Facebook: Hackers Stole Details For 29 Million Users

Reuters reports:

Facebook Inc said on Friday attackers stole names and contact details of 29 million users in the mass security breach disclosed by the social media network late last month. The breach, Facebook’s worst ever, has exacerbated concerns among users, lawmakers and investors that the company is not doing enough to safeguard data, particularly in the wake of the Cambridge Analytica data scandal.

From Facebook’s corporate blog:

The attackers exploited a vulnerability in Facebook’s code that existed between July 2017 and September 2018. The vulnerability was the result of a complex interaction of three distinct software bugs and it impacted “View As,” a feature that lets people see what their own profile looks like to someone else.

It allowed attackers to steal Facebook access tokens, which they could then use to take over people’s accounts. Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app.

Here’s how we found the attack that exploited this vulnerability. We saw an unusual spike of activity that began on September 14, 2018, and we started an investigation. On September 25, we determined this was actually an attack and identified the vulnerability.

Within two days, we closed the vulnerability, stopped the attack, and secured people’s accounts by resetting the access tokens for people who were potentially exposed. As a precaution, we also turned off “View As.” We’re cooperating with the FBI, which is actively investigating and asked us not to discuss who may be behind this attack.