I’m a Facebook fan and strongly believe that it is destined to break all records when it is either bought or is listed. Today however, Facebook took its first real knock with users reporting that they were getting data that was not their own. The team at my office first thought it was a proxy issue but we later discovered that the problems were widespread. Facebook is currently down with an “We’re upgrading” message on their sparse home page. I wish I was a fly on their wall. The tension must be excruciating.
Will the rumored offer of something like $5 billion be something that the owners later look at with broken hearts. Can you imagine the disappointment if similar offers fail to materialize.
Update:
Here is a link to a pdf document detailing an xss attack on Facebook. The document, written by Adrienne Felt, has been censored by the author until the vulnerability has been fixed by Facebook. It appears that the outage today was to correct security holes as identified in the document.
Update:
Facebook is online. I’ve noticed that now after the update if you click on a profile of a member that is not one of your friends, you are redirected to the basic search screen. All profiles, even those marked as public behave in a similar manner.
Update:
Facebook PR has a group that they’ve invited some of the press and bloggers into. Here’s an official statement that was just posted to that group:
This morning, we temporarily took down the Facebook site to fix a bug we identified earlier today. This was not the result of a security breach. Specifically, the bug caused some third party proxy servers to cache otherwise inaccessible content. The result was that an isolated group of users could see some pages that were not intended for them. The site has now been restored and we apologize for any inconvenience this may have caused.”
Update:
Is Facebook still insecure?
Facebook is a social networking website
Popular social networking website Facebook went down for unknown upgrades, possibly to circumvent multiple holes that were published in a white paper earlier. From roughly 1:00 to 4:15 pm ET, users reported the site was down.

Blogs have speculated it may be simply a server upgrade, or it may be new features. One web development blogger has even raised the theory that the site was hacked, with the login box showing multiple random email addresses, through "" coding. Another user replied to this posting, saying that they were even able to read the other, random user's inbox. Both a blogger who works at a computing company's office in Johannesburg, South Africa and a Norwegian news outlet reported similar troubles. Many blogs received comments from people with similar circumstances, worldwide.

A white paper by Adrienne Felt, posted on July 27, 2007, explained step-by-step how to use an exploit to hijack a user's account. The white paper was then partially censored by the author, until the vulnerability has been fixed by Facebook. Regardless of whether the change was prompted by this paper, both the XSS hole and problem with forms described by the author were fixed during the upgrade.

The site read "We're upgrading. We'll be back soon." with no further explanation.

This is the first known global outage for the site.

This comes as a rival site, ConnectU, has filed a lawsuit against Facebook founder Mark Zuckerberg for allegedly stealing the idea and the code. The hearing is scheduled for tomorrow.

Also on Wednesday, the Black Hat Briefings computer security conference begins. The conference unites people from "government agencies and global corporations with the underground's most respected hackers."