50M FACEBOOK ACCOUNTS HACKED
Social media giant still investigating security breach but also outlined initial steps for affected users
NEWYORK—
Facebook reported a major security breach in which 50 million user accounts were accessed by unknown attackers.
Facebook cofounder Mark Zuckerberg—whose own account was compromised—said that attackers would have had the ability to view private messages or post on someone’s account, but there’s no sign that they did.
Latest security issue
“We do not yet know if any of the accounts were actually misused,” Zuckerberg said of the latest setback for Facebook during a tumultuous year of security problems and privacy issues.
So far, though, none of these issues have significantly shaken the confidence of the company’s 2 billion global users.
For users, Facebook’s revelation of a data breach that gave attackers access to 50 million accounts raises an important question: What happens next?
What to do
For the owners of the affected accounts, and of another 40 million that Facebook considered at risk, the first order of business may be a simple one: sign back into the app.
Facebook logged everyone out of all 90 million accounts in order to reset digital keys the hackers had stolen.
Next up is the waiting game, as Facebook continues its investigation and users scan for notifications that their accounts were targeted by the hackers.
What Facebook knows so far is that hackers got access to the 50 million accounts by exploiting three distinct bugs in Facebook’s code that allowed them to steal those digital keys, technically known as “access tokens.”
Users don’t need to change their Facebook passwords, it said, although security experts say it couldn’t hurt to do so.
No suspects yet
Facebook, however, doesn’t know who was behind the attacks or where they’re based.
This latest hack involved bugs in Facebook’s “View As” feature, which lets people see how their profiles appear to others.
Mode of attack
The attackers used that vulnerability to steal access tokens from the accounts of people whose profiles came up in searches using the “View As” feature.
The attack then moved along from one user’s Facebook friend to another. Possession of those tokens would allow attackers to control those accounts.
One of the bugs was more than a year old and affected how the “View As” feature interacted with Facebook’s video uploading feature for posting “happy birthday” messages, said Guy Rosen, Facebook’s vice president of product management.
Noticed twoweeks ago
But it wasn’t until midSeptember that Facebook noticed an uptick in unusual activity, and not until this week that it learned of the attack, Rosen said.
Neither passwords nor credit card data was stolen, Rosen said. He said the company has alerted the FBI and regulators in the United States and Europe.
Facebook confirmed late Friday that third party apps, including its own Instagram app, could have been affected.
“The vulnerability was on Facebook, but these access tokens enabled someone to use the account as if they were the accountholder themselves,” Rosen said.
Tumultuous year
News broke early this year that a data analytics firm once employed by the Trump campaign, Cambridge Analytica, had improperly gained access to personal data from millions of user profiles.
Then a congressional investigation found that agents from Russia and other countries have been posting fake political ads since at least 2016.
In April, Zuckerberg appeared at a congressional hearing focused on Facebook’s privacy practices.