm.sproutbuilder.com" out of its cross-domain list.
mekai kiyanne.. Facebook ekei and Myspace ekei Coding wala problems wagayak ahu wela... Man hithanne Barn buddy eketh probs athi neda.. Parissamin friends....
source:http://tech.yahoo.com/news/pcworld/...eloperfindsmajorcodingerrorsinfacebookmyspace
The simple coding errors are alarming considering the extent t o which social networks have gone to reassure their users that their data will be safe. The problem involved the way those sites handle requests for data from other domains, known as the "cross-domain policy."
Facebook disallowed access from other applications on its main domain, but a developer in the Netherlands, Yvo Schaap, found that Facebook would allow data to be given out from one of its subdomains.
He also found the problem on MySpace, which allowed a domain called "farm.sproutbuilder.com" to access data. A Flash application could be uploaded to that site, which would then be allowed access to the data if a victim visited a malicious URL.
A look at Facebook's latest crossdomain.xml file shows that the bug appears to have been fixed. MySpace also appears to have taken "farm.sproutbuilder.com" out of its cross-domain list.
mekai kiyanne.. Facebook ekei and Myspace ekei Coding wala problems wagayak ahu wela... Man hithanne Barn buddy eketh probs athi neda.. Parissamin friends....
source:http://tech.yahoo.com/news/pcworld/...eloperfindsmajorcodingerrorsinfacebookmyspace
