Facebook Network Breach Impacts Up to 50M Users
Excerpts from the press call transcript [1] by Guy Rosen explaining what lead to this breach being possible:<p>&gt; The first bug was that, when using the View As function to look at your
profile as another person would, the video uploader shouldn’t have actually
shown up at all. But in a very specific case, on certain types of posts that are
encouraging people to post happy birthday greetings, it did show up.<p>&gt; The second bug was that this video uploader incorrectly used the single signon
functionally, and it generated an access token that had the permissions of
the Facebook mobile app. And that’s not the way the single sign-on
functionality is intended to be used.<p>&gt; The third bug was that, when the video uploader showed up as part of View
As -- which it wouldn’t do were it not for that first bug -- and it generated an
access token which is -- again, wouldn’t do, except for that second bug -- it
generated the access token, not for you as the viewer, but for the user that you
are looking up.<p>&gt; It’s the combination of those three bugs that became a vulnerability. Now,
this was discovered by attackers. Those attackers then, in order to run this
attack, needed not just to find this vulnerability, but they needed to get an
access token and then to pivot on that access token to other accounts and then
look up other users in order to get further access tokens.
This is the vulnerability that, yesterday, on Thursday, we fixed that, and we’re
resetting all of those access tokens to protect security of people’s accounts so
that those access tokens that may have been taken are not usable anymore.
This is what is also causing people to be logged out of Facebook to protect
their accounts.<p>[1] <a href="https:&#x2F;&#x2F;fbnewsroomus.files.wordpress.com&#x2F;2018&#x2F;09&#x2F;9-28-press-call-transcript.pdf" rel="nofollow">https:&#x2F;&#x2F;fbnewsroomus.files.wordpress.com&#x2F;2018&#x2F;09&#x2F;9-28-press-...</a>