Facebook’s Ad Tool Can Be Used For Covert Surveillance

Exploiting Custom Audiences

Facebook’s Custom Audience feature is a powerful tool that marketers can use to reach specific individuals via Facebook ads.

Merge With Target In A Single Custom Audience

To identify non-public information about a a target the process is quite simple; build a custom audience of decoy accounts and include the target account.

Using A Mix Of Fake And Real Facebook Accounts

To help avoid interference with this experiment, the female accounts I included in the custom audience were a mix of my fellow Nieman Fellows, as well as fake facebook accounts I purchased through vendors on blackhatworld.com.

Initial Experiment

I created a new Facebook account (John Harvard, pictured below), and ran the ad below to a custom audience that featured my personal Facebook account as the target.

The Facebook Ad
  1. It breaks the trust users have with Facebook. When a user chooses to hide their location, age, gender or the times they use the platform, Facebook must universally respect this wish. Under no circumstances should it be made available to a third party without the consent of the user.
  2. Aside from simple privacy concerns, there are many reasons that a Facebook user might not want their location, gender, or time of use known by a third party. Facebook’s ad tool could become an incredibly powerful covert surveillance tool used to monitor the movement of journalists, dissidents, etc.
  3. I filed a “white hat” report w/ Facebook, the status of which shows “triaged.” Repeated requests for an update have gone unanswered.
  4. I was able to replicate this experiment with the same results on 1/27/18

Final Thoughts

While I have extensive experience using Facebook’s ad tool, I am not a trained security researcher. I would love if others tried to replicate this experiment to see if they can reproduce these results.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Matt Karolian

Matt Karolian

1.8K Followers

2018 Nieman Fellow @ Harvard. I make things happen on the internet for The Boston Globe & Boston.com