<http://schema.org/articleBody>
"News has\u00A0recently\u00A0surfaced\u00A0over an Android and\u00A0iOS\u00A0security hole, but that story has been mixed up as to where the vulnerability exists. Siting problems with Facebook's mobile apps,\u00A0a\u00A0developer\u00A0recently found that Facebook had effectively left a door open to your private data. In other words,\u00A0iOS\u00A0and Android have nothing to do with it.\r\n\r\n*Update: We received an word from Facebook on the issue, which we've inserted below:\r\nFacebook's\u00A0iOS and Android applications are only intended for use with the manufacture provided operating system, and access tokens are only vulnerable if they have modified their mobile OS (i.e. jailbroken iOS or\u00A0modded\u00A0Android) or have granted\u00A0 a malicious actor access to the physical device. We develop and test our application on\u00A0an unmodified version of mobile operating systems and rely on the native protections as a foundation for development, deployment and security, all of which is compromised on a jailbroken device. As Apple\u00A0states, &amp;quot;unauthorized modification of iOS could allow hackers to steal personal information ... or introduce malware or viruses.&amp;quot; To protect themselves we recommend all users abstain from modifying their mobile OS to prevent any application instability or security issues.\r\nIn other words, this vulnerability only applies to jailbroken and modded devices, OR any regular device if someone has physical access to your phone OR connects it to a public terminal with malicious software installed.\r\n\r\nAccording to\u00A0Gareth Wright, who was looking into what Facebook's app stored, opening the\u00A0Facebook application directory and led him to discover a &amp;quot;whole bunch of cached images and the com.Facebook.plist.&amp;quot; There Wright found a &amp;quot;full\u00A0oAuth\u00A0key and secret in plain text.&amp;quot;\r\n\r\nThis information, when copied over to another device, allows direct access to the compromised Facebook account. So, after testing this out multiple times, Wright contacted Facebook and proceeded to create a few proofs of concept. At this point, while the vulnerability is still being resolved, Wright was able to grab\u00A0plists\u00A0directly from any device plugged into a computer with a bit of software.\r\n\r\n\r\n\r\nThis means shared and public computers are where the real threat exists, because the security hole can be tapped anytime a device is plugged in, gathered and used maliciously.\r\n\r\nFrom\u00A0Wright's blog:\r\nFacebook are aware and working on closing the\u00A0hole, but unless app developers follow suit and start encrypting the 60 day access token Facebook supplies, it\u2019s only a matter of time before someone starts using the info for ill purpose\u2026if they aren\u2019t already.\r\n\r\nUntil Facebook plug the hole, I\u2019ll be thinking twice about plugging my devices into a shared PC, public music docks or \u201Ccharging stations\u201D.\r\nLuckily, we have yet to hear of any such attempts, but it's a good thing that Wright opted to report the issue directly to Facebook instead of abusing it. Still, these issues deserve attention, giving credit to the &amp;quot;white hat&amp;quot; developer while calling Facebook out on their missteps.\r\n\r\n"^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/socialmedia/2012/04/05/security-hole-found-in-facebook-apps-for-ios-android-profile-data-at-risk/?awesm=tnw.to_1DwS5&+Android%2C+profile+data+at+risk>