Story image

Experts comment on Facebook’s 50 million user credential leak

01 Oct 2018

Earlier today, Facebook announced that a bug discovered on September 25 in their View As feature compromised the authentication tokens of almost 50 million users.

The data leak is one of the biggest security breaches at Facebook to date and could have far-reaching implications for Facebook users who have used its messaging service, Messenger, to communicate sensitive information.

Techday spoke to security experts who commented on the breach.

Barracuda Networks technology evangelist Greg Annette says, “Every new breach further proves that the public needs to preserve and protect their own cloud data because the providers are not.

“Free services like Facebook are even less likely to care about user data protection, so the public must take ownership in protecting and preserving data.

Annette says, “According to recent data, 78% of account takeover incidents result in a phishing email, with the goal of infecting additional accounts, via user impersonation. In order to protect themselves, the public should implement a few baseline proactive measures, including:

  • Back up data in a controlled environment. This will allow you to recover any deleted or compromised items.
  • Use unique passwords for all services, and where appropriate, use a password manager.
  • Enable multi-factor (MFA) or two-factor authentication (2FA) for any and all cloud-based accounts. While you should take personal steps to enable MFA and 2FA, you should also demand these authentication protocols from your vendor if they’re not automatically provided.

Darktrace Asia Pacific managing director Sanjay Aurora says, “While we may never understand the attacker’s motivations, it is important to realise that incentives are endless in this new era of cyber warfare.”

“In order to bypass Facebook’s security controls without raising alarm bells, this attack would have had to be complex, sophisticated, and stealthy. Complex attacks have many moving parts that often appear as individual, subtle anomalies hiding within the noise of the network.

“Attacks like this will only continue to threaten our organizations, and we have to assume that it will only get harder and harder to detect.  

"This is where technologies rooted in AI will be paramount. AI is capable of sifting through large amounts of data and lines of code to identify these subtle patterns, and what’s more, it is intelligent enough to determine how to contain the threat as it’s emerging in real time.

“We live our lives in a maze of interconnectivity, and the more we connect, the more risk we adopt into our lives and networks.

Sophos principal research scientist Chester Wisniewski says, “In something as big and complicated as Facebook, there are bound to be bugs.

“As with any social media platform, users should assume their information may be made public, through hacking or simply through accidental oversharing. This is why sensitive information should never be shared through these platforms. For now, logging out and back in is all that is necessary.

“The truly concerned should use this as a reminder and an opportunity to review all of their security and privacy settings on Facebook and all other social media platforms they share personal information with.”

RedLock cloud security VP Matt Chiodi says, “Facebook's recent “View As” vulnerability underscores the level of persistence on the part of attackers.

“If there’s a high enough value target, they will get in sooner or later. Facebook today employs over 10,000 cybersecurity professionals. No system or application is 100% secure.

“What's most intriguing is that despite a formal bug bounty program, the vulnerability has been present in Facebook code since July of 2017. It’s hard to believe that a vulnerability of this size would persist this long undetected.”

Forcepoint chief scientist Richard Ford says, “Facebook’s fast reaction time is a sign of the growing maturity around breach response that we’re starting to see as GDPR comes into effect.

“Understanding, if there was a pattern to the impacted accounts versus just random selection, is the difference between someone trying to hack the system for fun or a coordinated nation-state attack that compromises specific users to ultimately gain access to sensitive data.

“This breach illustrates a fundamental truth of the new digital economy: when I share my personal data with a company I am putting my trust in your ability to protect that data adequately.

“Users need to continually evaluate the type of data they share and the potential impact a breach of that data could cause, to become an active participant in protecting their own online identities.

“On the other side, companies need to avail themselves of proactive technologies such as behavioural analysis to hold up their end of the bargain.”

ESET researchers break down latest arsenal of the infamous Sednit group
At the end of August 2018, the Sednit group launched a spear-phishing email campaign, in which it distributed shortened URLs that delivered first-stage Zebrocy components.
Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Who's watching you? 
With privacy an increasing concern amongst the public, users should be more aware than ever of what personal data companies hold.
Fake apps on Google Play scamming users out of cryptocurrency
Fake cryptocurrency apps on Google Play have been discovered to be phishing and scamming users out of cryptocurrency, according to a new report from ESET.
Managing data to comply with privacy regulations - Micro Focus
It’s crucial for organisations to be able to access, understand, and accurately classify the data they have so they know how to treat it.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.