A SECURITY loophole in Facebook has allowed over one million Facebook accounts to generate at least 100 million “likes” and comments to manipulate online reputation, researchers said.
The researchers, from the University of Iowa and Lahore University of Management Science in Pakistan, said dozens of sites were found running so-called “collusion networks”, which have been found generating users’ likes for free, CBS News reported.
As Facebook posts that generate a lot of likes had higher chances of appearing on other peoples’ news feeds, users could easily be swayed by the attention and influence generated by such networks.
By subscribing to the service, users would grant the networks the ability to like and comment on the posts of other members. This allows the networks to harness its entire network to boost posts and accounts.
Exploiting a code known as OAuth, the networks use third-party applications such as Spotify, iMovie and the Playstation Network to access users’ Facebook accounts. The networks’ access could stretch anywhere between a few hours to even months at a time.
“In addition to reputation manipulation, attackers can launch other serious attacks using leaked access tokens. For example, attackers can steal personal information of collusion network members as well as exploit their social graph to propagate malware,” the researchers said in a paper, as cited by CBS news.
The researchers said collusion networks were active during the 2016 US presidential election season but were unable to tell whether posts were boosted to work for or against candidates. They said the research was merely a scratch on the surface.
Research co-author Zubair Shafiq said the team wanted to examine Russia’s alleged role in influencing the outcome of the elections as up to 50 networks have been found, with much more expected to be uncovered.
“These collusion networks are quite possibly involved in orders of magnitude much larger than what we observed.”
In response to the research, Facebook released a statement saying the collusion networks have been blocked.
“We have addressed the activity described in this research and we are no longer seeing it on our platform,” a Facebook spokesman said.
“Meanwhile, we are investigating different techniques that could be used to generate inauthentic likes in smaller volumes.”
The spokesman said the site would “take the appropriate action” to help ensure that connections and activity on its service remained “authentic”.