Two Ukranian men sued for scraping data on Facebook from 63k users

Facebook is suing two Ukrainians who used quick apps to illegally harvest private data of 63k users for advertisement purposes

Facebook launched a lawsuit, accusing two Ukrainian men of illegally harvesting users' data with the help of malicious quiz apps

Andrey Gorbachov and Gleb Sluchevsky, two entrepreneurs from Ukraine, are sued by Facebook for illegitimate scraping of sensitive data of 63 thousand users. The lawsuit^[1] that was filed on Friday last week accuses two men of tricking users into installing quiz applications that were able to compromise their browsers, inserting a layer of ads that were not coming from Facebook.

The applications, under names of “Supertest,” “FQuiz,” “Pechenka” and “Megatest” were downloaded as browser extensions by mainly Russian users and allowed compromise of users' profiles, and also took advantage of their friends' lists, displaying ads that were mimicking the legitimate Facebook ones.

The operation of malicious apps lasted between 2016 and 2018 and caused over $75,000 in ad revenue losses to the company. However, Facebook representatives said that the fake ads affected not only their platform, as Daily Beast reports:^[2]

As a result of installing the malicious extensions, the app users effectively compromised their own browsers because, unbeknownst to the app users, the malicious extensions were designed to scrape information and inject unauthorized advertisements when the app users visited Facebook or other social networking site as part of their online browsing

According to the legal documents, Gorbachov and Sluchevsky are accused under the Computer Fraud and Abuse Act, California Comprehensive Computer Data Access and Fraud Act, Breach of Contact, and Fraud.

The fraudulent apps used “Login with Facebook” feature to gain access to sensitive data

During two years of the operation, the four applications were available to download on multiple websites and were associated with domains like megatest.online, supertest.name, testsuper.su, testsuper.net, fquiz.com, and funnytest.pro.

The two men often operated under names “Elena Stelmah,” “Amanda Pitt,” and “Igor Kolomiiets” who were employed by a company “Web Sun Group,” which also offered web development and other online services.

The purpose of the apps was to display horoscopes, as well as character tests – which is nothing unusual when it comes to regular Facebook apps. The applications also used the “Login with Facebook” feature, which allowed users to avoid creating new accounts.

However, by logging in with a Facebook profile, users unknowingly allowed the malicious apps to scrape the information off of their profiles on the social platform, and allow steal such data like name, age, gender, lists of friends and profile picture.

In general, such activity is forbidden by the social media giant. However, Facebook agreed to provide the “Login with Facebook” feature to the apps. This is because the accused men simply lied and agreed with the Terms of Service agreement.

Facebook and data breach scandals

Everyone who has been following the press in the past year must have seen the surge of scandals that related to Facebook and users' privacy.

Probably the most notorious case came to light back in March 2018, when news headlines flashed about the Cambridge Analytica scandal,^[3] which resulted in 87 million users sensitive data compromise. However, the devastating blow that made millions of users question the social media giant's security procedures of personal information did not end there.

Later that year, the third-party quiz app NameTests.com was accused of exposing data of 120 million users^[4] when inserted malicious JavaScript that stored such data as names, photos, friend lists, and other data that can later be stolen by criminals.

At the end of 2018, Facebook once again came under scrutiny, when the press released articles about the company sharing data of its users with such industry giants like Netflix, Apple, Microsoft, Amazon, etc.^[5]

The social network leader is trying to recuperate after such blows and provide proof that not all incidents that involve data exposure are related to Facebook itself, but rather external parties. Since Gorbachov and Sluchevsky are located outside of the US, it is highly likely that they will avoid harsh punishments.

Facebook's CEO Mark Zuckerberg also published a memo, declaring the new era of “A Privacy-Focused Vision for Social Networking.” While the first major incident resulted in disturbances to the company, it did promise improvements, but what followed was a series of more data scandals. We can only wait and see if Facebook can fulfill its promises this time.

Stay safe online.