26,000 Malicious Apps Use Facebook APIs

Those APIs give developers easy access to user data.

  • By Dian Schaffhauser
  • 05/02/18

26,000 Malicious Apps Use Facebook APIs 

The mop-up work for Facebook in the wake of its privacy reform could take much longer than we might expect. According to security company Trustlook, there are nearly 26,000 malicious apps currently using at least one Facebook application programming interface, any of which could give those developers access to information from Facebook profiles, including names, locations and email addresses.

The company noted that similar dangers exist in APIs provided for other social sites, including Twitter, LinkedIn, Google and Yahoo.

In response to the privacy problem, Facebook CEO Mark Zuckerberg said his company would audit thousands of apps and give users easier tools for managing how their data is used.

Trustlook sells security products and services using artificial intelligence to protect against sophisticated malware and other kinds of attacks.

According to a recent blog article on Trustlook's website, the problems that led to the Cambridge Analytica data-harvesting outrage resulted when developers abused certain Facebook APIs, specifically those associated with its login feature. When Facebook users tap the site's login to connect with other services, they grant those apps' developers access to information on their profiles. Beginning in 2015, the year before the Cambridge Analytica debacle, Facebook also allowed developers to access a bit of data from friends of users who used Facebook Login as well — whether or not they had agreed to hand over their data.

The security company has identified 25,936 "malicious apps" in use by Facebook users. That count was handled through its product, SECUREai App Insights, whose three flavors — mobile, core and IoT — are used by companies that want to embed security into their own products. The technology provides information on apps, including risky API calls and a risk score. According to the firm, three of the top five app stores use the program to assess the risk of the apps allowed into their stores.

"Whether Facebook can accomplish their goals remains to be seen, but it's clear the company needs better visibility into how user information is being handled by third-party apps," the company suggested. "And most likely it needs a sophisticated piece of software to help."

About the Author

Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.

Featured

  • Two figures, one male and one female, stand beside a transparent digital interface displaying AI symbols like neural networks, code, and a shield, against a clean blue gradient background.

    Microsoft-IDC Report Makes Business Case for Responsible AI

    A report commissioned by Microsoft and published last month by research firm IDC notes that 91% of organizations use AI tech and expect more than a 24% improvement in customer experience, business resilience, sustainability, and operational efficiency due to AI in 2024.

  • futuristic VR goggles with blue LED accents, placed in front of a fantastical landscape featuring glowing hills, a shimmering river, and floating islands under a twilight sky

    Los Angeles Unified School District Adopts VR Learning Platform, Resources

    Los Angeles Unified School District (LAUSD) recently announced a partnership with Avantis Education to bring educational virtual and augmented reality (VR/AR) solution ClassVR to its students. A news release reports that the district has already deployed more than 16,000 ClassVR headsets as part of the Los Angeles Unified Instructional Technology Initiative.

  • Google Classroom tools

    Google Announces Classroom Updates, New Tools for Chromebooks

    Google has introduced a variety of features across its products for education, announced recently at the 2025 BETT ed tech event in London. Among the additions are enhancements to Google Classroom and new tools for Chromebooks, "designed to help address the diverse needs of students around the world," Google said in a blog post.

  • metallic padlock with a glowing keyhole, set on a dark gradient background with a faint digital grid and blue-green highlights

    Microsoft Announces Security Updates

    Microsoft has introduced a handful of new security tools and updates, which the company said adhere to its Secure Future Initiative, a set of three core tenets emphasizing "secure by design, secure by default and secure operations."