You didn't forget that Facebook owns Instagram, did you? That little fact is extra germane today following the news that at least 50 million Facebook users, and possibly 90 million, had their accounts accessed by hackers. And, it turns out, those users' Instagram accounts could have been compromised, too. Here's the key detail: You can log into your Instagram account with your Facebook account. And, if you used your affected Facebook account to log into your Instagram account, hackers would have been able to access that account as well. Image: screenshot / instagram To make matters worse, according to Krebs on Security, it's not just hacked individuals' Instagram accounts that were vulnerable. Potentially every third-party service that lets you log in with Facebook is vulnerable, too. Think Tinder, Uber, and so, so many others. Facebook's VP of product management Guy Rosen confirmed as much on an afternoon phone call with reporters. SEE ALSO: Some basic steps to protect your Facebook account after hack hits 50 million users Importantly, the company at present doesn't have any evidence that attackers actually gained access to Instagram accounts. But don't think everything is chill just yet. As Facebook repeatedly insisted both in its official statement and on the conference call, the investigation is still in its early stages. Meaning, there's still a lot about the hack that the company doesn't know. Fun, right?<doc-sep>Instagram has been hit by a mysterious spate of hacks stemming from Russia, leaving users permanently locked out of their accounts. After being locked out of their accounts, users report having their profile picture, username and bio changed. The accounts then remain dormant, awaiting whatever fate the hackers have planned for them. It is unclear why the hackers are breaking into the accounts. And the nature of the attack means people can't get their accounts back – even if they plead with Instagram. One user whose account was taken over earlier this month told The Independent that she has repeatedly reached out to Instagram's support but the account has still not been returned to her. 11 useful Instagram features you didn't know existed Show all 11 1 /11 11 useful Instagram features you didn't know existed 11 useful Instagram features you didn't know existed Hide and reorder filters Filters are a core part of Instagram, but there are so many available it can be easy to get lost. You can change the order in which they appear, and even hide the ones you never use, to speed up your photo-sharing process. On the filters page, scroll to the end, tap Manage, then drag and drop the ones you want to reorder, and un-check the ones you want to hide. 11 useful Instagram features you didn't know existed Never miss a post Instagram controversially ditched its reverse-chronological order feed for a new order determined by an algorithm, making it easy to completely miss some posts. To make sure you never miss a certain somebody’s updates, you can set up notification for them by visiting their profile, tapping the three dots in the top right-hand corner and selecting Turn On Post Notifications. 11 useful Instagram features you didn't know existed Eat less data If you’re worried about how much of your mobile data Instagram saps, you can limit it by sacrificing the speed at which the photos and videos in your feed load. Go to your profile, tap the three dots in the top right corner, open Cellular Data Use and choose Use Less Data. 11 useful Instagram features you didn't know existed See your Likes It’s easy to lose track of your friends’ old posts on Instagram, but if you know you Liked it, you’ll be able to track it down easily. Just go to your profile, hit the three dots at the top and select Posts You’ve Liked. You can also save posts in a folder only you can see by tapping the bookmark icon underneath it. Take a look at everything you’ve bookmarked by tapping the same icon that sits near the top of your profile. 11 useful Instagram features you didn't know existed Find relevant hashtags Everyone knows you can expand the reach of your posts by using a number of relevant hashtags, but what those are aren’t always glaringly obvious. You can easily find the right ones for you by typing a keyword into Instagram’s search bar, selecting a hashtag from the list and swiping along the Related row that appears at the top of the screen. 11 useful Instagram features you didn't know existed Clear your search history Whatever your reasons are, you can clear your recent searches by going to your profile, hitting the three dots in the top right and selecting Clear Search History. To go a step further and hide your Suggested searches too, go to the search page, tap and hold the account you want to hide, and choose Hide from the pop-up window. 11 useful Instagram features you didn't know existed Hide photos you’re tagged in Tagged photos on Instagram aren’t as prominent as they are on Facebook, but anyone can still browse through other people’s pictures of you by visiting your profile and tapping the photo of you icon. If you’re tagged in a picture you don’t want other people to see, go to your profile, hit the photos of you icon, tap the three dots at the top of the screen and choose Hide Photos. 11 useful Instagram features you didn't know existed Secure your account Make your Instagram account much harder to hack by enabling two-factor authentication, a security feature that protects you even if your login details are stolen. Go to your profile, tap the three dots, open Two-Factor Authentication and toggle it on. 11 useful Instagram features you didn't know existed Share lots at once If you want to upload a bunch of related pictures and videos without flooding everyone else’s feed, you can shared them all as one post. Hit the + icon, select Gallery, choose Select Multiple, pick out up to 10 of the pictures and clips you want, tap Next and reorder them by dragging and dropping. 11 useful Instagram features you didn't know existed Record hands-free Instagram Stories has been a massive hit since it came out last year, but you might not know that you can record Stories clips without having to hold one of your digits on the record key. On the Stores screen, just swipe through the options at the bottom until you get to Hands-Free. 11 useful Instagram features you didn't know existed Edit posts after publishing Most people know you can delete any of the images you’ve already posted, but not everyone is aware that you can also edit them. Instagram unfortunately doesn’t let you tinker with filters and effects, but you can change your original caption, tag people and update the location. "The problem is that my hacker has changed the email address associated with the account, locking me out. At the same time, I never received an email telling me that my email address or password had been changed, so I'm unable to recover my account," said Emma (who preferred her surname was not published), 26, from London said. "The 'support' service' I've received from Instagram has been shockingly poor. Attempts to block and report the account were ignored – instead I repeatedly received the same automated message telling me to change my password." People first began reporting the issue in August. But the widespread campaign is showing no sign of stopping, and there is still no clue about why hackers are gaining control of such a huge number accounts. An Instagram spokesperson told The Independent: "We are investigating claims of some hacked accounts and will take the necessary steps to help those impacted." For Emma, the reason behind her account being taken over remains a complete mystery. "The hackers have changed my account name to Zulugius Lydia," she said. "None of the photos have changed but they have weirdly changed the bio bit." The Facebook-owned firm claims that users will be notified of any change to the email address associated with an account, however Emma claimed this was not the case – an issue reported by dozens of other Instagram users across social media. Instagram first acknowledged the issue in August, issuing guidance to people who have difficulty accessing their accounts. Advice included strengthening passwords to improve security and revoking access to any "suspicious third-party apps". No specific definition was given for what these apps might look like. Since then, Instagram users have continued to report mysterious account takeovers. However, the advice does not appear to have stemmed the flow of attacks. Hackers are locking people out of their Instagram accounts, though their motives remain unclear (iStock/ Composite) Security experts have speculated that the hacked accounts could be being gathered to eventually spread spam and other online ads to the followers of the accounts. The lack of apparent action from Instagram means frustrated users may give up trying to take back control of their account and either quit Instagram or open a brand new account, warned privacy advocate Paul Bischoff. "Even if some victims regain control of their accounts, many of those affected have likely quit the platform or won't go through the trouble, adding soldiers to the spambot army," he said.<doc-sep>Facebook’s latest data breach doesn’t just affect the social network — but loads of other sites too. If you use Facebook to log into other services — like Instagram or Tinder — then Facebook hack attackers may have stolen all of your profile info, photos, private messages and more. On Friday evening, Facebook revealed that hackers were given access to 50 million accounts. This let them use your Facebook account “as if they were the account holder” — a shocking security breach. But because of the way the hack worked, it also gave attackers the same level of access to any accounts you use Facebook to log in with. So if you tied your Facebook to Messenger, Instagram, Spotify, Tinder or Airbnb, just to name a few, hackers will have been able to slip into those accounts too. It’s all thanks to a major screw-up in Facebook’s code. When you log into websites like Facebook, you are given an access token. Access tokens are like digital keys that remind the website — and other linked services — that you’re logged in. That’s why when you close the Facebook tab and open it up again later, you’re still logged in. If you have an access token, you don’t need to enter your username and password — because it means you’re already logged into the website. But last June, Facebook added a new video uploader tool that introduced a major bug. The bug allowed hackers to generate access tokens for absolutely anyone on the website. Unsurprisingly, hackers used this bug to create access tokens for 50 million users across the site. Importantly, if you log into other services with Facebook, this access token would treat you as being logged into those services too. So it doesn’t matter how strong your password was, or whether two-factor authentication was set up. The hack allowed attackers to convince these websites that they were already logged in — sneaking onto your account under the radar. The only way to actually avoid being caught up in this hack was to (1) not have a Facebook account, or (2) get lucky, and not be targeted by the hackers. The hackers were also given complete access (as if they were you, effectively), and so could have accessed any part of your accounts. “Because this issue impacted access tokens, it’s worth highlighting that these are the equivalent of a username and password combination but are used by applications to authenticate against other applications,” said Tim Mackey, senior technical evangelist at Synopsys. “If you’ve ever used a Facebook login button on a website, now would be an excellent time for Facebook users to review their App Settings to see which applications and games they’ve granted access rights to within Facebook.” The big fear is that hackers will have used automatic tools to harvest information from all 50 million accounts that were compromised. This means it’s possible that hackers are currently sitting on photos, videos, and private messages for tens of millions of people around the world. This data pool grows significantly when you add services like Tinder or Instagram into the mix. And even if you weren’t hacked yourself, messages you sent to people who were hacked may still be caught up in the hack. This significantly increases the risk of identity fraud, blackmail, and even lost relationships. If you’ve ever sent racy photos, made mean comments, or moaned about an employer on your Facebook — or in private messages — hackers may be ready and waiting to release this information right now. Hackers could also use the information they stole to defraud you, potentially gaining access to your bank accounts or other important services. “Today, consumers should be working under the assumption that their private information has been stolen by hackers 10 times over,” said Sam Curry, chief security officer at Cybereason. “Today, consumers are reminded again to watch their identities and credit for abuse.” “As an industry until we can start making cybercrime unprofitable for adversaries, they will continue to hold the cards that will yield potentially massive payouts.” If you were hacked, you’ll have been logged out and received notification.<doc-sep>
Even if you never log into Facebook itself these days, the other apps and services you use might be impacted by Facebook’s latest big, bad news. In a follow-up call on Friday’s revelation that Facebook has suffered a security breach affecting at least 50 million accounts, the company clarified that Instagram users were not out of the woods — nor were any other third-party services that utilized Facebook Login. Facebook Login is the tool that allows users to sign in with a Facebook account instead of traditional login credentials and many users choose it as a convenient way to sign into a variety of apps and services. Third-party apps and sites affected too Due to the nature of the hack, Facebook cannot rule out the fact that attackers may have also accessed any Instagram account linked to an affected Facebook account through Facebook Login. Still, it’s worth remembering that while Facebook can’t rule it out, the company has no evidence (yet) of this kind of activity. “So the vulnerability was on Facebook, but these access tokens enable someone to use [a connected account] as if they were the account holder themselves — this does mean they could have access other third party apps that were using Facebook login,” Facebook Vice President of Product Management Guy Rosen explained on the call. “Now that we have reset all of those access tokens as part of protecting the security of people’s accounts, developers who use Facebook login will be able to detect that those access tokens has been reset, identify those users and as a user, you will simply have to log in again into those third party apps.” Rosen reiterated that there is plenty Facebook does not know about the hack, including the extent to which attackers manipulated the three security bugs in question to obtain access to external accounts through Facebook Login. “The vulnerability was on Facebook itself and we’ve yet to determine, given the investigation is really early, [what was] the exact nature of misuse and whether there was any access to Instagram accounts, for example,” Rosen said. Anyone with a Facebook account affected by the breach — you should have been automatically logged out and will receive a notification — will need to unlink and relink their Instagram account to Facebook in order to continue cross-posting content to Facebook. How to relink your Facebook account and do a security check To do relink your Instagram account to Facebook, if you choose to, open Instagram Settings > Linked Accounts and select the checkbox next to Facebook. Click Unlink and confirm your selection. If you’d like to reconnect Instagram with Facebook, you’ll need to select Facebook in the Linked Accounts menu and login with your credentials like normal. If you know your Facebook account was affected by the breach, it’s wise to check for suspicious activity on your account. You can do this on Facebook through the Security and Login menu. There, you’ll want to browse the activity listed to make sure you don’t see anything that doesn’t look like you — logins from other countries, for example. If you’re concerned or just want to play it safe, you can always find the link to “Log Out Of All Sessions” by scrolling toward the bottom of the page. While we know a little bit more now about Facebook’s biggest security breach to date, there’s still a lot that we don’t. Expect plenty of additional information in the coming days and weeks as Facebook surveys the damage and passes that information along to its users. We’ll do the same.