Pierluigi Paganini
October 01, 2018
Last week, Facebook announced that attackers exploited a vulnerability in the “View As” feature that allowed them to steal Facebook access tokens of 50 Million Users.
The “View As” feature allows users to see how others see their profile, it was implemented under the privacy section to help users to check that only intended data is visible for their public profile.
Facebook noticed a traffic spike on September 16 but determined that is was under attack on September 25, when it also discovered the way attackers breached the platform. The incident was disclosed on September 27.
Facebook disabled the “View As” feature in response to the incident, the company reset the security tokens for the 50 million impacted accounts, and as a precautionary measure, reset them for other 40 million accounts.
Attackers also accessed data of the Facebook founder Mark Zuckerberg and the COO Sheryl Sandberg. Facebook is notifying users whose tokens have been compromised.
According to Facebook, the vulnerability is the result of the chaining of three flaws affecting the “View As” feature and the Facebook’s video uploader.
The company clarified that the version of the video uploader interface affected by the vulnerability was introduced in July 2017.
It is interesting to note that an attacker would first hack into a friends’ account and move target other accounts connected to it.
“It was the combination of these three bugs that became a vulnerability: when using the View As feature to view your profile as a friend, the code did not remove the composer that lets people wish you happy birthday; the video uploader would generate an access token when it shouldn’t have; and when the access token was generated, it was not for you but the person being looked up. That access token was then available in the HTML of the page, which the attackers were able to extract and exploit to log in as another user.” explained Guy Rosen, VP of Product Management.
“The attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens.”
“The attackers were then able to pivot from that access token to other accounts, performing the same actions and obtaining further access tokens.” added edro Canahuati, VP of Engineering, Security and Privacy at Facebook.
According to Facebook, the attackers queried the APIs to access profile information, but no private information (private messages or credit card data) seems to have been accessed.
Another aspect that was underestimated is that the exposed tokens can be used to access third-party apps that allow the authentication using Facebook profile. The token reset also mitigated this risk.
Experts also warn that users who have linked Facebook to an Instagram account will need to unlink and re-link their accounts due to the reset of the tokens.
Based on the info shared by Facebook, the attack was probably carried out by advanced attackers.
In the next weeks, we will a clear picture of the impact of the hack on the company, the company could face $1.63 billion EU fine under EU GDPR.
Rumors of a class action lawsuit are circulating online.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Facebook hack, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
