Another day, another bout of bad news for the world’s most popular social network, Facebook. The company has announced that it was the subject of a massive breach that affected almost 50 million accounts.
In a post on the company’s digital newsroom, VP of product management Guy Rosen says Facebook’s engineering team first discovered the security issue on Tuesday, 25 September.
Who’s looking at you, kid
“[I]t’s clear that attackers exploited a vulnerability in Facebook’s code that impacted ‘View As’, a feature that lets people see what their own profile looks like to someone else,” Rosen explains. “This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts. Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app.”
Rosen says they’ve fixed the vulnerability, “informed law enforcement”, reset the access tokens of the almost 50 million accounts they know were affected, and as a further precautionary step, “resetting access tokens for another 40 million accounts that have been subject to a ‘View As’ look-up in the last year”.
Begin again login again
What does this mean? Well, if you’ve had to log into your Facebook again today for the first time in a while, you’re not alone: around 90 million other people have had to do likewise. Once you logged back in, you should’ve gotten a notification at the top of your news feed explaining what happened. We didn’t, but YMMV.
Facebook’s also temporarily canning the ‘View As’ feature while it has a thorough dig to make sure its secure.
“This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017,” Rosen says, adding that “the attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens”.
Earlier this week a hacker announced their intention to delete Facebook CEO Mark Zuckerberg’s profile on the social network he founded and live stream the process. The show was scheduled for this weekend, but we have to wonder if this was the exploit said hacker hoped to harness… in which case, they best have a backup plan.
