Facebook now Meta has announced plans to expand its bug bounty program to start rewarding valid reports of scraping vulnerabilities across its platforms as well as include reports of scraping data sets that are available online.
“We know that automated activity designed to scrape people’s public and private data targets every website or service,” said Dan Gurfinkel, security engineering manager at Meta. “We also know that it is a highly adversarial space where scrapers — be it malicious apps, websites or scripts — constantly adapt their tactics to evade detection in response to the defenses we build and improve.”
The social media giants have therefore set out to monetarily compensate for valid reports of scraping bugs in its services and identify unprotected or openly public databases containing no less than 100,000 unique Facebook user records. The only caveat is that the reported data set must be unique and not previously known.
Should the requisite criteria be met, the company said it will take appropriate measures, including legal actions, to remove the data from the non-Meta website. This could also involve reaching out to hosting providers like Amazon, Box, and Dropbox to pull the data set offline, or working with third-party app developers to address server misconfigurations. Reports concerning scraped databases will be rewarded through matched charity donations of the researchers’ choosing.
Meta aims to identify and counter scenarios that makes scraping less costly for malicious actors to execute also with the aim of encouraging research into logic bypass issues that can allow access to information via unintended mechanisms, even if proper rate limits exist.
This focus on curbing unauthorized scraping comes as part of the company’s effort to limit abuse of people’s data on its platform in the wake of the infamous Cambridge Analytica data scandal that resulted in personal information belonging to millions of Facebook users harvested without their consent for political advertising.
Another happening which took place in earlier April wherein the phone numbers of 533 million Facebook users were shared on a cybercrime forum for free, data that was collected by scraping the platform. Meta has also in October 2021 filed a lawsuit against a Ukrainian national named Alexander Alexandrovich Solonchenko for allegedly scraping and selling the personal data of more than 178 million Facebook users on an underground forum.
Over $14 million in bounties has been paid since the beginning of the program in 2011, with $2.3 million awarded to researchers from more than 46 countries this year alone.