If you think that just because you have never signed up for Facebook you're immune to the tracking and collecting of user activities outside of this popular social networking site, think again.
Facebook's controversial Beacon ad system tracks activities from all users in its third-party partner sites, including from people who have never signed up with Facebook or who have deactivated their accounts, CA has found.
Beacon captures detailed data on what users do on these external partner sites and sends it back to Facebook along with users' IP addresses, Stefan Berteau, senior research engineer at CA's Threat Research Group, said Monday in an interview.
This happens even if users delete the Facebook cookie. "The Facebook Javascript [code] is still called by the affiliate site, and the information is passed in," he said. In the case of users without accounts or with deactivated accounts, the data isn't tied to a Facebook ID, he said.
However, it is well-known that IP addresses provide a variety of information about users and have in some cases been used to identify individuals.
The information captured by Beacon in these cases includes the addresses of Web pages visited by the user and a string with the action taken in the partner site, Berteau said.
CA has tested this in Beacon partner sites Epicurious.com, which focuses on food, and Kongregate.com, which focuses on video games, he said. More than 40 sites have signed up for Beacon, although not all of them have implemented it.
It's important for Facebook and the partner sites participating in Beacon to alert users about the data that is captured and passed back to Facebook, Berteau said.
"There is, to a certain extent, a privacy concern with the affiliate site, in that it's important for them to disclose that they'll be sending information about user actions to Facebook," Berteau said.
While users' activities on the Web are tracked in various ways for different purposes, most commonly with tracking cookies in banner ads, the Beacon implementation is one Berteau has never come across before in terms of the details of users' actions that it's able to capture and send back.
These latest findings build on Berteau's report on Friday that Beacon stealthily tracked the activities of users on affiliate Beacon sites even if they were logged off from Facebook and had previously declined having their activities reported back to their Facebook friends.
Over the weekend, Facebook confirmed that Berteau's report on Friday was accurate but said that it deletes the data it gets under these circumstances.
Still, Friday's findings deepened the privacy concerns surrounding Beacon since its introduction several weeks ago. And the admission Monday added to the concerns, since it contradicted what had, until then, been the official company line about this issue.
CA's research, which is ongoing, has demonstrated that Beacon is more intrusive and stealthy than previously acknowledged and imagined.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
1 Recommendation
