A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”
In an emailed statement responding to questions from Ars, Meta said: “We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.”
Asaf Aprozper, a cofounder and CTO of Claroc, said he reported the findings through Meta’s bug bounty program on October 8 and also tried reaching people at Meta on LinkedIn but got no reply either way.
The easiest way to discover the URLs is to perform a passive DNS search through one of...
Copyright of this story solely belongs to www.wired.com. To see the full text click HERE
