Today’s topics include a Facebook access token data breach affecting 90 million users, and Oracle launching Java 11 with improved security and performance.
Facebook has revealed additional technical details about its data breach first reported on Sept. 28 that involved unknown attackers somehow obtaining access tokens for Facebook users.
According to Pedro Canahuati, Facebook vice president of Engineering, Security and Privacy, “It was the combination of … three bugs that became a vulnerability: when using the View As feature to view your profile as a friend, the code did not remove the composer that lets people wish you happy birthday; the video uploader would generate an access token when it shouldn’t have; and when the access token was generated, it was not for you but the person being looked up.”
As a result of the access token issue, Facebook forced 90 million of its users to log back into the social networking site on the morning of Sept. 28. It’s unclear who was behind the attack, and Facebook isn’t making any sort of attribution yet.
Oracle released Java 11 on Sept. 25, providing users of the widely deployed programming language with 17 new features, including performance, scalability and security improvements.
Java 11 follows the Java 10 release, which became generally available in March. Unlike Java 10, however, Java 11 has been designated by Oracle as a Long Term Support release and will be supported until 2026.
Among the new features in Java 11 is JEP 332, which brings Transport Layer Security 1.3 support to Java. Security is also getting a boost with JEP 329, which brings ChaCha20 and Poly1305 Cryptographic Algorithms to Java, as well as JEP 324: Key Agreement with Curve25519 and Curve448. Java 11 also introduces a new approach to enable loading of single-file source code programs.