A security researcher from the Quotium Seeker Research Center has found a vulnerability in Facebook website that allows anyone to see a users’ friends list, even when the user has set that information to private. The exploit is carried out by abusing the ” feature on Facebook, which suggests new friends to users based on mutual connections and other criteria such as work or education information. Facebook said that that a hacker would have no way of knowing if the suggested friends represented a user’s entire list. A Security expert from Sudan had reported the exact same flaw to The Hacker News team, back in the month of June.
Source: https://thehackernews.com/2013/11/facebook-vulnerability-allows-to-view.html