It wasn’t one but at least three different bugs that enabled a data breach impacting 90 million Facebook users that was first reported on Sept 28.
Facebook has revealed additional technical details about its data breach that involved unknown attackers somehow obtaining access tokens for Facebook users. In an initial advisory on the issue, Facebook explained that attackers abused the “View As” feature in the social networking platform to get the access tokens, but didn’t precisely detail how the flaw was triggered.
“It was the combination of these three bugs that became a vulnerability: when using the View As feature to view your profile as a friend, the code did not remove the composer that lets people wish you happy birthday; the video uploader would generate an access token when it shouldn’t have; and when the access token was generated, it was not for you but the person being looked up,” Pedro Canahuati, Facebook vice president of Engineering, Security and Privacy, wrote in an updated advisory.
As a result of the access token issue, Facebook forced 90 million of its users to log back into the social networking site on the morning of Sept. 28. The access tokens that were at risk in the attack keep users logged into the site, holding the user session. An access token is not the same as the username and password combination, which were not stolen in the attack and as such, users have not been asked to reset their passwords as a result of the breach.
Initially, Facebook only revealed that the access tokens for facebook.com were at risk, but it turns out the same access tokens are used across other accounts that Facebook account credentials are used to log into. Canahuati explained that attackers were then able to pivot after gaining the initial access token to other accounts, performing the same actions and obtaining further access tokens.
“This does mean they could have accessed other third-party apps that were using Facebook login,” Guy Rosen, vice president of product management at Facebook, said on a late Sept. 28 afternoon call with the press. “Now that we have reset all of those access tokens as part of protecting the security of people’s accounts, developers who used Facebook login will be able to detect that those access tokens have been reset, identify those users, and as a user, you will simply have to log in again into those third-party apps.”
While Facebook has reset its access tokens, the social networking company doesn’t actually have any evidence that it has publicly presented that other third-party sites that use Facebook access credentials were in fact breached as well.
“We are early in the investigation,” Nathaniel Gleicher, Facebook’s head of Cybersecurity Policy, said on the call. “Our first focus on this was to understand the full scope of users that could have been impacted and make sure that they were secure.”
Attribution
It’s also still not clear who was behind the attack, and Facebook isn’t making any sort of attribution yet. Gleicher commented that there are “sophisticated adversaries” out there. He also responded to a a media inquiry about an accusation made by a hacker that was planning on live streaming a hack of Facebook founder Mark Zuckerberg’s page. There had been some speculation that the hacker was directly related to the access token breach, though Gleicher denied that such a connection exists.
“When you’re talking about the scope and scale of this type of investigation, we drove this very quickly,” he said. “And one of the things we found, actually, is that as we brought our security teams and our product teams closer together, it essentially allowed us to run an investigation like this as fast as we think we possibly could have.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.