Facebook APIs used by tens of thousands of malicious apps

Facebook fired employee for privileged data abuse

It was also reported this week that Facebook fired an employee in the security group for misusing privileged data access. Facebook fired a security engineer who allegedly took advantage of his position to access information he then used to stalk women online, the social media giant confirmed to NBC News Tuesday.

On Sunday, Jackie Stokes, founder of Spyglass Security, tweeted about the Facebook employee in question, noting that she was able to confirm his employment through his social media profiles.

I've been made aware that a security engineer currently employed at Facebook is likely using privileged access to stalk women online.

I have Tinder logs. What should I do with this information?

— Jackie Stokes (@find_evil) April 30, 2018

NBC News first reported on this on Tuesday and spoke to Facebook's CSO Alex Stamos, who said it was being investigated "as a matter of urgency."

Facebook later confirmed that the employee in question, who referred to himself as a "professional stalker" to Stokes, was fired.

Since then, Motherboard has reported that sources say multiple Facebook employees have been fired over the course of time for abusing their privileged access to user data, including stalking exes.

"It's important that people's information is kept secure and private when they use Facebook," Stamos told NBC News. "It's why we have strict policy controls and technical restrictions so employees only access the data they need to do their jobs -- for example to fix bugs, manage customer support issues or respond to valid legal requests. Employees who abuse these controls will be fired."

In other news

• AWS threatened to suspend Signal's account if the company continues to use domain fronting. AWS wrote to the creator of the messaging app, Moxie Marlinspike, and said that domain fronting is a violation of its terms of service. Domain fronting is a technique used to protect messages sent over Signal from being tracked or censored in countries where Signal is banned. Its aim is to hide the real location of the endpoint of a connection. Marlinspike, who posted the letter sent to him from Amazon, was told not to use the Souq.com domain as part of Signal's domain fronting. "You do not have permission from Amazon to use Souq.com for any purpose. Any use of Souq.com or any other domain to masquerade as another entity without express permission of the domain owner is in clear violation of the AWS Service Terms," the letter read. "We will immediately suspend your use of CloudFront if you use third-party domains without their permission to masquerade as that third party." Google similarly banned Signal after it used domain fronting, though the moves from Google and Amazon have come under criticism from digital rights activists.
• Medical devices made by Becton, Dickinson and Company (BD), the medical technology company headquartered in Franklin Lakes, N.J., could potentially expose patient records through the Key Reinstallation Attack (KRACK) vulnerability. KRACK, which was originally discovered in October 2017, is a flaw in the Wi-Fi Protected Access 2 (WPA2) protocol that affects Wi-Fi devices. In its security bulletin, BD said it is "monitoring the developing situation with a recently disclosed set of vulnerabilities found in the WPA2 protocol affecting confidentiality, integrity, and availability of communication between a Wi-Fi access point and a Wi-Fi enabled client such as a computer, phone, Wi-Fi base stations, and other gear, even if the data is encrypted. This is NOT a BD-specific vulnerability, but could affect any Wi-Fi devices that use the WPA2 protocol." BD products, including its medical supply and management systems -- such as BD Alaris Gateway Workstation, Pyxis Anesthesia ES and several others -- are all affected by the KRACK vulnerability. BD released fixes and third-party vendor mitigations in response.
• Microsoft has patched a critical flaw in the Windows Host Compute Service Shim library (hcsshim). The open source container library was introduced in early 2017, and the Shim version is used in the Docker Engine project. The vulnerability enables remote code execution and, according to the Microsoft security update, occurs when hcsshim "fails to properly validate input while importing a container image. To exploit the vulnerability, an attacker would place malicious code in a specially crafted container image which, if an authenticated administrator imported (pulled), could cause a container management service utilizing the Host Compute Service Shim library to execute malicious code on the Windows host." Microsoft released the patch this week and Michael Hanselmann, the security researcher based in Switzerland who discovered the flaw, will release the technical details in a proof of concept later this month.