Thursday, April 18, 2024

16 Malicious Facebook apps that Share User Data with third-parties for Ransomware Attacks and Targeted Advertising

Third-party apps on social media continue to misuse the data shared by users, researchers from the University of Iowa proposed a paper dubbed CanaryTrap details Data Misuse by Third-Party Apps on Online Social Networks.

CanaryTrap aimed to misuse of data shared with third-party apps on Facebook, researchers used unique “honeytoken” emails and uses Facebook’s ad transparency tool ‘Why Am I Seeing This?’ to detect any unrecognized use of the shared honeytoken.

Third-party apps with access to a large number of information such as the user’s email address, date of birth, gender, and likes have a high potential for data misuse.


The misuse of data is something hard to detect and not possible to track also, as it is completely out of control.

With paper CanaryTrap researchers “uses honeytokens to monitor misuse of data shared with third-party apps on online social networks.”

Honeytokens or nothing like honeypots that intentionally leaked to find it’s unauthorized usage. Researchers implement CanaryTrap to investigate misuse of data shared with third-party apps on Facebook.

The above image illustrates how the third-party app may engage in data misuse, third-party app developers use developer APIs to retrieve the user data and store in their servers.

Those stolen data are used later by third-parties to implement their functionality and to use the data outside the scope of the third-party app.

“CanaryTrap relies on sharing a honeytoken in the data associated with an account that can be used as a bait to trigger misuse.”

The image below illustrates how a honeytoken email address to a Facebook account and then shared it with a third-party app. Then monitoring the honeytoken through two channels.

Researchers registered account with Facebook and then installed a Facebook app, waited for 15 minutes, and then uninstalled the app from the account.

Then researchers monitor the unique email address created, if it receives email then it’s clear that app shared data with third-party.

Researchers tested 1,024 such apps, out of the 16 apps found sharing data with third-party in that 9 apps only disclosed that they relate with email senders.

We presented CanaryTrap to help independent watchdogs detect misuse of data shared with third-party apps without needing cooperation from online social networks, researchers concluded.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Most Important Security Tips to Protect Your Internet Privacy and Stay Away from Hackers

The Most Important Role of Penetration Testing in Data Privacy and Protection


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles