"There simply might be no suitable trace or intelligence allowing investigators to connect the dots." A widespread Russian disinformation campaign leveraged the platform unnoticed, followed by revelations that third-party companies like Cambridge Analytica had collected user data without their knowledge. The vulnerability couldn’t have come at a worse time for Facebook, whose executives are still reeling from a series of scandals that unfolded in the wake of the 2016 US presidential election. “It’s easy to say that security testing should have caught this, but these types of security vulnerabilities can be extremely difficult to spot or catch since they rely on having to dynamically test the site itself as it’s running,” says David Kennedy, the CEO of the cybersecurity firm TrustedSec. Facebook has temporarily turned off "View As," as it continues to investigate the issue. That also explains Friday morning's logouts they served to reset the access tokens of both those directly affected and any additional accounts “that have been subject to a View As look-up” in the last year, Rosen said. “This is a complex interaction of multiple bugs,” Rosen said, adding that the hackers likely required some level of sophistication.
Later Friday, Facebook also confirmed that third-party sites that those users logged into with their Facebook accounts could also be affected. As part of that fix, Facebook automatically logged out 90 million Facebook users from their accounts Friday morning, accounting both for the 50 million that Facebook knows were affected, and an additional 40 million that potentially could have been. The company says that the attackers could see everything in a victim's profile, although it's still unclear if that includes private messages or if any of that data was misused.
The bugs that enabled the attack have since been patched, according to Facebook. Unlike the Cambridge Analytica scandal, in which a third-party company erroneously accessed data that a then-legitimate quiz app had siphoned up, this vulnerability allowed attackers to directly take over user accounts. Facebook’s privacy problems severely escalated Friday when the social network disclosed that an unprecedented security issue, discovered September 25, impacted almost 50 million user accounts.
0 kommentar(er)
