Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    Facebook Data Breach Extended to Third-Party Applications

    Written by

    Sean Michael Kerner
    Published October 1, 2018
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      It wasn’t one but at least three different bugs that enabled a data breach impacting 90 million Facebook users that was first reported on Sept 28.

      Facebook has revealed additional technical details about its data breach that involved unknown attackers somehow obtaining access tokens for Facebook users. In an initial advisory on the issue, Facebook explained that attackers abused the “View As” feature in the social networking platform to get the access tokens, but didn’t precisely detail how the flaw was triggered.

      “It was the combination of these three bugs that became a vulnerability: when using the View As feature to view your profile as a friend, the code did not remove the composer that lets people wish you happy birthday; the video uploader would generate an access token when it shouldn’t have; and when the access token was generated, it was not for you but the person being looked up,” Pedro Canahuati, Facebook vice president of Engineering, Security and Privacy, wrote in an updated advisory.

      As a result of the access token issue, Facebook forced 90 million of its users to log back into the social networking site on the morning of Sept. 28. The access tokens that were at risk in the attack keep users logged into the site, holding the user session. An access token is not the same as the username and password combination, which were not stolen in the attack and as such, users have not been asked to reset their passwords as a result of the breach.

      Initially, Facebook only revealed that the access tokens for facebook.com were at risk, but it turns out the same access tokens are used across other accounts that Facebook account credentials are used to log into. Canahuati explained that attackers were then able to pivot after gaining the initial access token to other accounts, performing the same actions and obtaining further access tokens.

      “This does mean they could have accessed other third-party apps that were using Facebook login,” Guy Rosen, vice president of product management at Facebook, said on a late Sept. 28 afternoon call with the press. “Now that we have reset all of those access tokens as part of protecting the security of people’s accounts, developers who used Facebook login will be able to detect that those access tokens have been reset, identify those users, and as a user, you will simply have to log in again into those third-party apps.”

      While Facebook has reset its access tokens, the social networking company doesn’t actually have any evidence that it has publicly presented that other third-party sites that use Facebook access credentials were in fact breached as well.

      “We are early in the investigation,” Nathaniel Gleicher, Facebook’s head of Cybersecurity Policy, said on the call. “Our first focus on this was to understand the full scope of users that could have been impacted and make sure that they were secure.”

      Attribution

      It’s also still not clear who was behind the attack, and Facebook isn’t making any sort of attribution yet. Gleicher commented that there are “sophisticated adversaries” out there. He also responded to a a media inquiry about an accusation made by a hacker that was planning on live streaming a hack of Facebook founder Mark Zuckerberg’s page. There had been some speculation that the hacker was directly related to the access token breach, though Gleicher denied that such a connection exists.

      “When you’re talking about the scope and scale of this type of investigation, we drove this very quickly,” he said. “And one of the things we found, actually, is that as we brought our security teams and our product teams closer together, it essentially allowed us to run an investigation like this as fast as we think we possibly could have.”

      Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

      Sean Michael Kerner
      Sean Michael Kerner
      Sean Michael Kerner is an Internet consultant, strategist, and writer for several leading IT business web sites.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×