Hours after Facebook announced on Friday a huge data breach that affected at least 50 million users, the news got worse. In a conference call with reporters—Facebook’s second of the day, after the first one left many questions unanswered—the company’s vice president of product, Guy Rosen, said that the hackers could have also gained access to users’ accounts on other apps and websites, beyond Facebook itself, via Facebook Login. That’s the feature of Facebook that allows you to sign up for, and log in to, all kinds of other online services using your Facebook credentials. For users whose Facebook accounts were hacked, the company confirmed, it’s possible that those third-party accounts could have been breached as well. Advertisement The follow-up call was meant to clarify some of the details of the breach, which is almost certainly the most significant in Facebook’s history. In it, Rosen explained how three separate bugs combined to give hackers a path to full control of users’ Facebook accounts. They gained access not by stealing users’ passwords, but via a sort of digital key called an “access token” that’s meant to let you into your account on another device (say, your phone) automatically when you’re already logged in on another (say, your laptop). Advertisement Advertisement The good news is that the hackers don’t have anyone’s Facebook passwords—so even users who were affected by the breach don’t necessarily have to change those. The bad news: They could theoretically have used that same token to gain access to some of users’ other online accounts, depending on how the relevant apps and sites handle Facebook access tokens. It was not immediately clear whether the hackers—who remain unknown—actually took advantage of this, nor how easy it would have been for them to do so. Advertisement Any such connections should have been broken when Facebook reset the access tokens of the affected users, beginning Thursday night. That would have logged users out of those third-party apps and sites. Facebook also clarified that users affected by the Facebook breach who had Instagram or Oculus accounts linked to their Facebook account would need to delink and relink those accounts. One piece of good news: Whatsapp was apparently not affected. The story is still developing, and more details are likely to emerge in the days to come. But there’s already one conclusion we can make: There was a time when Facebook harbored ambitions to be a sort of “universal login” for sites and apps everywhere—like a driver’s license for the online world. That never quite came to pass, but it did get pretty far along. This should be the final answer to the question of whether it was ever a good idea.<doc-sep>The Facebook hack is even worse than was at first clear, the company has admitted. The site had already admitted that a hole in its code would allow people to gain access to any account, in a problem that affected some 50 million users. But it later said that the problem would also affect its "Facebook Login" service, which allows other apps to use people's Facebook account to login. How to stop Facebook from revealing everything about you Show all 9 1 /9 How to stop Facebook from revealing everything about you How to stop Facebook from revealing everything about you Lock your profile down If you haven’t done this already, do it now. In Settings, hit the Privacy tab. From here, you can control who gets to see your future posts and friends list. Choose from Public, Friends, Only Me and Custom in the dropdown menu. How to stop Facebook from revealing everything about you Limit old posts Annoyingly, changing this has no effect on who’s able to see your past Facebook posts. Instead, on the Privacy page, you have to click on Limit Past Posts, then select Limit Old Posts and finally hit Confirm on the pop-up. How to stop Facebook from revealing everything about you Make yourself harder to find You can stop completely random people from adding you by selecting Friends of Friends from the dropdown menu in the Who can send you friend requests? section of the Privacy page. It’s also worth limiting who can find your Facebook profile with your number and email address. At the bottom of the page is the option to prevent search engines outside of Facebook from linking to your profile. How to stop Facebook from revealing everything about you Control access to your Timeline You can limit who gets to post things on your Timeline and who gets to see posts on your Timeline too. In Settings, go to Timeline and Tagging and edit the sections you want to lock down. How to stop Facebook from revealing everything about you Block people When you block someone, they won’t be able to see things you post on your Timeline, tag you, invite you to events or groups, start conversations with you or add you as a friend. To do it, go to Settings and Blocking. Annoyingly, you have to block people on Messenger separately. You can also add friends to your Restricted list here, which means they’ll still be friends with you but will only be able to see your public posts and things you share on a mutual friend's Timeline. How to stop Facebook from revealing everything about you Review tags One of Facebook’s handiest privacy features is the ability to review posts you’re tagged in before they appear on your Timeline. They’ll still be visible on the News Feed while they’re fresh, but won’t be tied to your profile forever. In Timeline and Tagging, enable Timeline review controls. How to stop Facebook from revealing everything about you Clean up your apps You can view a list of all of the apps you’ve connected to your Facebook account by going to Settings and Apps. The list might be longer than you expected it to be. It’s worth tidying this up to ensure things you no longer use lose access to your personal information. If you don’t want to log into websites and apps with your facebook account, scroll down and turn Platform off. How to stop Facebook from revealing everything about you Change your ad preferences You can view a list of everything Facebook thinks you’re into and tinker with your ad preferences by going to Settings and Adverts. A lot more information is displayed on the desktop site than the app, so we’d recommend doing this on a computer. How to stop Facebook from revealing everything about you Download your data Facebook lets you download all of the data it has on you, including the posts you’ve shared, your messages and photos, ads you’ve clicked on and even the IP addresses that are logged when you log in or out of the site. It’s a hell of a lot of information, which you should download to ensure you never over-share on the social network again. That means that once a hacker had access to a person's Facebook account, they could make their way through the rest of their digital life. That might include other Facebook apps like Instagram but also third-party ones that use the login service, such as Tinder. "The vulnerability was on Facebook, but these access tokens enabled someone to use the account as if they were the account-holder themselves," said Guy Rosen, Facebook's vice president of product management, who disclosed the vulnerability in a blog post on Friday. The latest hack involved bugs in Facebook's "View As" feature, which lets people see how their profiles appear to others. The attackers used that vulnerability to steal the digital keys, known as "access tokens," from the accounts of people whose profiles were searched for using the "View As" feature. The attack then moved along from one user's Facebook friend to another. Possession of those tokens would allow attackers to control those accounts. One of the bugs was more than a year old and affected how the "View As" feature interacted with Facebook's video uploading feature for posting "happy birthday" messages, said Mr Rosen. But it wasn't until mid-September that Facebook noticed an uptick in unusual activity, and not until this week that it learned of the attack, he said The nature of the hack means that there is little users can do to protect themselves. Facebook says it has already fixed the flaw by logging everyone out of their accounts and suspending the "view as" feature. “There is no evidence that people have to take action such as changing their passwords or deleting their profiles," said a spokesperson for the National Cyber Security Centre. “However, users should be particularly vigilant to possible phishing attacks, as if data has been accessed it could be used to make scam messages more credible.”<doc-sep>Facebook got hacked, it revealed on Friday — and 50 million users' accounts were compromised. What's more, if the victims logged into other services — like Tinder, Instagram, or Spotify — with their Facebook accounts, those might be affected to. It's not clear whether the attackers did this, but the possibility may force companies that rely on Facebook's login system to launch their own investigations. Facebook CEO Mark Zuckerberg was among the 50 million affected users. Life just got worse for the 50 million people caught up in what may be the biggest hack of Facebook ever. On Friday, the Silicon Valley tech firm revealed that it had detected a security breach in which an as-yet unknown attacker, or attackers, managed to gain access to tens of millions of users' accounts by exploiting vulnerabilities in its software. But it wasn't until a second, follow-up conference call with reporters on Friday that Facebook acknowledged one of the most alarming parts of the incident: Not only did the hackers obtain the ability to access the Facebook accounts of the affected users, they also had access to any other service in which a person used their Facebook account to register — including apps like Tinder, Spotify, and Airbnb. Instagram, which is owned by Facebook, may also have been affected. The revelation drastically widens the potential impact of the hack, putting people's private data elsewhere across the web at risk. It may force the numerous major companies and startups reliant on Facebook's login service to audit their own systems for evidence of malicious activity as a result. Tinder, Airbnb, and Spotify — perhaps three of the highest-profile tech companies to use Facebook's login service — did not immediately respond to Business Insider's request for comment. So what happened? In short, the attackers found a way to trick Facebook into issuing them "access tokens" — basically, digital keys — that let them access other users' accounts as if they were that user. After spotting some unusual activity earlier this month, Facebook realized what was going on on Tuesday evening and subsequently revoked these access tokens before disclosing the hack publicly on Friday — though not before 50 million people were affected. These access keys also let the attackers theoretically access any other services that someone used Facebook's login service to log in to, whether that's dating app Tinder, or a niche smartphone game, and gain access to highly personal information. It's not clear whether this has actually occurred — when asked, a Facebook exec said only that the company was early in its investigation — but the possibility may force the other companies to undertake their own investigations into the issue. It's also not yet clear who is behind the attack on Facebook, or whether the attacks were targeted, and the reason behind it. Facebook has now patched the vulnerabilities and revoked the compromised access tokens, forcing affected users to log back in (though their passwords haven't been compromised, the company says) and notifying them about the issue. But there are at least two high-profile victims of the hack that we know about: Facebook CEO Mark Zuckerberg, and COO Sheryl Sandberg. A spokesperson confirmed that the company's two top execs were both among the tens of millions of users affected. Do you work at Facebook? Got a tip? Contact this reporter via Signal or WhatsApp at +1 (650) 636-6268 using a non-work phone, email at rprice@businessinsider.com, WeChat at robaeprice, or Twitter DM at @robaeprice. (PR pitches by email only, please.) You can also contact Business Insider securely via SecureDrop. Now read:<doc-sep>This morning, Facebook disclosed a widespread security flaw that could have allowed hackers or other malicious third parties to access an affected user’s account by gleaning their security token. The flaw affected as many as 50 million people, and Facebook says it’s forcibly making around 90 million users log back into their accounts in full today to be safe. The company says that’s because in addition to the impacted accounts, around 40 million additional people simply used the exploitable feature since the exploit was active starting in July of 2017. It also says it’s fixed the issue and alerted law enforcement, indicating that this is not an engineering mistake, but a purposeful exploit discovered and used by some third-party organization or hacker. The company says its engineering team was made aware of the issue on September 25th, but Guy Rosen, Facebook’s vice president of product management, says it’s not clear whether accounts were compromised, when the issue was exploited, or who might have been behind the attack. An attacker exploited Facebook’s View As feature to glean user security tokens “On Tuesday, we discovered that an attacker exploited a technical vulnerability to steal access tokens that would allow them to log into about 50 million people’s accounts on Facebook,” wrote CEO Mark Zuckerberg in a post to his personal Facebook page. “We do not yet know whether these accounts were misused but we are continuing to look into this and will update when we learn more.” The flaw could have let someone exploit the “View As” feature, which lets you view your own profile as it appears to another user or to the public, as a way of evaluating your specific sharing settings. However, it appears that the feature inadvertently exposed Facebook security tokens when someone selected a profile as the desired View As target. That would let someone gain access to the person’s account. Facebook access tokens are the digital keys that allow mobile users to log in to their accounts without having to retype their passwords. With full access to a user’s account, the attackers could have used any third-party app that was logged in via Facebook, the company said late Friday. In addition to making 90 million users log back in today, Facebook said it’s also disabling the View As feature “while it conducts a thorough security review.” The company gives a bit of technical analysis about how the exploit worked, but there still aren’t a lot of concrete details here: This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017, which impacted “View As.” The attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens. On a call with reporters following the announcement, Facebook said that the “video uploading feature” in July of last year related to a tool that allowed users to upload birthday videos in a way that would allow the View As feature to expose secure information, but only when interacting with two other bugs. The company also confirmed that no credit card info was exposed. Facebook’s @guyro says that the breach that affected 50 million users involved a vulnerability in a tool that allowed users to upload Happy Birthday videos — Kevin Roose (@kevinroose) September 28, 2018 I asked Facebook how sophisticated the hackers were and whether this could be nation-state activity. Rosen says attack was "complex" and leveraged three multiple bugs that interacted together. "We may never know" the identity of the hackers, Rosen adds. — Dustin Volz (@dnvolz) September 28, 2018 News of this security exploit comes just hours after a prominent Taiwanese hacker by the name of Chang Chi-yuan pledged to delete Zuckerberg’s personal page on Sunday as a way to demonstrate some type of security flaw in Facebook, Chang’s proficiency as a hacker, or both. It was not immediately clear whether the issue affecting Facebook’s View As feature is the one Chang intended to exploit, but the timing had some suspecting they could be related. Facebook said on the call with reporters today that the View As exploit does not have anything to do with Chang’s stunt, which he reportedly planned to stream on Facebook Live. Later on in the day, Chang backed down from his pledge, writing on his personal page that he “reported the bug to Facebook and I will show proof when I get bounty.” A more pressing concern for Facebook is the absence of a chief security officer, after former CSO Alex Stamos left the company last month. Following Stamos’ departure, Facebook said it would not be filling the CSO role and would instead restructure its security organization and embed specialists through its many divisions. A Facebook spokesperson said at the time that the company would “continue to evaluate what kind of structure works best” to protect users’ security. Following widespread news coverage of the exploit, Facebook users began reporting that the social network was blocking news links regarding the hack from The Associated Press and The Guardian, leading more cynical critics of the company to assume it was purposefully suppressing negative news about itself on its own platform. Facebook is preventing users from posting The Guardian's report on the Facebook data breach. Ouch. https://t.co/IGU685PjdK pic.twitter.com/GGGrKqBZEc — Jed Bracy (@JedBracy) September 28, 2018 Facebook later confirmed to The Verge that the stories were being shared so frequently that they tripped the company’s internal spam detection tools. “We fixed the issue as soon as we were made aware of it, and people should be able to share both articles,” the company said. “We apologize for the inconvenience.” Update 9/28, 6:22PM ET. Added comment from Facebook about blocking news links. Update 9/28, 5:22PM ET: Added information from a second call with reporters. Update 9/28, 1:35PM ET: Added information from Facebook’s call with reporters this afternoon.<doc-sep>
On Friday, Facebook announced that it had discovered evidence of a security breach affecting almost 50 million accounts. The company’s investigation is in its early stages, so there are still many unknowns about the cyberattack. Here’s a rundown of what we know so far based on the details that Facebook has released to the public. How did it happen? Hackers were able to manipulate the code associated with the platform’s “View As” feature, which lets users see what their profiles look like from the point of view of a different account. Vulnerabilities in this code allowed hackers to exploit three different bugs and steal access tokens, digital keys that let people use Facebook without having to enter their login credentials every time, from 50 million accounts. Developers introduced these vulnerabilities in July 2017 when they updated a tool that allows users to upload happy birthday videos. The uploading tool had been inadvertently generating access tokens when it showed up on a user’s “View As” page, which the hackers then exploited to breach accounts. Facebook’s security team began noticing an unusual spike in user access to the website this past December, and then they finally found the hack last Tuesday. What did the hackers have access to? The hackers were essentially able to log in and take over users’ accounts. Facebook claims there is no evidence thus far indicating that the hackers read private messages, posted anything to account pages, or stole credit card numbers. However, they did attempt to access personal information, which could have included details like name, gender, and hometown. The hackers may also have been able to manipulate the Facebook Login feature, which allows people to use their Facebook usernames and passwords as login credentials for other apps and websites. This means that the hackers could, theoretically, have breached apps like Instagram, Tinder, and Airbnb using the access tokens they stole. Tinder said Monday that there was “no evidence” accounts had been accessed, but that it would be “very helpful” if Facebook shared more information about the hack. Who was responsible for the hack? Facebook has released little info about the attackers. Company officials said on Friday that they had not uncovered many identifying details—for instance, they were unable to determine whether the hackers were working on behalf of a nation-state—and the nature of the attack is such that we may never actually know who was responsible. Carolyn Everson, Facebook’s vice president of global marketing, suggested on Monday that the hackers were fairly sophisticated since they went undetected for so long and had to have an intimate understanding of three different bugs to execute the attack. She compared them to an “odorless, weightless intruder that walked in.” What is Facebook doing about it? Facebook has patched the vulnerabilities in the “View As” and video upload tools. The company also reset the access tokens for the 50 million affected accounts, as well as for 40 million additional accounts as a precautionary measure. Users will also have to delink and relink their Instagram and Oculus accounts to their Facebook accounts. Facebook users do not need to change their passwords, but they may want to log out and back in to be safe. Facebook has also contacted the FBI, as well as the Irish Data Protection Commission, as is required under the European Union’s General Data Protection Regulation, or GDPR. Will there be any consequences for Facebook? Shortly after Facebook announced news of the breach on Friday, a Virginia resident and a California resident filed a class-action complaint alleging that the company’s lack of appropriate security measures had increased the risk of identity theft. New York State Attorney General Barbara Underwood tweeted, “We’re looking into Facebook’s massive data breach. New Yorkers deserve to know that their information will be protected.” The FTC and Virginia Sen. Mark Warner have further suggested that an investigation may be in order. Members of the U.K. Parliament are also renewing their demands for CEO Mark Zuckerberg to testify in front of them. Yet, according to the Verge, it’s the European Union that’s most likely to bring the hammer down on Facebook. Ireland’s Data Protection Commission, which helps to enforce the GDPR, is demanding more information from the company concerning the breach.