San Francisco: Facebook boss Mark Zuckerberg has described the security breach that affected a potential 90 million users as “really serious", as the social network grapples with yet another piece of bad news in a difficult year for the company's reputation.
Zuckerberg's own account was affected along with that of Chief Operating Officer Sheryl Sandberg, a spokeswoman said.
The company said on Friday that hackers had stolen digital tokens allowing them to take over nearly 50 million user accounts in its worst security breach ever given the unprecedented level of potential access.
Some Australian users have told AAP they had been among those forced to log back into the network and had received a breach notification in their news feed.
A Facebook spokeswoman said it was too early to offer information on how many people in Australia were affected.
Facebook, which has more than 2.2 billion monthly users, said it has yet to determine whether the attacker misused any accounts or stole private information. It also has not identified the attacker’s location or whether specific victims were targeted. Its initial review suggests the attack was broad in nature.
Facebook made headlines earlier this year after profile details from 87 million users was improperly accessed by political data firm Cambridge Analytica. The disclosure has prompted government inquiries into the company's privacy practices across the world, and fuelled a "#deleteFacebook" social movement among consumers.
Zuckerberg Posted:
I want to update you on an important security issue we've identified. We patched the issue last night and are taking precautionary measures for those who might have been affected. We're still investigating, but I want to share what we've already found:On Tuesday, we discovered that an attacker exploited a technical vulnerability to steal access tokens that would allow them to log into about 50 million people's accounts on Facebook.
We do not yet know whether these accounts were misused but we are continuing to look into this and will update when we learn more.
We've already taken a number of steps to address this issue:
1. We patched the security vulnerability to prevent this attacker or any other from being able to steal additional access tokens. And we invalidated the access tokens for the accounts of the 50 million people who were affected – causing them to be logged out. These people will have to log back in to access their accounts again. We will also notify these people in a message on top of their News Feed about what happened when they log back in.
2. As a precautionary measure, even though we believe we've fixed the issue, we're temporarily taking down the feature that had the security vulnerability until we can fully investigate it and make sure there are no other security issues with it. The feature is called "View As" and it's a privacy tool to let you see how your own profile would look to other people.
3. As an additional precautionary measure, we're also logging out everyone who used the View As feature since the vulnerability was introduced. This will require another 40 million people or more to log back into their accounts. We do not currently have any evidence that suggests these accounts have been compromised, but we're taking this step as a precautionary measure.
We face constant attacks from people who want to take over accounts or steal information around the world. While I'm glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place. If you've forgotten your password or are having trouble logging in, you can access your account through the Help Center.
There’s more detail in Guy’s post below, and we’ll update you as our investigation continues.
https://newsroom.fb.com/news/2018/09/security-update/
Zuckerberg's own account was affected along with that of Chief Operating Officer Sheryl Sandberg, a spokeswoman said.
The company said on Friday that hackers had stolen digital tokens allowing them to take over nearly 50 million user accounts in its worst security breach ever given the unprecedented level of potential access.
Some Australian users have told AAP they had been among those forced to log back into the network and had received a breach notification in their news feed.
A Facebook spokeswoman said it was too early to offer information on how many people in Australia were affected.
Facebook, which has more than 2.2 billion monthly users, said it has yet to determine whether the attacker misused any accounts or stole private information. It also has not identified the attacker’s location or whether specific victims were targeted. Its initial review suggests the attack was broad in nature.
Facebook made headlines earlier this year after profile details from 87 million users was improperly accessed by political data firm Cambridge Analytica. The disclosure has prompted government inquiries into the company's privacy practices across the world, and fuelled a "#deleteFacebook" social movement among consumers.
Zuckerberg Posted:
I want to update you on an important security issue we've identified. We patched the issue last night and are taking precautionary measures for those who might have been affected. We're still investigating, but I want to share what we've already found:On Tuesday, we discovered that an attacker exploited a technical vulnerability to steal access tokens that would allow them to log into about 50 million people's accounts on Facebook.
We do not yet know whether these accounts were misused but we are continuing to look into this and will update when we learn more.
We've already taken a number of steps to address this issue:
1. We patched the security vulnerability to prevent this attacker or any other from being able to steal additional access tokens. And we invalidated the access tokens for the accounts of the 50 million people who were affected – causing them to be logged out. These people will have to log back in to access their accounts again. We will also notify these people in a message on top of their News Feed about what happened when they log back in.
2. As a precautionary measure, even though we believe we've fixed the issue, we're temporarily taking down the feature that had the security vulnerability until we can fully investigate it and make sure there are no other security issues with it. The feature is called "View As" and it's a privacy tool to let you see how your own profile would look to other people.
3. As an additional precautionary measure, we're also logging out everyone who used the View As feature since the vulnerability was introduced. This will require another 40 million people or more to log back into their accounts. We do not currently have any evidence that suggests these accounts have been compromised, but we're taking this step as a precautionary measure.
We face constant attacks from people who want to take over accounts or steal information around the world. While I'm glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place. If you've forgotten your password or are having trouble logging in, you can access your account through the Help Center.
There’s more detail in Guy’s post below, and we’ll update you as our investigation continues.
https://newsroom.fb.com/news/2018/09/security-update/
- Featured Thumbs
- https://i.imgur.com/nm0BIog.jpg
Last edited by a moderator:
