{"id":277671,"date":"2018-09-28T19:18:41","date_gmt":"2018-09-28T17:18:41","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=277671"},"modified":"2018-09-28T19:21:07","modified_gmt":"2018-09-28T17:21:07","slug":"facebook-hit-by-massive-hack-50-million-users-affected","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/277671-facebook-hit-by-massive-hack-50-million-users-affected.html","title":{"rendered":"Facebook hit by massive hack – 50 million users affected"},"content":{"rendered":"

Facebook has published a security update<\/strong><\/a> detailing how its systems have been compromised.<\/p>\n

Its engineering team discovered a security breach on Thursday which affects “almost 50 million accounts”.<\/p>\n

“Our investigation is still in its early stages. But it\u2019s clear that attackers exploited a vulnerability in Facebook\u2019s code that impacted View As,” said Facebook.<\/p>\n

“This allowed them to steal Facebook access tokens which they could then use to take over people\u2019s accounts.”<\/p>\n

Access tokens are the equivalent of digital keys, added Facebook.<\/p>\n

The company said it is taking the matter very seriously and has fixed the vulnerability. It has also notified the authorities.<\/p>\n

Affected accounts<\/h3>\n

“We have reset the access tokens of the almost 50 million accounts we know were affected to protect their security,” said Facebook.<\/p>\n

“We\u2019re also taking the precautionary step of resetting access tokens for another 40 million accounts that have been subject to a View As look-up in the last year.”<\/p>\n

This means that around 90 million accounts will be logged out of Facebook, and users will have to log back in. Apps that use Facebook will also be logged out. Users will not have to change their password, however.<\/p>\n

Facebook said it is also turning off View As for now.<\/p>\n

The attack follows a hacker declaring earlier today that he will broadcast a hack<\/strong> <\/a>on Facebook founder Mark Zuckerberg’s Facebook page on Sunday.<\/p>\n

Facebook’s full statement is below.<\/p>\n

\n

Facebook security statement<\/h3>\n

On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts. We\u2019re taking this incredibly seriously and wanted to let everyone know what\u2019s happened and the immediate action we\u2019ve taken to protect people\u2019s security.<\/p>\n

Our investigation is still in its early stages. But it\u2019s clear that attackers exploited a vulnerability in Facebook\u2019s code that impacted \u201cView As\u201d, a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people\u2019s accounts. Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they don\u2019t need to re-enter their password every time they use the app.<\/p>\n

Here is the action we have already taken. First, we\u2019ve fixed the vulnerability and informed law enforcement.<\/p>\n

Second, we have reset the access tokens of the almost 50 million accounts we know were affected to protect their security. We\u2019re also taking the precautionary step of resetting access tokens for another 40 million accounts that have been subject to a \u201cView As\u201d look-up in the last year. As a result, around 90 million people will now have to log back in to Facebook, or any of their apps that use Facebook Login. After they have logged back in, people will get a notification at the top of their News Feed explaining what happened.<\/p>\n

Third, we\u2019re temporarily turning off the \u201cView As\u201d feature while we conduct a thorough security review.<\/p>\n

This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017, which impacted \u201cView As.\u201d The attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens.<\/p>\n

Since we\u2019ve only just started our investigation, we have yet to determine whether these accounts were misused or any information accessed. We also don\u2019t know who\u2019s behind these attacks or where they\u2019re based. We\u2019re working hard to better understand these details \u2014 and we will update this post when we have more information, or if the facts change. In addition, if we find more affected accounts, we will immediately reset their access tokens.<\/p>\n

People\u2019s privacy and security is incredibly important, and we\u2019re sorry this happened. It\u2019s why we\u2019ve taken immediate action to secure these accounts and let users know what happened. There\u2019s no need for anyone to change their passwords. But people who are having trouble logging back into Facebook \u2014 for example because they\u2019ve forgotten their password \u2014 should visit our Help Center. And if anyone wants to take the precautionary action of logging out of Facebook, they should visit the \u201cSecurity and Login\u201d section in settings. It lists the places people are logged into Facebook with a one-click option to log out of them all.<\/p>\n

\n

Now read:\u00a0Tiberius Coin \u2013 a new token backed by seven metals<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

Facebook has been affected by an enormous hack.<\/p>\n","protected":false},"author":23,"featured_media":254201,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[26872,161,35],"class_list":["post-277671","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-data-breach","tag-facebook","tag-headline"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/277671"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=277671"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/277671\/revisions"}],"predecessor-version":[{"id":277673,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/277671\/revisions\/277673"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/254201"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=277671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=277671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=277671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}