Aberystwyth student discovers Facebook privacy flaw

Aberystwyth University student Jack Jenkin's discovery was reported by national and international press

Aberystwyth University student Jack Jenkins’ discovery was reported by national and international press

AN ABERYSTWYTH University student is responsible for discovering a flaw on a Facebook application which meant that any user could see private messages sent via the application. The application, Stories: New Year’s Midnight Delivery, was designed to allow users to write messages to be sent at midnight on New Year’s Eve.

Jack Jenkins, a final year Business and IT student, spoke to Aberystwyth Student Media about the flaw. He explained “I discovered it after sending a message through the service. When I saw their confirmation and my message confirmation ID, I was curious as it looks like the ID was a running number of all messages sent, and in a more amateur operation I thought maybe it would take me to other people’s sent messages. To my surprise, that’s exactly what happened.”

Jenkins posted screenshots of the steps he used which led to his discovery

Jenkins posted screenshots of the steps he used which led to his discovery on his blog, which has since had 12,000 views.

Posting on his personal blog at 2.30am on December 31st, Jenkins explained how he had discovered he could view, edit and delete other people’s messages, some of which contained personal information and photographs. He encouraged his readers to delete messages that he had created to test the flaw.

Some of the messages Jenkins viewed contained photographs

Some of the messages Jenkins was able to view contained photographs.

Although Jenkins received no response from Facebook when notifying them of the problem, the “oversight” was noted by Jenkins as fixed twelve hours later.

Jenkins spent his year in industry working for the University’s Information Services department and currently works on their help desk. He has been offered a job in web security by a French software firm as a result of his discovery making international press. He is hoping to be accepted onto  a graduate scheme in IT or to start his own IT support business after graduating in July.