Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    Facebook Data Breach Extended to Third-Party Applications

    By
    Sean Michael Kerner
    -
    October 1, 2018
    Share
    Facebook
    Twitter
    Linkedin
      Facebook data breach

      It wasn’t one but at least three different bugs that enabled a data breach impacting 90 million Facebook users that was first reported on Sept 28.

      Facebook has revealed additional technical details about its data breach that involved unknown attackers somehow obtaining access tokens for Facebook users. In an initial advisory on the issue, Facebook explained that attackers abused the “View As” feature in the social networking platform to get the access tokens, but didn’t precisely detail how the flaw was triggered.

      “It was the combination of these three bugs that became a vulnerability: when using the View As feature to view your profile as a friend, the code did not remove the composer that lets people wish you happy birthday; the video uploader would generate an access token when it shouldn’t have; and when the access token was generated, it was not for you but the person being looked up,” Pedro Canahuati, Facebook vice president of Engineering, Security and Privacy, wrote in an updated advisory.

      As a result of the access token issue, Facebook forced 90 million of its users to log back into the social networking site on the morning of Sept. 28. The access tokens that were at risk in the attack keep users logged into the site, holding the user session. An access token is not the same as the username and password combination, which were not stolen in the attack and as such, users have not been asked to reset their passwords as a result of the breach.

      Initially, Facebook only revealed that the access tokens for facebook.com were at risk, but it turns out the same access tokens are used across other accounts that Facebook account credentials are used to log into. Canahuati explained that attackers were then able to pivot after gaining the initial access token to other accounts, performing the same actions and obtaining further access tokens.

      “This does mean they could have accessed other third-party apps that were using Facebook login,” Guy Rosen, vice president of product management at Facebook, said on a late Sept. 28 afternoon call with the press. “Now that we have reset all of those access tokens as part of protecting the security of people’s accounts, developers who used Facebook login will be able to detect that those access tokens have been reset, identify those users, and as a user, you will simply have to log in again into those third-party apps.”

      While Facebook has reset its access tokens, the social networking company doesn’t actually have any evidence that it has publicly presented that other third-party sites that use Facebook access credentials were in fact breached as well.

      “We are early in the investigation,” Nathaniel Gleicher, Facebook’s head of Cybersecurity Policy, said on the call. “Our first focus on this was to understand the full scope of users that could have been impacted and make sure that they were secure.”

      Attribution

      It’s also still not clear who was behind the attack, and Facebook isn’t making any sort of attribution yet. Gleicher commented that there are “sophisticated adversaries” out there. He also responded to a a media inquiry about an accusation made by a hacker that was planning on live streaming a hack of Facebook founder Mark Zuckerberg’s page. There had been some speculation that the hacker was directly related to the access token breach, though Gleicher denied that such a connection exists.

      “When you’re talking about the scope and scale of this type of investigation, we drove this very quickly,” he said. “And one of the things we found, actually, is that as we brought our security teams and our product teams closer together, it essentially allowed us to run an investigation like this as fast as we think we possibly could have.”

      Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

      Sean Michael Kerner
      Sean Michael Kerner is an Internet consultant, strategist, and contributor to several leading IT business web sites.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×