Facebook has put out more details about the data breach that exploited a vulnerability in its code between July 2017 and September 2018.
What is the recent picture on data breach?
Facebook has claimed that fewer users - 30 million, not 50 million - had their access tokens stolen by exploiting 400,000 accounts.
But crucially, the new revelation is that 15 million of the 30 had their name and contact details (phone numbers or e-mails) stolen.
This was depending on what people had on their profiles.
Another 14 million had details like gender, relationship status, their birth date, recent searches, and the last 10 places the person had checked into or were tagged in stolen.
This was along with name and contact details like others.
Just 1 million of the 30 had none of their data compromised.
But Messenger, Messenger Kids, Instagram, WhatsApp, Oculus, Workplace, Pages, payments, third-party apps, or advertising or developer accounts have not been affected.
How was it done?
The attackers moved from account to account using an automated script collecting tokens.
This was done by repeatedly exploiting the vulnerability using access tokens for about 400,000 people.
The attackers then used the list of friends they collected to “eventually steal access tokens for about 30 million people.
So starting with the accounts they controlled directly, they moved to their friends and to their friends’ friends, and so forth.
The attackers could see things about users like-
posts on their Timelines
their list of Friends
groups they’re members of
the names of some recent Messenger conversations
Facebook claims that the message content was not available to attackers.
But even this could have been seen if the person was Page admin and had received a message from someone.
What next?
Facebook is sending customised messages to the 30 million users, suggesting steps to protect themselves.
On the Facebook Help Center, users can check if they have been affected and what information may have been accessed.
Reportedly, accounts have already been secured by what Facebook did recently when they prompted millions of users to reset the access tokens.
So no one needs to log out again or change passwords.
But the risk is that stolen data could be used to target phishing mails etc to the users, knowing their preferences.
So users have to be careful of suspicious e-mails, text messages or calls that could be made using this information.
