- Personal Lines
- No comments
On Sept. 28, 2018, Facebook announced that nearly 50 million user accounts were compromised in a data breach. The breach, which can be traced back to July 2017, is one of the largest in the company’s 14-year history.
While investigations are ongoing, the company said hackers exploited a software vulnerability in Facebook’s “View As” feature to steal access tokens and gain control of user accounts. Access tokens are effectively digital keys to specific accounts, and stealing them allows attackers to view private posts or compose status updates without the knowledge of the affected user.
In addition, the attack allowed the hackers to see anything that users can see on their own profile, including the names and birth dates of friends and family members. Such information could be used in future phishing attacks.
Via Facebook’s press release:
Here are some additional technical details about the security issue.
Earlier this week, we discovered that an external actor attacked our systems and exploited a vulnerability that exposed Facebook access tokens for people’s accounts in HTML when we rendered a particular component of the “View As” feature. The vulnerability was the result of the interaction of three distinct bugs:
First: View As is a privacy feature that lets people see what their own profile looks like to someone else. View As should be a view-only interface. However, for one type of composer (the box that lets you post content to Facebook) — specifically the version that enables people to wish their friends happy birthday — View As incorrectly provided the opportunity to post a video.
Second: A new version of our video uploader (the interface that would be presented as a result of the first bug), introduced in July 2017, incorrectly generated an access token that had the permissions of the Facebook mobile app.
Third: When the video uploader appeared as part of View As, it generated the access token not for you as the viewer, but for the user that you were looking up.
In response to the attack, Facebook reset 90 million logins automatically, fixed the software vulnerability and informed law enforcement officials. While the company says that users do not need to change their passwords, individuals experiencing login issues should navigate to Facebook’s Help Center.
As a safety precaution, users are encouraged to log in and out of all of their accounts on every device. Users can see all of the devices they’re currently signed into here.
To learn more about the breach, read Facebook’s official blog post.
The Safegard Group takes cyber security seriously and can help you protect yourself, contact us for details.