Friday revealed last Friday that an unknown hacker had breached the site, compromising the accounts of 50 million users. The company’s security team found three bugs were used in the attacks, saying they were used in combination to successfully break into Facebook accounts.
Facebook says its engineering team discovered a security threat that could allow a hacker “to steal Facebook access tokens which they could then use to take over people’s accounts.”
This attack exploited the complex interaction of multiple issues in Facebook’s code, the company said. The attackers exploited a vulnerability in Facebook’s code related to the “View As” feature, which is designed to let users see how their profile appears on other people’s screens. If you used the feature, hackers were able to steal your access token and potentially take over your account.
The perpetrator’s ultimate aim was to steal what are known as “OAuth bearer tokens.” Essentially, these tokens prove the Facebook user is the rightful owner of an account and denote what they have access to. As Shadwell describes them: “OAuth tokens are like car keys, if you’re holding them you can use them, there’s no discrimination of the holder.” And in the context of this attack, those keys unlocked not just Facebook accounts, but any site that affected users accessed with a Facebook login. That might include Instagram or news websites.
Should I change my password?
Definitely, yes. There’s no indication that the attackers were able to steal passwords directly, but changing it will ensure that any access they may have had to your account will be blocked.
How do I do that?
- Click the menu icon in the top-right corner of any Facebook page and select Settings.
- Click Security and Login.
- Click Edit next to Change Password.
- Click Save Changes.
Facebook shares dropped more than 3% Friday after the company disclosed that hackers took advantage of a security issue to attack its systems, impacting almost 50 million accounts.