Story image

Experts comment on Facebook’s 50 million user credential leak

01 Oct 2018

Earlier today, Facebook announced that a bug discovered on September 25 in their View As feature compromised the authentication tokens of almost 50 million users.

The data leak is one of the biggest security breaches at Facebook to date and could have far-reaching implications for Facebook users who have used its messaging service, Messenger, to communicate sensitive information.

Techday spoke to security experts who commented on the breach.

Barracuda Networks technology evangelist Greg Annette says, “Every new breach further proves that the public needs to preserve and protect their own cloud data because the providers are not.

“Free services like Facebook are even less likely to care about user data protection, so the public must take ownership in protecting and preserving data.

Annette says, “According to recent data, 78% of account takeover incidents result in a phishing email, with the goal of infecting additional accounts, via user impersonation. In order to protect themselves, the public should implement a few baseline proactive measures, including:

  • Back up data in a controlled environment. This will allow you to recover any deleted or compromised items.
  • Use unique passwords for all services, and where appropriate, use a password manager.
  • Enable multi-factor (MFA) or two-factor authentication (2FA) for any and all cloud-based accounts. While you should take personal steps to enable MFA and 2FA, you should also demand these authentication protocols from your vendor if they’re not automatically provided.

Darktrace Asia Pacific managing director Sanjay Aurora says, “While we may never understand the attacker’s motivations, it is important to realise that incentives are endless in this new era of cyber warfare.”

“In order to bypass Facebook’s security controls without raising alarm bells, this attack would have had to be complex, sophisticated, and stealthy. Complex attacks have many moving parts that often appear as individual, subtle anomalies hiding within the noise of the network.

“Attacks like this will only continue to threaten our organizations, and we have to assume that it will only get harder and harder to detect.  

"This is where technologies rooted in AI will be paramount. AI is capable of sifting through large amounts of data and lines of code to identify these subtle patterns, and what’s more, it is intelligent enough to determine how to contain the threat as it’s emerging in real time.

“We live our lives in a maze of interconnectivity, and the more we connect, the more risk we adopt into our lives and networks.

Sophos principal research scientist Chester Wisniewski says, “In something as big and complicated as Facebook, there are bound to be bugs.

“As with any social media platform, users should assume their information may be made public, through hacking or simply through accidental oversharing. This is why sensitive information should never be shared through these platforms. For now, logging out and back in is all that is necessary.

“The truly concerned should use this as a reminder and an opportunity to review all of their security and privacy settings on Facebook and all other social media platforms they share personal information with.”

RedLock cloud security VP Matt Chiodi says, “Facebook's recent “View As” vulnerability underscores the level of persistence on the part of attackers.

“If there’s a high enough value target, they will get in sooner or later. Facebook today employs over 10,000 cybersecurity professionals. No system or application is 100% secure.

“What's most intriguing is that despite a formal bug bounty program, the vulnerability has been present in Facebook code since July of 2017. It’s hard to believe that a vulnerability of this size would persist this long undetected.”

Forcepoint chief scientist Richard Ford says, “Facebook’s fast reaction time is a sign of the growing maturity around breach response that we’re starting to see as GDPR comes into effect.

“Understanding, if there was a pattern to the impacted accounts versus just random selection, is the difference between someone trying to hack the system for fun or a coordinated nation-state attack that compromises specific users to ultimately gain access to sensitive data.

“This breach illustrates a fundamental truth of the new digital economy: when I share my personal data with a company I am putting my trust in your ability to protect that data adequately.

“Users need to continually evaluate the type of data they share and the potential impact a breach of that data could cause, to become an active participant in protecting their own online identities.

“On the other side, companies need to avail themselves of proactive technologies such as behavioural analysis to hold up their end of the bargain.”

Industrial control component vulnerabilities up 30%
Positive Technologies says exploitation of these vulnerabilities could disturb operations by disrupting command transfer between components.
McAfee announces Google Cloud Platform support
McAfee MVISION Cloud now integrates with GCP Cloud SCC to help security professionals gain visibility and control over their cloud resources.
Why AI and behaviour analytics should be essential to enterprises
Cyber threats continue to increase in number and severity, prompting cybersecurity experts to seek new ways to stop malicious actors.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
Organisations not testing incident response plans – IBM Security
Failure to test can leave organisations less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.
65% of manufacturers run outdated operating systems – Trend Micro
The report highlights the unique triple threat facing manufacturing, including the risks associated with IT, OT and IP.