Meta Platforms, the company formerly known as Facebook, has announced that it's expanding its bug bounty program to start rewarding valid reports of scraping vulnerabilities across its platforms as well as include reports of scraping data sets that are available online.
"We know that automated activity designed to scrape people's public and private data targets every website or service," said Dan Gurfinkel, security engineering manager at Meta. "We also know that it is a highly adversarial space where scrapers — be it malicious apps, websites or scripts — constantly adapt their tactics to evade detection in response to the defenses we build and improve."
To that end, the social media giant aims to monetarily compensate for valid reports of scraping bugs in its service and identify unprotected or openly public databases containing no less than 100,000 unique Facebook user records with personally identifiable information (PII) such as email, phone number, physical address, religious, or political affiliation. The only caveat is that the reported data set must be unique and not previously known.
Should the requisite criteria be met, the company said it will take appropriate measures, including legal actions, to remove the data from the non-Meta website. This could also involve reaching out to hosting providers like Amazon, Box, and Dropbox to pull the data set offline, or working with third-party app developers to address server misconfigurations. Reports concerning scraped databases will be rewarded through matched charity donations of the researchers' choosing.
"Our goal is to quickly identify and counter scenarios that might make scraping less costly for malicious actors to execute," Gurfinkel noted, adding "we want to particularly encourage research into logic bypass issues that can allow access to information via unintended mechanisms, even if proper rate limits exist."
The move to curb unauthorized scraping, a technique referring to the practice of extracting data from websites, comes as part of the company's efforts to limit abuse of people's data on its platform in the wake of the infamous Cambridge Analytica data scandal that resulted in the personal information belonging to millions of Facebook users harvested without their consent for political advertising.
That's not all. Earlier this April, the phone numbers of 533 million Facebook users were shared on a cybercrime forum for free, data that was collected by scraping the platform. In October 2021, Meta filed a lawsuit on Friday against a Ukrainian national named Alexander Alexandrovich Solonchenko for allegedly scraping and selling the personal data of more than 178 million Facebook users on an underground forum.
The company said it has paid out over $14 million in bounties since the inception of the program in 2011, with $2.3 million awarded to researchers from more than 46 countries this year alone. Most of the valid reports over the past 10 years have come from India, the U.S., and Nepal, Meta pointed out.
