Facebook Sounds Alarm As Security Bug Impacts 50 Million Accounts

Three days ago, Facebook engineers discovered a problem. Today we're learning just how serious that problem was. According to an official announcement, a security flaw that affected almost 50 million accounts had been exploited by attackers.

Those attackers, Facebook says, exploited the site's "view as" feature. For those of you who have never used it, the function allows you to view your own pages the way another Facebook user would see them. Click into "view as" and Facebook will show you what a friend or co-worker might see.

What Facebook's security team has learned is that the flaw allowed attackers to steal access tokens. If that's a phrase that sounds familiar, there's a good reason. Tokens were at the core of the massive Yahoo! hack that impacted more than one billion users.

What is an access token? Facebook describes it like this: they're "the equivalent of digital keys that keep people logged in to Facebook so they don’t need to re-enter their password every time they use the app."

Convenient? Absolutely. If someone steals your key, however, that convenience becomes theirs. Whoever has the key has complete control over the account.

These attackers effectively stole tens of millions of keys.

Update, 6:15PM: In this case, the keys could have allowed hackers to access more than just Facebook, too. If you logged into another website using a Facebook button on that site, that account could have been compromised, too.

A Facebook spokesperson reports that the company has "invalidated data access for third-party apps for the affected individuals" to prevent any unauthorized access.

Lee Mathews/Forbes

We should expect a tech company as prominent as Facebook to handle a breach of this significance appropriately, and so far it seems as though that's happening. Facebook has moved very quickly to notify the public of the incident. Three days is a rapid turnaround from discover to issuing an advisory.

Facebook also immediately reset the 50 million affected access tokens (which is like changing the locks to render a stolen key useless). On top of that, the company reset 40 million more tokens linked to any account that utilized the 'view as' feature in the past year.

There's no question that 50 million is a lot of people. As a percentage of Facebook's total userbase, however, it's actually fairly small. Second quarter numbers for 2018 put the figure at around 2.3 billion, which means just over 2% of users were at risk.

That's another part of what makes issues like this one so alarming. When someone discovers and exploits a flaw in Facebook's code -- no matter how small -- it has the potential to impact millions and millions of people.

Timing around the announcement has raised some eyebrows. Very early this morning, reports surfaced that a Taiwanese white hat hacker claimed he was going to delete Mark Zuckerberg's own Facebook account. He even planned to livestream the whole thing. Then, at about 3PM Eastern, the hacker cancelled his plans. Facebook has not announced a link between the security flaw and the hacker's claim, but it's curious how quickly the cancellation followed Facebook's announcement.

Facebook continues to investigate the incident. It does not yet know whether any data was improperly access or unauthorized actions were performed on any of the impacted accounts. This post will be updated as the company provides additional information.

