Facebook on alert after 50 million accounts exposed
Facebook engineers found a security flaw that exposed almost 50 million accounts after attackers abused the View As feature.
Last Tuesday, Facebook engineers discovered a problem. By the end of this week, everyone knew how serious the matter was. According to the official announcement, a security flaw affected almost 50 million accounts, which were exposed by the attackers.
The hackers, the technology giant says, exposed the “View As” feature. For anyone who has never used it, this function lets you see your own profile as any other user would (the public, or a specific friend). That way, you can understand how other people see your page. What the US company's security team realised was that this serious breach allowed attackers to steal tokens. It was also in this way that Yahoo! was attacked on a massive scale, with an impact on more than a billion users.
What are access tokens?
Zuckerberg's company describes them this way: they are the equivalent of digital keys, which keep people connected, with the login done, so they do not have to re-enter the password every time they use the app. Is it convenient? Of course it is. If someone steals your entry key, however, the convenience becomes the hacker's. Whoever has that token has full access and control over the account. These attackers effectively stole tens of thousands of passes.
In this case, the keys may have given the hackers more than access to Facebook. If you logged in to another site using the social network, that account may have been compromised too. The platform's spokesperson reported that the company invalidated access to data from external applications for the affected users, to prevent an unauthorised entry.
What you expect from a technology platform of Facebook's scale is that it knows how to handle a security flaw of this nature properly, and so far that seems to have happened: the world's largest social network was very quick to notify the public of the incident, and in just three days it discovered the problem and took precautions.
Immediately, the company also reset the 50 million accounts affected by the password theft (the equivalent of changing the locks to make the previous key unusable). And, besides that, 40 million other tokens linked to accounts that had used the “View As” tool in the last year were also cleared.
There is no doubt that 50 million people is a great many. But as a percentage of Facebook's total number of users, this figure is small. In the second quarter of 2018, the data indicated about 2.3 billion people with an active profile.
There is still another reason that makes this matter so alarming. When someone discovers and exposes a flaw in Facebook's code, no matter the size, it has the potential to reach millions and millions of people.
The timing of the announcement also raised a few eyebrows. In the early hours of this Friday, news started circulating that a white hat hacker (an ethical attacker, a security specialist who usually runs penetration tests on systems to prevent them) from Thailand said he was going to delete Mark Zuckerberg's own account. He had even planned to livestream everything he was going to do. Then, around three in the morning in the United States, the attacker cancelled his plans.
Facebook did not mention any link between the problem detected and these statements, but the truth is that the timing is, at the very least, suspicious.
The company continues to investigate what actually happened. It is still not certain that any data was accessed improperly or that there were unauthorised actions on any of the accounts hit.
