They should not require you to log in to their site to look up whether they have victimized you. I used to have a FB account but threw the random password away. Was I affected? No way to know?
Not to mention those of us with deleted Facebook accounts. It looks like I’m not affected but to anyone who had an account during those dates and deleted it since, how do they find out?
Yet another reason they should email affected users, guess they care more about not publicizing bad information than taking responsibility.
Does a user with a deleted account qualify as an impacted user? I think the visibility is an issue.
As one of those people, this summer I encountered a spotify issue where my spotify would randomly start playing Cannabis Club ATL. Others had the same issue. Perhaps unrelated, too difficult to tell, especially if FB doesn't consider me an active user.
People don't want to because they want their content to be "evergreen" and they think that if there's a date that's more than a year or so old, people will disregard / discount the content. So by default many blog CMSs default to not showing the date of any articles.
I forget what the text looks like in your second link when you're not logged in but after I logged in the verification text appears as follows:
"""
Is my Facebook account impacted by this security issue?
Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts.
"""
Additionally, the attackers also accessed other account information, including:
- The following information associated with your Facebook account:
- Username.
- Date of birth.
- Gender.
- Types of the devices you've used to access Facebook.
- The language you choose to use Facebook in.
- If you previously added this specific information to your Facebook account, it was also accessed:
- Relationship status.
- Religion.
- Hometown.
- Current city.
- Work.
- Education.
- Website.
- The 10 most recent locations you've checked in to or been tagged in. These locations are determined by the places named in the posts, such as a landmark or restaurant, not location data from a device.
- The 15 most recent searches you've entered into the Facebook search bar.
- People or Pages you follow on Facebook.
There's lots of "verification" data there, and lots of info to make convincing phishing attempts. That's serious juju.
Like if I say "I'm calling from Samsung about your SMA500FU, phone number #####, ..." that gives me a lot of trust for a phish.
I wonder, say, how many phones I could get by mailing people an envelope saying their phone was at risk of exploding, sending corresponding texts, etc..
I also got an alert in my feed. I stopped using Facebook 2 years ago... I didnt delete my account. But this incident highlights the latent risk our data poses across hundreds of websites...
Is my Facebook account impacted by this security issue?
Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:
Name.
Email addresses.
Phone number.
Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:
Account passwords.
Payment card or credit card information.
I'm curious did they reset everyone's tokens? I remember the day when I was meeting friends for dinner and all or just got logged out of fb at the same time.
I get the same message that I'm not likely impacted
Same, I think, I commented to my wife something like "that's worrying I've been logged out, sometimes that means your account is compromised", but I get the "you're not affected" message too.
IIRC that was on Facebook Lite on Android. I don't know my password so didn't log in at the time, but it just worked the next time I tried.
the best way to keep your passwords secure is the old fashioned way. Write them down and put them in a lock box. I only access my financial information from one computer. Perhaps I am paranoid.
On the other hand, there's no way to log into a shadow profile, and shadow profile information is never displayed to any logged in user, so you're safe against this particular exploit.
Exactly. If it’s “hackers stole my data from [insert company here]” then it should really be my data. In which case, I want those companies to either delete it or pay me for it.
Title says 14M people but Facebook's notice says this:
>We have now determined that attackers used access tokens to gain unauthorized access to account information from approximately 30 million Facebook accounts.
They got 30 million users' access tokens. They didn't do anything with 1 million of them but grabbed contact info from 29 million people and additional profile info from 14 million of them, according to Facebook.
I doubt other payment or ecommerce platforms are any more secure. Given its size, I assume Facebook has a lot of smart people working on security. And they still screw it up. How are smaller platforms, who can't attract or pay for the very best talent, going to do any better (other than by being smaller targets, I guess)?
I am. I know a bunch of them personally. They are definitely the some of the best security people I know. They just have a really hard problem to solve.
If you think about it, a breach of 30 million accounts out of 2 billion ain’t that bad.
This requires pretty loose definitions of OK, which, I guess, works out OK for Visa and MasterCard ?
Both systems experience what on the Web we'd consider a staggering level of problems. Fraud losses just in the UK for the card payment system exceed £500M per year. They're proud of themselves for catching about 60% by value of potential fraud. That is, people _tried_ to steal over a billion pounds each year, but only get away with £500M...
They use out-dated cryptography, they straight up lie to their partners, to customers and even to the courts. I trust them about as much as some random Etsy maker.
Now, my country's laws mean when Visa screws up, my bank, regulated by those laws, has to make me whole. And I'm a middle-aged white guy, so good old-fashioned unconscious bias means when I'm screaming at a regulator about my rights they listen.
But if I didn't have those laws, if I was an elderly black lady, I can expect that I'd be told it's not the payment card company, I must have secretly travelled to Hong Kong last weekend and bought $5000 of men's watches and so I have to pay for that transaction even if I have witnesses who say I never left... after all the computer says it was my card and how could that be wrong?
This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that.
I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name of the babysitter with curly finger nails. I remember that and no one can figure it out based on the internet.
I use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind.
I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.
Good point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").
I used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.
> wised up and switched to random 16-character responses
As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too.
Company policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful".
In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.
Any business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?
Naming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.
I think a better idea, due to the issues pointed out by others, is to use valid sounding answers but not real answers. So if your mother's maiden name is Smith, don't put f4jjedglkej. Put something like "Anderson" and then store that answer in your password manager. This is what I do in order to avoid potential social engineering or employees that are simply confused by a gibberish answer.
It's funny that in a topic complaining about a company who spies on it's users someone brings up Last Pass which says right in it'a TOS they spy on all your browser traffic and share that info with marketing partners
>The attacker says “Ah, a bunch of random characters, do I have to say it?
The vast majority of users aren't using random characters, so how would they know to say that to begin with? Are you implying they try that line, idk, 10,000 times until it (maybe) works?
Hacker: oh shoot, I forget I always put the incorrect information in this one... i can't remember, did I put a fake name or random characters? Or was this the one I put a bunch of words into?
Support: yeah, it looks like random characters... let's move on
Proper training, required. That person presumably is legally liable as they've breeched the providers security by giving information; and maybe given away PII.
You can get a fair amount of entropy out of names, and there are often multiple name type questions (somebody's maiden, friend's nickname, favorite teacher). Luckily it's hard to hammer customer service reps with repeated attempts, at least until the AI for voice personal assistants get a little better.
Use a Gasser password generator, like the one in Multics[1], to make password that are easier to pronounce, but still long and complex enough to offer some value as security challenge answers.
You can read 'mettlograter' or 'donetrapalyn' over the phone as easily as you can type them, and they're much better than '/1a!P:l3', which has approximately the same complexity.
For security questions, to avoid social engineering, you are better off using real, but incorrect answers and saving those. So for favorite food, put brocolli instead of your actual favorite food and rather than nonsensical answers.
I don't understand what this buys you. If you have access to your password vault, why do you need the security questions? If you lose access to the vault, don't you lose the account?
These questions are often required to be answered and some places, like vanguard, use them as a form of 2fa. Additionally, it's possible for the bank to reset passwords for some reason (hack, error, etc) and still keep these around. The point is no longer account recovery, that's correct, but it does buy you a lot of things.
The problem is that when someone claims to be you and says they've lost your password, the security questions are sometimes the only thing preventing the customer service rep from letting them bypass the password entirely.
I use 1Password but it's not fool proof. I did fake answers for a business account then promptly forgot about it and locked myself out of the account a few months later. But yes, this is the best way to do it by far.
Security questions are IMO an awful form of account recovery, as they often use publicly available data about yourself. It's basically downgrading the security of the account more often than not.
If there are no custom security question, I use my password manager to store them and put random answers not tied to myself personally.
It depends, in the cases that they ask you for the answer you have control, but sometimes security question like things will just end up being personal data queries like "To what address did we send account statements in June of 2016" and if a bank (or whatever) asks questions like that to confirm identity over the phone there's no way you can compel them to do otherwise, short of taking your business elsewhere. Techniques like asking them to add a note to your account or flag it as locked... those only work if the CS people read and obey them, often times social engineering attempts will re-dail CS lines until they find someone who is tired or generally sloppy and get them to push the change through.
The hackers stole session tokens. It's not about passwords and security (well it is, but not on the user level), it's about better securing access to certain data.
PSA:
Woah.wait. I just thought since personal data of about ~30 million people was leaked, most of them would be having Gmail accounts. So, isn't Gmail under threat too? I think GOOGLE should also issue an advisory asking people to change their security questions. Did I miss something?
Google has been actively trying to get people to stop using security questions in favour of various kinds of two-factor for quite some time now (mainly mobile phone number based stuff). They'll be fine.
As a kid with a newspaper round I set up a bank account and didn’t know what it meant when I was asked for my mother’s maiden name, so made up an answer. Accidental security.
It is a hard problem.
Fixed security questions just seem like a flawed idea anyway. When creating an account to access a significant financial service online recently, I was given a list of some 20 security questions and asked to choose 3. The problem was that 18 of them didn't apply to me or had no clear answer of the kind that I would certainly remember in the event that those questions were actually needed to prove my identity. These things are probably second only to using SMS-based 2FA for annoying security measures of questionable effectiveness being mandated by ever more services (though the new voiceprint-based 2FA is closing fast).
I read a comment on HN that they decided to use a random word like "banana" as the answer to a security question like "What's your mother's maiden name?" Within a couple of days, the bank called his house and spoke with a different relative to get the real answer.
How is this relevant? Hackers can steal recovery question answers regardless of whether web token vulnerabilities exist. And web token vulnerabilities can exist regardless of recovery question strategies.
Security questions are DUMB. They are the exactly same authentication mechanism as password (i.e. proving you know some piece of information). So you basically have multiple backup password in case you forgot the first one. But worse.
If you create a different password for them. Because you rarely use those answer, you won't be able to remember them when they are actually needed. If you generate them with your password manager, then when you loss your password you loss them too. If you actually answer the questions with real information, you basically created a weak password.
All in all, security questions is a terrible idea.
That's where I've ended up. I just assume that anything I enter on any website or app is potentially public. I've seen no real evidence that we as technologists and tech companies are able to do better.
"[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party accessed your name, email address and phone number. We acted quickly to secure the site and took action to protect your account, and we're working closely with law enforcement to address the incident."
If you were I've of the unlucky ones then check your security data at banks and any other place that has financial info, or ability to spend money (Amazon, etc.).
More important is perhaps to warn less savvy people to be vigilant about phishing attempts.
I kind of work on the assumption that those things are largely public. I mean, phone books were a thing for a very long time. Don't get me wrong, leak bad, very bad, but they didn't leak my bank accounts or a list of my worst fears.
"For 14 million people, the attackers accessed the same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches. "
The attackers accessed different info for different groups of people.
Hm, that's a bit of a silly rule. This isn't the best example, but there are certainly instances where someone is arguing from a point of complete ignorance about details in the article. Even the rule's preferred example of "The article mentions that." still seems to me to insinuate someone hasn't read the article.
I think it is just more polite to cite the article than make an accusation. There is no real benefit in accusing someone of not reading the article. This seems like a case of fostering civil discussion without losing any clarity. Since "you must not have read the article." or "did you even read the article?" adds nothing to the discussion.
People have pride. publicly claiming they messed up is a direct challenge , and it will hurt that pride. regardless of whether or not they did. When you hurt that pride, conversations go sour. And, in all fairness, do we expect someone to say “well, gosh, you’re right; I did indeed mess up. Sorry!” You can probably imagine that’s not how people work.
It’s a rule because of the effect it has on the conversation that follows, not because it is Just or Unjust. In that sense, HN is not like a court. As much as people, at times, seem to think it is :p
On top of people wanting privacy about that stuff, there’s also probably enough there to get through a lot of “password recovery questions”, for sites that have those. Especially if they can get similar info about your family (through the same FB breach).
Too often an email address plus correct answers to questions like “what’s your mother’s birthplace?”, “what’s your fathers middle name?”, “what’s your favourite hockey team” are used to prove identity online, and these types of questions could be very answerable from this breach.
Can you have that information entered into Facebook without then showing to anyone but yourself? If so, why would you have the info in there? If not, and as is common, you allow friends to see it, then that information is basically public anyway unless you are very, very selective in who you accept as a friend.
Even when being selective, there is no identity verification, so it is common for spammers or data collectors to simply make an account using the name and profile pic of any of your friends and requesting to be your friend.
yes facebook forces you to put in phone number for example, for "backup authentication" "verification" purposes, and if you don't want to show that to your friends or the public you must set it to private. The default is something like "show to all friends"
There are many preferences in facebook that are like that - unavoidable/impassible fields that ask for info, and then you set it to "private/only yourself" to prevent information leakage, but are set default to world or friend visible.
It's a dark pattern that's all over facebook - you will see it if you install the facebook mobile apps - you can't proceed to surf your timeline without clicking through and answering questions sometimes - best thing is to fill in blank/gibberish info, but sometimes phone numbers, etc can't be avoided.
Well, let's see. A feature used to view profile information had a vulnerability that allowed an attacker to get my phone number. My phone number isn't even listed on my profile.
This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile.
While my phone number may be available elsewhere outside of FB, I only have it tied to my account as a password reset contact.
The vulnerability allowed the attacker to obtain an access token for your site. So with that access token, they presumably had full access to everything as if they were you. Hence their ability to get a phone number not listed.
I'm not sure if the web interface uses those same access tokens, but the mobile app probably does. So they were probably able to access everything using unpublished API endpoints that the mobile app would normally use.
Right, I get that. I just think, or would hope, rather, that access tokens are locked down appropriately or never "over-granted" access to unnecessary data. In this case, my phone number which isn't on my profile.
If that means different API tokens for different services, then maybe that's a better way to do it. I'm not Facebook, though.
It's only possible with a very different set of tradeoffs around risk and innovation than are the norm in software. It takes NASA-grade layers of slow development processes to be 100% certain that there will never be any incidents.
Most companies, most developers, and most consumers would not be happy with the cost and speed this would result in.
In short: it's not that it's impossible. We know how to do it. It just comes with a cost attached that nobody wants to pay.
Let me ask you this: Have you done any programming yourself?
Facebook has some of the best information security researchers, takes bug bounty seriously, and they have got very low hacks compared to the effort hackers put to hack it.
If a business model of a company is based on monetizing user data, it seems only fair that in cases like this flow of the money is reversed - from Facebook to users.
Otherwise it seems that big tech has limited risk and huge upside.
edit: 40acres put it more eloquently - Regulation is coming. If data is the new oil these are the oil spills that lead to the EPA.
This comment suggests that they discovered the vulnerability and spent two days working out how to fix it, whilst leaving the site live for exploitation.
2) Did they report the breach in a timely manner. That is not clear to me yet
3) Until a detailed analysis is done we don't know if there was anything negligent about this.
4) If in other investigations into Facebook it is found that Facebook were storing data they had no right to, and it transpired that they had lost some in this attack, they would be culpable because they shouldn't have had the data to lose.
We don’t have a lot of case law to go on but generally speaking most experts assume article 33 will be the easiest part of gdpr to conform to.
Even under the most harsh interpretations 3 days is the standard & that comes with all kinds of outs.
To the rest of your other points they largely are not at all covered by GDPR.
For instance I’ve never seen an interpretation of the GDPR that required a timeframe for remediation.
Further there is no requirement to allow a supervisory authority investigatory power after a breach.
In any case this appears to be a Facebook acting with extreme transparency. Exactly what the regulators want. It would be weird if this lead to negative ramifications.
> For about 14 million people the hackers accessed information such as the last 10 places that person checked into, their current city and their 15 most-recent searches...
I imagine such information will be very useful for fine-tuning phishing scams. E.g. something like “we saw you the other day at the Baton Rouge State Fair, and it’d be a shame if anyone saw what you did there. Send 0.5 BTC here so no one finds out.”
As with any breach it is always interesting to see how the scope gets broadened day by day. Tomorrow there might be some headline like "Hackers actually took all of your location data, a timestamp of every breath you took in the last week, and 4K video of everything you looked at through your eyes for the last ten years."
If facebook offered a single $1m bug bounty, it would have likely gone to some other vulnerability besides this.
I would guess facebook gets a fair number of bug bounty reports of equal or greater severity than this one. Also in the past on HN when people argue that the payout of a bug bounty is too low, there have been comments saying web vulnerabilities are pretty much worthless on the black market.
Oh come on. Mass blackmail, that'd be pretty cool. Or models trained on our behaviour, subtly affecting the market to make us do silly things purely for the enjoyment of some accidental bitcoin millionaire, never detectable by governmental or human-intution anomaly-detectors because all effects are below the noise level. Something cool like this must be going on somewhere, and I want to read a (non-fiction) book about it.
So: “We collected detailed personal data on 14M people, much of it not directly given to us by those people. This created an enticing target for data thieves. Despite our obscene profits from data, we disproportionately reinvested in protection of this sensitive information. Since we lacked security and have a unique ability to hold more data in one place than anyone else, thieves got more of your data than they could have dreamed of.”
I guess I don't really understand the frustration of some people. I do but I don't. I don't have a facebook account, or instagram, or any social media, haven't had one in many years. No one NEEDS to have one. I guess to me, if you don't want this info to be exposed, just don't have an account. Assume the worst can happen. This is not like other sites, I get that you're "trusting" them with your info, but you are willingly putting your information there, just don't.
You forget that you don't need to have a Facebook account for Facebook to create a profile for you. You just have to exist.
The same is true for many other social networks.
So while you're posting about being all smug and happy that you never signed up for one of these services, your personal data is still in their servers, ready to be exploited by both the company and hackers.
Oh yes I understand that very much, but I do what I can not to help them. The point I was making is about people who willingly put all of their info there, photos, addresses, location etc.
but you are willingly putting your information there, just don't
I know you're the Area Man Constantly Mentioning He Doesn't Own a TV[1], but...
Facebook probably has a profile on you containing personally identifiable information. If literally anyone who has ever had your phone number or email address also had a Facebook account, and gave Facebook access to their contacts, that's the ballgame. So maybe be a little less sanctimonious about telling others not to give away their data, because I'd bet all the money in my wallet Facebook has data on you.
So what? That doesn't change a single thing. All you are doing with this line of thinking is blaming the victim. The fault here is Facebook's and the attacker's. No one else's.
Spot on. Another comment here sounds like it may be suggesting mandatory bounties -- at first glance that sounds very bad for small players, but some thresholds and/or percentages of revenue make the concept more palatable. The users themselves should be able to receive some kind of equitable relief too, but it's difficult when a single user's data is worth <$100 yet the cost to the user is potentially a much larger sum.
Regardless, I completely agree - that's almost surely where this is headed.
The current administration is actively dismantling the EPA, so I'm not sure this is the best analogy.
There's no real appetite for regulation of commercial data use in the US on either end of the political spectrum. And this is a good thing, because GDPR-style regulation would do nothing but further entrench the big players and crowd out innovation.
When will we start prosecuting these companies for letting user data getting hacked? If you cannot protect user data, you have no business dealing with them. At the very least, there should be monetary compensation.
Interesting trend I'm noticing with Facebook data controversies: 3rd parties are exploiting Facebooks connectedness to exponentially scale the # of accounts targeted by an attack.
Both Cambridge Analytica and these hackers were able to launch a successful attack on a relatively small number of accounts and through Facebook's graph like network were able to leverage the initial attack to affect more people.
Social networks mirror real life networks; they can be attacked with virus like tendencies.
216 comments
[ 3.2 ms ] story [ 289 ms ] threadCheck if you are affected here: https://www.facebook.com/help/securitynotice
(posting because it took 10+ mins to find it - many media outlets are not linking directly to it)
Yet another reason they should email affected users, guess they care more about not publicizing bad information than taking responsibility.
As one of those people, this summer I encountered a spotify issue where my spotify would randomly start playing Cannabis Club ATL. Others had the same issue. Perhaps unrelated, too difficult to tell, especially if FB doesn't consider me an active user.
If they still store some user details (which it seems they do) and then this leaks - absolutely.
What about those who have never been users yet Facebook stores plenty of information about?
People don't want to because they want their content to be "evergreen" and they think that if there's a date that's more than a year or so old, people will disregard / discount the content. So by default many blog CMSs default to not showing the date of any articles.
/grump
You can thank SEO for that. Something about older content being less "relevant"
They might intend to repeatedly update the second one, which might be a reason not to put a published date on it.
""" Is my Facebook account impacted by this security issue? Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts. """
Is my Facebook account impacted by this security issue?
Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:
Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:Additionally, the attackers also accessed other account information, including:
- The following information associated with your Facebook account:
The data you listed is semi-public in my case.
Like if I say "I'm calling from Samsung about your SMA500FU, phone number #####, ..." that gives me a lot of trust for a phish.
I wonder, say, how many phones I could get by mailing people an envelope saying their phone was at risk of exploding, sending corresponding texts, etc..
Is my Facebook account impacted by this security issue?
Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information:
Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as:I get the same message that I'm not likely impacted
IIRC that was on Facebook Lite on Android. I don't know my password so didn't log in at the time, but it just worked the next time I tried.
Might be unrelated.
Does deleting Facebook mean I no longer have a right to know if my data was breached while I was a member?
If you're in Europe you might have some some recourse (GDPR and such), but if you're from the US you are most likely out of luck.
Regardless, Facebook might have a detailed profile on you but not know your name. I doubt there is much you can do.
[1]: https://theconversation.com/shadow-profiles-facebook-knows-a...
I understand in general that only "pure" facebook users were impacted and that "WhatsApp" users aren't?
(not sure how integrated WhatsApp is with the Facebook infrastructure - I do use WhatsApp but I don't have a Facebook account)
This sort of victim blaming is all too common in the mainstream press:
IRS Says More Taxpayers May Have Been Hacked http://time.com/4000659/irs-taxpayer-hacked-cybercrime/
It wasn't the taxpayers that were hacked - it was the IRS.
Hackers stole personal information from 104,000 taxpayers, IRS says https://www.washingtonpost.com/news/federal-eye/wp/2015/05/2...
Hackers did not steal personal information from 104,000 taxpayers - they stole it from the IRS.
Smaller media outlets often get it right:
Over 700,000 People Got Screwed in Last Year's IRS Data Breach http://gizmodo.com/over-700-000-people-got-screwed-in-last-y...
[0] https://news.ycombinator.com/item?id=13681544
>We have now determined that attackers used access tokens to gain unauthorized access to account information from approximately 30 million Facebook accounts.
I am not willing to roll the dice on that assumption.
If you think about it, a breach of 30 million accounts out of 2 billion ain’t that bad.
That we know of. These sorts of leaks always seem to end up having a much wider impact than initially reported.
Both systems experience what on the Web we'd consider a staggering level of problems. Fraud losses just in the UK for the card payment system exceed £500M per year. They're proud of themselves for catching about 60% by value of potential fraud. That is, people _tried_ to steal over a billion pounds each year, but only get away with £500M...
They use out-dated cryptography, they straight up lie to their partners, to customers and even to the courts. I trust them about as much as some random Etsy maker.
Now, my country's laws mean when Visa screws up, my bank, regulated by those laws, has to make me whole. And I'm a middle-aged white guy, so good old-fashioned unconscious bias means when I'm screaming at a regulator about my rights they listen.
But if I didn't have those laws, if I was an elderly black lady, I can expect that I'd be told it's not the payment card company, I must have secretly travelled to Hong Kong last weekend and bought $5000 of men's watches and so I have to pay for that transaction even if I have witnesses who say I never left... after all the computer says it was my card and how could that be wrong?
Well, they could just not collect as much data?
I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name of the babysitter with curly finger nails. I remember that and no one can figure it out based on the internet.
I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.
As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too.
[1] https://news.ycombinator.com/item?id=18203907
In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.
https://www.logmeininc.com/legal/privacy
it basically says they collect everything possible to collect and will use it for anything they want including sharing with 3rd parties
"identity theft high risk 2fZMbjL1lLZgnS8La"
The vast majority of users aren't using random characters, so how would they know to say that to begin with? Are you implying they try that line, idk, 10,000 times until it (maybe) works?
attacker accesses recovery answers for site A. Sees that it is random characters. Attacker has access to site A.
Attacker phones sites B,C,D and E, trys social engineering. Attacker now has access to site B,C,D,E also.
Support: what is your fathers middle name?
Hacker: Michael
Support: sorry that is wrong
Hacker: oh shoot, I forget I always put the incorrect information in this one... i can't remember, did I put a fake name or random characters? Or was this the one I put a bunch of words into?
Support: yeah, it looks like random characters... let's move on
"Computers are hard, and I'm just not very good with them!"
Big pain the few times I've had to read over the phone a giant randomized string, but the phone reps always seem to think it's funny.
You can read 'mettlograter' or 'donetrapalyn' over the phone as easily as you can type them, and they're much better than '/1a!P:l3', which has approximately the same complexity.
[1] https://multicians.org/thvv/gpw-js.html
If there are no custom security question, I use my password manager to store them and put random answers not tied to myself personally.
Q: What's the name of your first pet?
A: pVp5TxN7htNC3B3Tae3RaPLndpLj5LeV
I read a comment on HN that they decided to use a random word like "banana" as the answer to a security question like "What's your mother's maiden name?" Within a couple of days, the bank called his house and spoke with a different relative to get the real answer.
“Am I blonde?”
“What’s my shoe size?”
“How old am I?”
“Do I have a dog?”
And of course, the answers to those are incredibly easy to guess / enumerate.
If you create a different password for them. Because you rarely use those answer, you won't be able to remember them when they are actually needed. If you generate them with your password manager, then when you loss your password you loss them too. If you actually answer the questions with real information, you basically created a weak password.
All in all, security questions is a terrible idea.
"[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party accessed your name, email address and phone number. We acted quickly to secure the site and took action to protect your account, and we're working closely with law enforcement to address the incident."
Ridiculous.
In all earnestness, Facebook would have required password reset if it were needed.
More important is perhaps to warn less savvy people to be vigilant about phishing attempts.
I kind of work on the assumption that those things are largely public. I mean, phone books were a thing for a very long time. Don't get me wrong, leak bad, very bad, but they didn't leak my bank accounts or a list of my worst fears.
"For 14 million people, the attackers accessed the same two sets of information, as well as other details people had on their profiles. This included username, gender, locale/language, relationship status, religion, hometown, self-reported current city, birthdate, device types used to access Facebook, education, work, the last 10 places they checked into or were tagged in, website, people or Pages they follow, and the 15 most recent searches. "
The attackers accessed different info for different groups of people.
HN guidelines:
https://news.ycombinator.com/newsguidelines.html
>Please don't insinuate that someone hasn't read an article.
It’s a rule because of the effect it has on the conversation that follows, not because it is Just or Unjust. In that sense, HN is not like a court. As much as people, at times, seem to think it is :p
Too often an email address plus correct answers to questions like “what’s your mother’s birthplace?”, “what’s your fathers middle name?”, “what’s your favourite hockey team” are used to prove identity online, and these types of questions could be very answerable from this breach.
Even when being selective, there is no identity verification, so it is common for spammers or data collectors to simply make an account using the name and profile pic of any of your friends and requesting to be your friend.
There are many preferences in facebook that are like that - unavoidable/impassible fields that ask for info, and then you set it to "private/only yourself" to prevent information leakage, but are set default to world or friend visible.
It's a dark pattern that's all over facebook - you will see it if you install the facebook mobile apps - you can't proceed to surf your timeline without clicking through and answering questions sometimes - best thing is to fill in blank/gibberish info, but sometimes phone numbers, etc can't be avoided.
Here are the facts:
1. A software company had a security incident.
2. They urgently resolved the issue.
3. They looked into who was impacted, and sent customized notifications letting people know how they were impacted.
None of this behavior is ridiculous. It's quite responsible. What would you expect to happen differently?
This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile.
While my phone number may be available elsewhere outside of FB, I only have it tied to my account as a password reset contact.
I'm not sure if the web interface uses those same access tokens, but the mobile app probably does. So they were probably able to access everything using unpublished API endpoints that the mobile app would normally use.
If that means different API tokens for different services, then maybe that's a better way to do it. I'm not Facebook, though.
Yeah, that's the entire security incident. So are you saying you expect software companies to never have security incidents? Now that's ridiculous.
Most companies, most developers, and most consumers would not be happy with the cost and speed this would result in.
In short: it's not that it's impossible. We know how to do it. It just comes with a cost attached that nobody wants to pay.
Perfect safety is a pipe dream.
Facebook has some of the best information security researchers, takes bug bounty seriously, and they have got very low hacks compared to the effort hackers put to hack it.
Otherwise it seems that big tech has limited risk and huge upside.
edit: 40acres put it more eloquently - Regulation is coming. If data is the new oil these are the oil spills that lead to the EPA.
1) https://news.ycombinator.com/item?id=18203002
This comment suggests that they discovered the vulnerability and spent two days working out how to fix it, whilst leaving the site live for exploitation.
2) Did they report the breach in a timely manner. That is not clear to me yet
3) Until a detailed analysis is done we don't know if there was anything negligent about this.
4) If in other investigations into Facebook it is found that Facebook were storing data they had no right to, and it transpired that they had lost some in this attack, they would be culpable because they shouldn't have had the data to lose.
So nothing specific, but lots of maybees
Even under the most harsh interpretations 3 days is the standard & that comes with all kinds of outs.
To the rest of your other points they largely are not at all covered by GDPR.
For instance I’ve never seen an interpretation of the GDPR that required a timeframe for remediation.
Further there is no requirement to allow a supervisory authority investigatory power after a breach.
In any case this appears to be a Facebook acting with extreme transparency. Exactly what the regulators want. It would be weird if this lead to negative ramifications.
I imagine such information will be very useful for fine-tuning phishing scams. E.g. something like “we saw you the other day at the Baton Rouge State Fair, and it’d be a shame if anyone saw what you did there. Send 0.5 BTC here so no one finds out.”
a) Paying out a $1m USD bug bounty, or
b) Accepting the reputational hit from a successful exploit
I wonder which they would choose with perfect hindsight?
Facebook runs a great bug bounty program, but given Facebook's size, data footprint, and profitability, perhaps it's worth increasing the rewards.
I would guess facebook gets a fair number of bug bounty reports of equal or greater severity than this one. Also in the past on HN when people argue that the payout of a bug bounty is too low, there have been comments saying web vulnerabilities are pretty much worthless on the black market.
https://news.ycombinator.com/item?id=9041017
https://news.ycombinator.com/item?id=16001371
https://news.ycombinator.com/item?id=12172699
I consider that pretty scary, at least.
Did I miss anything?
The same is true for many other social networks.
So while you're posting about being all smug and happy that you never signed up for one of these services, your personal data is still in their servers, ready to be exploited by both the company and hackers.
I know you're the Area Man Constantly Mentioning He Doesn't Own a TV[1], but...
Facebook probably has a profile on you containing personally identifiable information. If literally anyone who has ever had your phone number or email address also had a Facebook account, and gave Facebook access to their contacts, that's the ballgame. So maybe be a little less sanctimonious about telling others not to give away their data, because I'd bet all the money in my wallet Facebook has data on you.
[1] https://www.theonion.com/area-man-constantly-mentioning-he-d...
So what? That doesn't change a single thing. All you are doing with this line of thinking is blaming the victim. The fault here is Facebook's and the attacker's. No one else's.
Regardless, I completely agree - that's almost surely where this is headed.
There's no real appetite for regulation of commercial data use in the US on either end of the political spectrum. And this is a good thing, because GDPR-style regulation would do nothing but further entrench the big players and crowd out innovation.
Both Cambridge Analytica and these hackers were able to launch a successful attack on a relatively small number of accounts and through Facebook's graph like network were able to leverage the initial attack to affect more people.
Social networks mirror real life networks; they can be attacked with virus like tendencies.