First OpenSocial app hacked in 45 minutes

The first app launched under Google's OpenSocial API program has been taken down, shortly after it was discovered a hacker could use it to change user profiles.

The application was built by third party developer RockYou to run on Plaxo, a social networking Web site which allows its members to update and synchronise Microsoft Outlook, Mozilla Thunderbird and Mac OS X calendars and address books.

A developer who uses the nickname "harmonyguy" alerted Plaxo's vice president of marketing John McCrea to a vulnerability in the RockYou "emoticon" -- icons that represent a user's emotions -- application that Plaxo allowed on its platform as part of Google's OpenSocial API program.

The flaw allowed the "harmonyguy" to add emoticons to McCrea's Plaxo profile without his permission.

The application was taken down by Plaxo after "harmonyguy" identified the flaw -- which took just 45 minutes, according to TechCrunch blogger Michael Arrington.

"We have temporarily taken down this app, due to some bugs discovered today. We apologise for the inconvenience. We are at the early phase of this, so expect some ups and downs ... Your patience appreciated," wrote McCrea on the Plaxo blog last Friday.

Last week, Google announced its ambitions to unite multiple social networking Web sites under the OpenSocial API. OpenSocial standardises the API for a number of different social networking Web sites, allowing third party developers to create applications that access users' friends and update feeds, explained Google.

Plaxo is just one of the companies to become part of Google's OpenSocial API program. Some of the sites included in the program are Engage.com, Friendster, LinkedIn, MySpace, Oracle, orkut, Plaxo and Salesforce.com.

Although he claims to have hacked third party Facebook applications such as SuperPoke, "harmonyguy" said Facebook's platform makes it harder to change a user's profile.

"The main issue I've found with Facebook apps is being able to access people's app-related history; for instance, until recently, I could access the SuperPoke action feed for any user," "harmonyguy" told Arrington. Facebook is not part of OpenSocial.

Changing an emoticon may not be a malicious hack, said "harmonyguy", however, he warned that if Google does not stabilise its platform, more damaging hacks are in store.