{"id":15643,"date":"2018-09-29T09:44:41","date_gmt":"2018-09-29T13:44:41","guid":{"rendered":"http:\/\/www.thundercloud.net\/infoave\/new\/?p=15643"},"modified":"2018-09-29T18:27:24","modified_gmt":"2018-09-29T22:27:24","slug":"facebook-was-hacked-heres-the-official-word","status":"publish","type":"post","link":"https:\/\/www.thundercloud.net\/infoave\/new\/facebook-was-hacked-heres-the-official-word\/","title":{"rendered":"Facebook Was Hacked: Here’s the Official Word"},"content":{"rendered":"

Facebook Was Hacked: Here’s the Official Word<\/span><\/h1>\n

If you have a Facebook account, please read the following from the Facebook Newsroom.\u00a0 We recommend that you change your Facebook as soon as possible. Make sure you use a strong password. For some ideas on how to make strong passwords that are easy to remember, see our article here<\/a>.<\/span><\/span><\/p>\n

Related reading:<\/strong><\/em><\/span><\/p>\n

“Why Should Users Trust Facebook…<\/span>”\u00a0<\/a><\/em><\/span><\/p>\n

“Another Day, Another Facebook Problem<\/a>“<\/em><\/span><\/p>\n

Here is the “official” word from the Facebook Newsroom<\/span><\/a>:<\/span><\/p>\n

Originally published on September 28, 2018 at 9:41AM PT<\/strong><\/em><\/span><\/p>\n

Security Update<\/span><\/h2>\n

By\u00a0Guy Rosen<\/a>,\u00a0<\/em>VP of Product Management<\/em><\/span><\/p>\n

On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts. We\u2019re taking this incredibly seriously and wanted to let everyone know what\u2019s happened and the immediate action we\u2019ve taken to protect people\u2019s security.<\/span><\/p>\n

Our investigation is still in its early stages. But it\u2019s clear that attackers exploited a vulnerability in Facebook\u2019s code that impacted \u201cView As<\/a>\u201d a feature that lets people see what their own profile looks like to someone else. This allowed them to steal Facebook access tokens which they could then use to take over people\u2019s accounts. Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they don\u2019t need to re-enter their password every time they use the app.<\/span><\/p>\n

Here is the action we have already taken. First, we\u2019ve fixed the vulnerability and informed law enforcement.<\/span><\/p>\n

Second, we have reset the access tokens of the almost 50 million accounts we know were affected to protect their security. We\u2019re also taking the precautionary step of resetting access tokens for another 40 million accounts that have been subject to a \u201cView As\u201d look-up in the last year. As a result, around 90 million people will now have to log back in to Facebook, or any of their apps that use Facebook Login. After they have logged back in, people will get a notification at the top of their News Feed explaining what happened.<\/span><\/p>\n

\n

\"\"<\/span><\/p>\n

Updated on September 28, 2018 at 1:08PM PT to include image of notification.<\/span><\/p>\n<\/div>\n

Third, we\u2019re temporarily turning off the \u201cView As\u201d feature while we conduct a thorough security review.<\/span><\/p>\n

This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017, which impacted \u201cView As.\u201d The attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens.<\/span><\/p>\n

Since we\u2019ve only just started our investigation, we have yet to determine whether these accounts were misused or any information accessed. We also don\u2019t know who\u2019s behind these attacks or where they\u2019re based. We\u2019re working hard to better understand these details \u2014 and we will update this post when we have more information, or if the facts change. In addition, if we find more affected accounts, we will immediately reset their access tokens.<\/span><\/p>\n

People\u2019s privacy and security is incredibly important,<\/u>\u00a0and we\u2019re sorry this happened. It\u2019s why we\u2019ve taken immediate action to secure these accounts and let users know what happened. There\u2019s no need for anyone to change their passwords. But people who are having trouble logging back into Facebook \u2014 for example because they\u2019ve forgotten their password \u2014 should visit our\u00a0Help Center<\/a>. And if anyone wants to take the precautionary action of logging out of Facebook, they should visit the \u201cSecurity and Login<\/a>\u201d section in settings. It lists the places people are logged into Facebook with a one-click option to log out of them all.<\/span><\/p>\n

<\/a>Update on September 28, 2018 at 4:45PM PT\u00a0<\/strong><\/em><\/span><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

Facebook Was Hacked: Here’s the Official Word If you have a Facebook account, please read the following from the Facebook Newsroom.\u00a0 We recommend that you change your Facebook as soon as possible. Make sure you use a strong password. For some ideas on how to make strong passwords that are easy to remember, see our article here. Related\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":14573,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1433,1426,1670,1656,1674,779],"tags":[730,2686,2685],"_links":{"self":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/15643"}],"collection":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/comments?post=15643"}],"version-history":[{"count":3,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/15643\/revisions"}],"predecessor-version":[{"id":15650,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/15643\/revisions\/15650"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media\/14573"}],"wp:attachment":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media?parent=15643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/categories?post=15643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/tags?post=15643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}