Facebook fires sueball at 'malicious' app SDK makers, accuses them of gobbling up people's personal information
(2020/08/28)
- Reference: 1598642570
- News link: https://www.theregister.co.uk/2020/08/28/facebook_lawsuits/
- Source link:
Facebook on Thursday said it had filed two separate lawsuits in the US and UK to prevent unsanctioned snarfing of people's personal data and the inflation of likes on posts.
Over in the UK, the ad giant, in conjunction with Facebook Ireland, filed a claim in the London High Court against developer Fatih Haltas and his two marketing operations MobiBurn and Oak Smart Technologies. It's claimed that since April 2018 the British biz used its malicious SDKs to harvest not only data from the social network, but also from other websites where Facebook was used to login.
The legal broadside may evoke a sense of deja vu, given that Facebook [1]took similar action in February against New Jersey-based analytics biz OneAudience for the same sort of SDK shenanigans.
Haltas, Facebook claims, refused to comply with the ad network's audit request. The targeted marketing operation is said to have paid developers to install its SDK in their apps to display advertising and collect information, including details on people's Facebook profile pages.
Jessica Romero, director of platform enforcement and litigation at Facebook, made clear in a [2]statement that the MobiBurn SDK's alleged unauthorized data looting was not the result of any unforeseen technical security failure at Facebook.
Trashing privacy? That's our job! Facebook accuses analytics biz of harvesting people's info from software dev kit sold to app makers [3]READ MORE
"When people installed those apps on their devices, MobiBurn collected information from the devices and requested data from Facebook, including the person’s name, time zone, email address and gender," said Romero. "MobiBurn did not compromise Facebook, instead they used the malicious SDK on the users’ devices to collect information."
What happened, Facebook contends, is apps with the MobiBurn SDK "self-compromised," as described in the High Court filing
The suggestion is that Facebook being compromised and the app "self-compromising" are different things. The situation recalls the 2018 Cambridge Analytica scandal, which likewise was not the result of anyone compromising the social network's security systems.
Meanwhile in US District Court in San Francisco, Facebook and its Instagram arm sued Nikolay Holper, a resident of Minsk, Belarus, for running a service called Nakrutka that provided fake interactions – likes, followers, post views, and comments.
"[Holper] used a network of bots and Instagram accounts that he controlled to deliver millions of automated likes to his customers," the US complaint [5][PDF] says. "Some of the Instagram accounts used by [Holper] were responsible for over 8 million likes over the course of just two days."
In its legal filing, Facebook says that it disabled Holper's Facebook account in January and in February sent him a cease-and-desist letter to which he has not yet responded.
"Today’s actions are the latest in our efforts to protect people who use our services, hold those who abuse our platform accountable, and advance the state of the law around data misuse and privacy," said Romero, perhaps forgetting about Facebook's [6]lobbying against privacy laws .
The US has no formal extradition treaty with Belarus, but Facebook's legal salvo will do... something. ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2020/02/28/facebook_sues_developer/
[2] https://about.fb.com/news/2020/08/taking-legal-action-against-those-who-abuse-our-platform/
[3] https://www.theregister.com/2020/02/28/facebook_sues_developer/
[4] https://regmedia.co.uk/2020/08/28/mobiburn_fb_lawsuit.pdf
[5] https://www.courtlistener.com/recap/gov.uscourts.cand.364987/gov.uscourts.cand.364987.1.0.pdf
[6] https://news.bloomberglaw.com/privacy-and-data-security/facebook-google-donate-heavily-to-privacy-advocacy-groups
[7] https://whitepapers.theregister.com/
Over in the UK, the ad giant, in conjunction with Facebook Ireland, filed a claim in the London High Court against developer Fatih Haltas and his two marketing operations MobiBurn and Oak Smart Technologies. It's claimed that since April 2018 the British biz used its malicious SDKs to harvest not only data from the social network, but also from other websites where Facebook was used to login.
The legal broadside may evoke a sense of deja vu, given that Facebook [1]took similar action in February against New Jersey-based analytics biz OneAudience for the same sort of SDK shenanigans.
Haltas, Facebook claims, refused to comply with the ad network's audit request. The targeted marketing operation is said to have paid developers to install its SDK in their apps to display advertising and collect information, including details on people's Facebook profile pages.
Jessica Romero, director of platform enforcement and litigation at Facebook, made clear in a [2]statement that the MobiBurn SDK's alleged unauthorized data looting was not the result of any unforeseen technical security failure at Facebook.
Trashing privacy? That's our job! Facebook accuses analytics biz of harvesting people's info from software dev kit sold to app makers [3]READ MORE
"When people installed those apps on their devices, MobiBurn collected information from the devices and requested data from Facebook, including the person’s name, time zone, email address and gender," said Romero. "MobiBurn did not compromise Facebook, instead they used the malicious SDK on the users’ devices to collect information."
What happened, Facebook contends, is apps with the MobiBurn SDK "self-compromised," as described in the High Court filing
[4]PDF
: "After a user installed one of these apps on their device and essentially 'self-compromised,' the SDK contained in the app would collect information about the user from their device and their social media accounts where the user logged into the app using those accounts."The suggestion is that Facebook being compromised and the app "self-compromising" are different things. The situation recalls the 2018 Cambridge Analytica scandal, which likewise was not the result of anyone compromising the social network's security systems.
Meanwhile in US District Court in San Francisco, Facebook and its Instagram arm sued Nikolay Holper, a resident of Minsk, Belarus, for running a service called Nakrutka that provided fake interactions – likes, followers, post views, and comments.
"[Holper] used a network of bots and Instagram accounts that he controlled to deliver millions of automated likes to his customers," the US complaint [5][PDF] says. "Some of the Instagram accounts used by [Holper] were responsible for over 8 million likes over the course of just two days."
In its legal filing, Facebook says that it disabled Holper's Facebook account in January and in February sent him a cease-and-desist letter to which he has not yet responded.
"Today’s actions are the latest in our efforts to protect people who use our services, hold those who abuse our platform accountable, and advance the state of the law around data misuse and privacy," said Romero, perhaps forgetting about Facebook's [6]lobbying against privacy laws .
The US has no formal extradition treaty with Belarus, but Facebook's legal salvo will do... something. ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2020/02/28/facebook_sues_developer/
[2] https://about.fb.com/news/2020/08/taking-legal-action-against-those-who-abuse-our-platform/
[3] https://www.theregister.com/2020/02/28/facebook_sues_developer/
[4] https://regmedia.co.uk/2020/08/28/mobiburn_fb_lawsuit.pdf
[5] https://www.courtlistener.com/recap/gov.uscourts.cand.364987/gov.uscourts.cand.364987.1.0.pdf
[6] https://news.bloomberglaw.com/privacy-and-data-security/facebook-google-donate-heavily-to-privacy-advocacy-groups
[7] https://whitepapers.theregister.com/
Maybe I'm getting this wrong ..
Anonymous Coward
.. but isn't the security and access control of Facebook's facilities a Facebook issue rather than that of a third party?
Who are they trying to fool with this deflection, or is it more because the company in question found a way to use the data without paying Facebook?
Oh look, there it is again:
Hubert Cumberdale
the [1]Facebook logo reflected the wrong way in someone's eye trope . C'mon Reg, [2]what's with that ?
[1] https://duckduckgo.com/?q=facebook+reflected+in+eye&kp=1&t=ffab&atb=v1-1&iax=images&ia=images
[2] https://regmedia.co.uk/2018/10/31/shutterstock_facebook_panic.jpg?x=648&y=324&crop=1
Goodness me
logicalextreme
Not the inflation of likes on posts ?! This world is truly beyond redemption.
Pot meet Kettle
JassMan
Thank god I don't use Facebook or even have an account just for signing in to other websites.
Otter: He can't do that to our pledges.
Boon: Only we can do that to our pledges.