Major Facebook Breach: 50m Users Compromised

Nearly 50m Facebook accounts were compromised by an attack that gave hackers the ability to take over users’ accounts, Facebook revealed on Friday 28th Sept. The breach was discovered by Facebook engineers on Tuesday 25 September, the company said, and patched on Thursday 27th.

Users whose accounts were affected will be notified by Facebook. Those users will be logged out of their accounts and required to log back in.

“I’m glad we found this and fixed the vulnerability,” Mark Zuckerberg said on a conference call with reporters on Friday morning. “But it definitely is an issue that this happened in the first place. I think this underscores the attacks that our community and our services face.”

The security breach is believed to be the largest in Facebook’s history and is particularly severe because the attackers stole “access tokens”, a kind of security key that allows users to stay logged into Facebook over multiple browsing sessions without entering their password every time. 

Possessing a token allows an attacker to take full control of the victim’s account, including logging into third-party applications that use Facebook Login.

The security breach comes at a time of significant strife for the social media company, which has faced mounting criticism over issues including foreign election interference, the flow of misinformation, hate speech, and data privacy.
The revelation that a political consultancy linked to the US president, Donald Trump, had obtained the personal information of tens of millions of Facebook users prompted widespread concern that the company was cavalier in its approach to privacy.

“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” Zuckerberg wrote in a public apology regarding the Cambridge Analytica breach.

According to Facebook, the attacker exploited three bugs that were introduced into the site’s “view as” feature in July 2017. “View as” allows users to see what their profile looks like to other users. The company does not yet know when the hack took place, but it said that it began an investigation after discovering unusual activity on 16 September.
In addition to the 50m accounts whose access tokens were taken, Facebook said that it would require 40m additional users who used the “view as” tool since July 2017 to log out of their accounts as a precaution. This will reset those users’ access tokens, protecting their accounts.

The company has notified law enforcement, the vice-president of product management, Guy Rosen, said on the conference call. Rosen said that Facebook was working with the FBI, but he did not comment on whether national security agencies were involved in the investigation.

“The investigation is early, and it’s hard to discover who is behind this,” Rosen said. “We may never know.” He did note that the scale and complexity of the hack would have required “a certain level” of expertise. Dr Lukasz Olejnik, an independent cybersecurity and privacy researcher, said: “Anyone involved in this hack knew what he was doing.” Olejnik noted that whoever discovered the vulnerabilities would likely have been eligible for a “bug bounty” payment had they disclosed the bugs rather than exploited them.

Another key area of investigation is discovering the extent to which the hackers used the access tokens. The company says it has not yet seen evidence that the hackers accessed private messages or made posts on users’ behalf, but they did attempt to access certain profile information.

Rosen did not provide any details on the location of users affected, saying only that the attack seemed “broad” and investigators had not determined whether there were particular targets. The company has notified the Irish Data Protection Commission (DPC) about the breach. 

The implementation of Europe’s General Data Protection Regulation (GDPR) meant that Facebook was required to notify data protection authorities within 72 hours if any affected users were in the European Economic Area.

The Irish DPC was critical in its initial response to the breach, tweeting: “At present Facebook is unable to clarify the nature of the breach & risk to users. We are pressing Facebook to urgently clarify these matters.

News of the hack comes at the end of a week in which many of Facebook’s Silicon Valley peers testified before the US Congress about the possibility of consumer privacy regulations.

“Today’s disclosure is a reminder about the dangers posed when a small number of companies like Facebook or the credit bureau Equifax are able to accumulate so much personal data about individual Americans without adequate security measures,” said the US senator Mark Warner in a statement. “This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users.”

Facebook shares fell about 3% following the disclosure. 

Guardian

You Might Also Read:

Regulation Might Actually Protect Facebook:

ICO Fine Facebook Half A Million Pounds:

 

« US Has Devastating Cyber Weapons
NATO Can’t Agree On What A Cyber Attack Is »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

LogRhythm

LogRhythm

LogRhythm's security platform unifies SIEM, log management, network and endpoint monitoring, user behaviour analytics, security automation and advanced security analytics.

Mi-Token

Mi-Token

Mi-Token is an advanced two-factor authentication solution that offers unparalleled security, flexibility, cost-effectiveness and ease of use.

IoT Now

IoT Now

IoT Now explores the evolving opportunities and challenges facing CSPs, and we pass on some lessons learned from those who have taken the first steps in next gen IoT services.

Wallarm

Wallarm

Wallarm is the only unified, best-in-class API Security and WAAP (Web App and API Protection) platform to protect your entire API and web application portfolio.

RUSCADASEC

RUSCADASEC

RUSCADASEC is an independent non-profit initiative on developing the open Russian-speaking international community of industrial cyber security/ICS/SCADA cyber security professionals.

QuoIntelligence

QuoIntelligence

QuoIntelligence experts can help your team understand the evolving cyber threats and provide simple yet comprehensive recommendations so you can focus on what matters.

Protek International

Protek International

Protek International delivers world-class Digital Forensics, eDiscovery, Cyber Security, and related Advisory services.

Mobileum

Mobileum

Mobileum is a leading provider of Telecom analytics for roaming, security and risk management and end-to-end domestic and roaming testing solutions.

VCG Group

VCG Group

VCG provides everything you need for the design, implementation and management of data centres, cyber-secure enterprise networks, cloud and connectivity services.

RedHunt Labs

RedHunt Labs

RedHunt Labs is a premier Cybersecurity Solutions provider, offering Attack Surface Management solution 'NVADR' and Penetration Testing services.

KirkpatrickPrice

KirkpatrickPrice

KirkpatrickPrice is dedicated to providing you with innovative security guidance and efficient audit services.

Randaemon

Randaemon

RANDAEMON’s mission is to create True Random Number Generators (TRNG) that are hardware-based and integrated into System-on-Chip.

Cranium

Cranium

Cranium are an international consultancy organisation specialised in privacy, security and data management.

Walacor

Walacor

Walacor’s secure data platform represents the next generation of secure data and blockchain storage with a trust-first approach that revolutionizes enterprise data, and database management systems.

Blue Cloud Softech Solutions

Blue Cloud Softech Solutions

Blue Cloud Softech propels inspiring digital transformations. We provide AI products, cybersecurity, healthcare technology, and cloud solutions.

Neural Defend

Neural Defend

Neural Defend is a deepfake detection technology with proprietary algorithms and an AI agentic multi-layered of solution.