Facebook says attack exposed info of 50 million users

(CNN Money) — An attack on Facebook discovered earlier this week exposed information on nearly 50 million of the social network’s users, the company announced Friday.

The attackers exploited a feature called “View as” that lets users see their Facebook page the way someone else would. The attackers could then potentially use it to take over the accounts and use them exactly as if they were the account holders.

Facebook said it does not know who the attackers were or where they were based. It also said it has already fixed the issue and informed the FBI and other law enforcement, as well as lawmakers and regulators. It has also informed the Irish Data Protection Commission about the breach, a step required by Europe’s GDPR regulations. The commission said it received the notification, but expressed concern with its timing and lack of detail.

More than 90 million users were forcibly logged out of their accounts by Facebook and had to log back in on Friday for security reasons. Users do not need to take any additional security precautions or reset their passwords, said Facebook. All logged out users will receive a notification about the issue from Facebook.

The company says it does not know if the affected accounts were misused in any way or if any user information was actually accessed. It has not determined if any specific locations or accounts were targeted. It has turned off the “View As” feature that the attackers exploited while it investigates.

Facebook says the vulnerability is the result of three distinct bugs, and originally appeared in July 2017 when the company made a change to a video uploading feature. The company first detected some unusual activity — a spike in user access to the site — on September 16, 2018. It launched an investigation and uncovered this attack on Tuesday of this week. On Wednesday it notified law enforcement and on Thursday evening it fixed the vulnerability and began resetting login tokens, according to Facebook.

The attackers stole Facebook “access tokens” which keep a person logged into their Facebook account over long periods of time so they don’t have to keep signing in. Facebook reset all 50 million tokens, as well as tokens for an additional 40 million people who had used the “View as” feature in the past year as a “precautionary step.”

“The reality here is we face constant attacks from people who want to take over accounts or steal information…. we need to do more to prevent this from happening in the first place,” CEO Mark Zuckerberg said during a call with reporters shortly after the announcement.

The announcement is the latest issue for the company, which has struggled with security breaches, privacy issues and misinformation in recent years. Facebook says it is investing heavily in security going forward, and increasing the number of people working on security from 10,000 to 20,000.

“Security is an arms race and we’re continuing to improve our defenses,” said Zuckerberg.

The-CNN-Wire
™ & © 2018 Cable News Network, Inc., a Time Warner Company. All rights reserved.