Another security issue at Facebook!

The hacking of Facebook announced Tuesday 25 September 2018 and the consumer data breach that resulted is yet another testament to the technical and management difficulties confronting this social media platform. By this, I am not in any way suggesting that it is an easy task securing platforms, as this requires non-ending concerted efforts, as […]

The hacking of Facebook announced Tuesday 25 September 2018 and the consumer data breach that resulted is yet another testament to the technical and management difficulties confronting this social media platform. By this, I am not in any way suggesting that it is an easy task securing platforms, as this requires non-ending concerted efforts, as long as updates and upgrades are made, which they must for a software company to survive.

So what happened? Basically, nearly 50 million Facebook accounts were confirmed to have been compromised by an attack that gave hackers the ability to take over users’ accounts. An additional 40 million accounts are also suspected to have been hacked; so a total of 90 million customers were notified and asked to log out of their accounts and required to log back in. Obviously, I wouldn’t be surprised if the actual number of affected accounts is an order of magnitude greater than that reported, knowing how some companies spin stuff. For example, it’s reported that Facebook tried to prevent users from sharing the news of the hack, by flagging articles on the issue as spam: “We removed this post because it looked like spam to us,” says Facebook’s notice. Meanwhile, Facebook attributes the occurrence of this notice to some software glitch in its system!

The security breach is reportedly the largest in Facebook’s history. It is also severe because the attackers stole what are called “access tokens,” which are a kind of security key that allows you to stay logged into Facebook over multiple browsing sessions without entering your password every time. A token allows an attacker to take full control of your account, including logging into any of the thousands of third-party applications that use Facebook Login. Facebook says that the attacker exploited three bugs that were introduced into the site’s “View As” feature in July 2017. This feature allows you to see what your profile looks like to other users. A few important details of the breach have not been made public by Facebook. Details such as who the attackers are – individuals or state-sponsored – or what the victims share in common, have not been provided to the public.

The effects of hacking can be real. Breaches violate our privacy, and the hackers presently in question have reportedly tried to harvest your private information, including your name, sex and hometown, from Facebook’s systems. The thousands of companies that allow you to log into their system via Facebook Login are obviously quite nervous right now, as the tokens stolen by the hackers enable them to log into those third-party systems. Furthermore, breaches create enormous risks for a country’s economy and national security. Moreover, information obtained from hacking can easily be used to affect election results all over the world. The midterm elections in the US will take place in about 30 days, while Facebook has reportedly already dealt with a number of incidents believed to be connected to the elections in Mexico, Brazil and other countries.

Facebook itself suffers when the platform is attacked. Besides the negative public relation problem, the company gets called in for serious questioning by government regulators when users’ data in the company’s platform are compromised. For example, Facebook is reportedly now cooperating with the Irish Data Protection Commission to determine, on behalf of the European Union (EU), whether any of the provisions of the EU’s General Data Protection Regulation (GDPR) has been violated as a result of the breach. Facebook will be tried in order to determine whether or not it did enough to protect EU users’ data, or face a fine of 20 million euros ($23 million) or 4% of Facebook’s global annual revenue for 2017 – whichever is higher. This amount will approximately be equal to $1.6 billion, in the case of Facebook. (Note that Facebook’s EU headquarters is located in Ireland.)

What should you do if you use Facebook? For this particular incidence, Facebook says you do not have to do anything (other than logging out and then logging back in): Facebook has “taken care of it!” However, I would suggest you should always take precautionary measures at all time, no matter what anyone tells you. I would discourage the use of the “stay logged-in” feature of some applications. Also, check the devices into which you are currently logged – the Security Login tabs under Settings in Facebook will tell you – to determine if some unfamiliar gadget/device has logged into your account. You should be able to click the “Remove” button to get rid of such devices. You should also change your passwords regularly. Make your passwords very complicated: at least 12 characters including texts, numbers, lower-case, upper-case, special symbols, and so on. Desist from using the same password on more than one account. You could also turn-on the two-factor authentication, if you don’t mind the headache. Of course, you could delete your Facebook account and spend the time on more useful and profitable endeavors. You also need to prepare for the next hacking of Facebook or of any important platform that you use.