Recently while lurking around one of the social networking sites popular with local folks, I have found out that the site does not scrub out the GPS data from uploaded pictures. I've contacted them and told them about my concerns, but their reply was that they believe uploading images with (potentially) your home address is only a user error.
I've tried to argue with them, that because
- A lot of the users like to post selfies on the site, so there are quite a lot of pictures
- The userbase of the site contains a lot of teens and other potentially vulnerable people (to real life abuse if their home/work address would leak)
- The site's API makes it very easy to search for selfies and other pictures
- And finally once someone comments on your photo you cannot delete it anymore (so even if someone realizes their mistake they cannot fix it anymore, unless contacting customer support to remove the offending pictures). Even quitting the social networking site alltogether will not delete your already uploaded pictures that have comments on them.
this is something to be concerned about, but based on their reply they didn't think so, even after I showed them some of my findings, like the fact that using their API around 13% of the pictures have GPS information in their EXIF data.
To help raise awareness I created a (yet unpublished) blog post and an (also yet unpublished) open source application that uses the site's API to go over the pictures of a user, and tells them whether they are vulnerable or not. If they are, the app also suggest them that they should contact customer support and ask them to completely purge the offending pictures from the system (as that is the only way to get rid of them).
Unfortunately while I'm trying to make the app only return the bare minimum data (it only tells the user whether they are vulnerable or not, but doesn't plot the locations on a map or similar), I'm worried that a malicious person after realizing the hole could modify the app in a way that would allow them to easily plot the locations of people who have uploaded pictures with GPS data.
My questions are:
- Is this actually considered a security risk, or are they right that this is just user error?
- Is my approach of releasing a blog post and an application with it that can tell you if you are vulnerable or not the right one to do, since I couldn't get the developers to plug this hole?
- Should I be concerned that if I make my findings public it can lead to a surge of malicious use, which I'm worried that could lead to real life stalking and abuse of some of the members of the site, or am I just worrying too much?