FACEBOOK BREACH: 50M USERS AFFECTED
Facebook bug is reminiscent of a much larger attack on Yahoo in which attackers compromised 3 billion accounts that included e-mail addresses, phone numbers
Facebook reported a major security breach in which 50 million user accounts were accessed by unknown attackers.
The attackers gained the ability to “seize control” of those user accounts, Facebook said, by stealing digital keys the company uses to keep users logged in. They could do so by exploiting three distinct bugs in Facebook’s code.
The company said it has fixed the bugs and logged out the 50 million breached users—plus another 40 million who were vulnerable to the attack—in order to reset those digital keys. Users don’t need to change their Facebook passwords, it said.
Facebook said it doesn’t know who was behind the attacks or where they’re based. In a call with reporters on Friday, chief executive officer Mark Zuckerberg—whose own account was compromised—said that attackers would have had the ability to view private messages or post on someone’s account, but there’s no sign that they did.
“We do not yet know if any of the accounts were actually misused,” Zuckerberg said.
The hack is the latest setback for Facebook during a tumultuous year of security problems and privacy issues. So far, though, none of these issues have significantly shaken the confidence of the company’s two billion global users.
This latest hack involved bugs in Facebook’s “View As” feature, which lets people see how their profiles appear to others. The attackers used that vulnerability to steal the digital keys, known as “access tokens,” from the accounts of people whose profiles were searched for using the “View As” feature. The attack then moved along from one user’s Facebook friend to another. Possession of those tokens would allow attackers to control those accounts.
One of the bugs was more than a year old and affected how the “View As” feature interacted with Facebook’s video uploading feature for posting “happy birthday” messages, said Guy Rosen, Facebook’s vice president of product management. But it wasn’t until mid-September that Facebook noticed an uptick in unusual activity, and not until this week that it learned of the attack, Rosen said.
Facebook confirmed late Friday that third party apps, as well as its own Instagram app, could have been affected.
“The vulnerability was on Facebook, but these access tokens enabled someone to use the account as if they were the account-holder themselves,” Rosen said.
It concerns me but considering that Facebook is a social network, I already took some measures not to disclose everything there. With the influx of Facebook users, there is a tendency for a security breach. No precedent that the security breach has had a serious impact on anyone. I would be more concerned if the security feature of my email had been compromised.
AMMIEL ANG USJ-R Law student With that hacking incident, I guess everyone should be more cautious now especially when sharing confidential information through Facebook. It would be better to share info through calls, texts, or email because even with the tight security Facebook has right now, this still happened. RENDZBORG BAUTISTA College student, 19