Yes, Facebook originally said 50 million accounts were improperly accessed. In September, a group of hackers used a flaw in Facebook’s “view as” feature to gain unauthorized access to millions of accounts — and today, the company released its most comprehensive statement yet on exactly what data was taken as part of the breach. Related: Facebook's Breach will be Forgotten? DATA is Misused. According to today’s statement, the hackers stole access tokens for 30 million accounts (revised down from an initial estimate of 50 million), allowing them to gain complete access to the profiles. Of those 30 million, the hackers accessed basic contact information (name and either email or phone number) for 14 million accounts, and additional information including gender, religion, location, device information, and the 15 most recent searches for another 15 million accounts. No information was accessed for the remaining one million accounts. Related: REMIND your hacked Facebook Logins Available on DarkWeb just For $3.90 THE FBI IS ACTIVELY INVESTIGATING THE HACK “We take these incidents really, really seriously,” said Guy Rosen, Facebook’s vice president of product management, told reporters in a call afterwards. Facebook has pledged to notify all 30 million users through the Help Center in the coming days. Crucially, Facebook said no data was taken from third-party apps linked to the accounts, including Facebook products like Instagram, Messenger and WhatsApp. At the same time, there may have been smaller but more invasive attacks during the same period that have yet to be uncovered by Facebook’s investigation. There’s also no indication that the hackers posted any content while logged in. Related: How To Check whether Your Facebook Data was Leaked! The statement also gives new detail into the timeline of the attack. The first spike of activity registered on September 14th, but it wasn’t until 11 days later that Facebook identified the activity as a malicious attack. The vulnerability was closed two days later and reported to users and privacy officials in accordance with the GDPR and other breach disclosure laws. Related: How to see if your Facebook data was accessed -- Facebook Hack Facebook also confirmed that the FBI is actively investigating the hack, but declined to give further details, saying the bureau had “asked us not to discuss who may be behind this attack.” Because of the nature of the “View As” bug, it is likely that Facebook has significant knowledge of the accounts where the attack originated, if not the perpetrators themselves. Related: The Breach killed GOOGLE+ was NOT a BREACH at all An AD for future: You have known and experienced what a centralized world was and saw the hacking, data breach and personal data leaking of social networks and other platforms such as YouTube, Yahoo etc.. But what about decentralized world on internet? Enjoy a different world on Decentralized Video Player Cuckoo. Download Cuckoo: https://cuckootech.github.io/download/
Cuckoo player is a totally free decentralized new concept video player based on P2P connection. All the videos and your data will be stored as fragments which are not able to be leaked or hacked. Decentralized Cuckoo player is not able to censor videos nor enforce guidelines which means all the data is controlled by Cuckoo user itself. Cuckoo users remain free to advertise any products or service they would like, directly inside their own videos at their own risk of losing their subscribers.
By Russell Brandom on Oct 1, 2018 On Friday, a massive breach opened up a new front in the war on Facebook. According the the company, more than 50 million accounts were taken over by a kind of login worm, which used a series of unpublished vulnerabilities to hijack session keys on an unprecedented scale. Hackers had full access to any of the targeted accounts — essentially, they could do whatever you can do when you’re logged in — and Facebook is still working to survey the full extent of the damage. Breach response is always chaotic, but this one is particularly haphazard because of a new set of rules established by the EU’s General Data Protection Regulation or GDPR. Implemented in May, the GDPR sets strict requirements for any breach involving EU citizens, requirements that are already guiding Facebook’s response to the session key attack. According to Facebook’s timeline, the disclosure on Friday came just before the 72-hour window for disclosing the news to privacy commissioners, a far tighter deadline than companies usually adopt. IRISH OFFICIALS ARE “AWAITING FROM FACEBOOK FURTHER URGENT DETAILS OF THE SECURITY BREACH.” As required, Facebook also sent more formal notifications to various privacy commissioners, who may decide to file suit over the breach. As recently as Sunday, the Irish data privacy commissioner said it was “awaiting from Facebook further urgent details of the security breach.” The UK Commissioner is still determining if the country’s citizens were implicated, although given the broad reach and indiscriminate pattern of the attack, it’s likely that at least a few of them were. “It’s always the company’s responsibility to identify when UK citizens have been affected as part of a data breach and take steps to reduce any harm to consumers,” the Commissioner said in a statement. “We will be making enquiries with Facebook and our overseas counterparts to establish the scale of the breach and if any UK citizens have been affected.” Facebook is already facing a class-action suit in California and some stern questions from the FTC, but the bulk of the pressure is expected to come from Europe. There have been countless breaches before — Facebook has even dealt with specific login bugs like this one — but the GDPR changes everything. If the company is found to have violated the rule, it could be liable for up to four percent of annual revenue, a staggering $4 billion. No one has accused Facebook of negligence yet, but the basic facts of the case have yet to be nailed down — and with lawmakers already hostile to Facebook, plenty of privacy commissioners will want to try their luck. Because the law is so fresh, no one knows for sure how such a case would play out, but Facebook is already preparing for what could be the fight of its life. “THE FORENSICS ON THIS STUFF ISN’T EASY” The new breach is a real contrast with previous GDPR fights, which have largely had to do with policy decisions and terms of service. Both Facebook and Google have already come under fire for having Terms of Service that violate the regulation, although the suits were brought by a third party and haven’t made much progress. Scandals like Cambridge Analytica present another front in the fight, in which apparent violations of user privacy stem from user choices, sidestepping most legal definitions of a breach. But this recent breach is far simpler. Facebook shouldn’t have given these hackers access to the accounts — it wasn’t a data-sharing project or an API gone wrong — so it’s hard to read the fallout as anything other than a breakdown in Facebook security. The only question is how much Facebook will be punished for the lapse. Under the GDPR, the question of blame largely hinges on whether the company was negligent, ignoring basic practices that could have prevented the breach. We don’t know enough about the attack to judge Facebook’s response at this point, but what’s happened in public has been enough to satisfy some critics. “Facebook has done a decent job so far based on what we know, including the resetting of the tokens,” says Shane Green, founder of Digi.me, an alternative platform focused on data privacy. “The forensics on this stuff isn’t easy, and it’s a tricky balance to give people warning about worst case without scaring them to death or causing an overreaction.” Still, as more detail comes out, the possibility of a GDPR suit is hard to ignore. So far, Facebook has emphasized the complexity of the bug — a three-part vulnerability in the obscure “View As” function” — but it was Facebook’s own product code that created the vulnerabilities and left them unpatched for more than a year. There have also been a number of rumors that the attack may have reported to Facebook in advance of the breach, rumors made credible by the blustery public threat against Mark Zuckerberg’s account the day before Facebook’s announcement. None of those rumors have been confirmed, but they represent a scary possibility for the company. If any one of those bugs was reported to Facebook in advance of the breach, the failure to promptly patch could be powerful evidence in court. The case is particularly complicated because the hack extended beyond Facebook itself. Once a given account was compromised, attackers also had access to any third-party accounts that relied Facebook for authentication. This is a common practice on the web — if you’ve ever clicked “login through Facebook” instead of setting up a new password, you’re part of it — but a dangerous one in cases like this. Facebook has revoked the compromised login tokens, but it can’t solve the whole problem itself. Those outside platforms will need to flush their systems too, and it’s likely there will be some who are late to realize the danger. If that line of attack causes further breaches and further damage, it’s hard to say whether the liability will fall on Facebook or the third-party service. More and more YouTuber and users are flocking to decentralized Cuckoo, a video-platform which gives every one of us complete control over data, personal or not, in a revolutionary way. For Facebook, unanswered questions like that are the scariest part of this legal tangle. No one has ever litigated these issues before, and we only have a hazy sense of what a strong or weak GDPR case looks like. The company could be in for years of legal warfare and a billion-dollar payout — or it could walk away scot free. We’re just months into the GDPR regime, and there’s simply no roadmap for how it can be used. The more important is no one can ensure this breach and hack won't happen on other social media or platforms. Politically, Facebook is the perfect target — an increasingly unpopular American tech company with significant opponents on both the left and right. With the law still working itself out, the details of the case are less important than the overwhelming political logic. Situations like this are never easy, but Facebook picked a uniquely bad moment to have a breach. Source from http://gentleineyes.blogspot.com/2018/10/the-facebook-hack-will-be-europes-first.html
If you’ve finally given up on the world’s most popular social media network — be it from the Cambridge Analytica scandal or today’s news that unknown hackers stole access to 50 million accounts — it’s not too complicated to remove yourself from the service. But before you delete all of those pictures, posts, and Likes, you should download your personal information from Facebook first.
Your Facebook archives contain just about all of the pertinent information related to your account, including your photos, active sessions, chat history, IP addresses, facial recognition data, and which ads you clicked, just to name a few. That’s a ton of personal information that you should probably maintain access to. To download your archive, go to “Settings” and click “Download a copy of your Facebook data” at the bottom of General Account Settings, and then click “Start My Archive.”
After you’ve finished downloading your archive, you can now delete your account.
Beware: once you delete your account, it cannot be recovered.
If you are ready to delete your account, you can click this link, which will take you to the account deletion page. (Facebook doesn’t have the delete account option in its settings, for some reason.) Once you click “Delete My Account,” your account will be marked for termination, and inaccessible to others using Facebook.
The company notes that it delays termination for a few days after it’s requested. If you log back in during that period, your deletion request will be canceled. So don’t sign on, or you’ll be forced to start the process over again. Certain things, like comments you’ve made on a friend’s post, may still appear even after you delete your account. Facebook also says that copies of certain items like log records will remain in its database, but notes that those are disassociated with personal identifiers.
The company says it can take up to 90 days to fully delete your account and the information associated with it, but it notes that your account will be inaccessible to other people using Facebook during that time.
If you’re really serious about quitting Facebook, remember that the company owns several other popular services as well, like Instagram and WhatsApp, so you should delete your accounts there as well.
Facebook is cleaning up after a major security incident exposed the account data of millions of users. What’s already been a rocky year after the Cambridge Analytica scandal, the company is scrambling to regain its users trust after another security incident exposed user data.
Here’s everything you need to know so far.
What happened?
Facebook says at least 50 million users’ data were confirmed at risk after attackers exploited a vulnerability that allowed them access to personal data. The company also preventively secure 40 million additional accounts out of an abundance of caution.
What data were the hackers after?
Facebook CEO Mark Zuckerberg said that the company has not seen any accounts compromised and improperly accessed — although it’s early days and that may change. But Zuckerberg said that the attackers were using Facebook developer APIs to obtain some information, like “name, gender, and hometowns” that’s linked to a user’s profile page.
What data wasn’t taken?
Facebook said that it looks unlikely that private messages were accessed. No credit card information was taken in the breach, Facebook said. Again, that may change as the company’s investigation continues.
What’s an access token? Do I need to change my password?
When you enter your username and password on most sites and apps, including Facebook, your browser or device is set an access tokens. This keeps you logged in, without you having to enter your credentials every time you log in. But the token doesn’t store your password — so there’s no need to change your password.
Is this why Facebook logged me out of my account?
Yes, Facebook says it reset the access tokens of all users affected. That means some 90 million users will have been logged out of their account — either on their phone or computer — in the past day. This also includes users on Facebook Messenger.
When did this attack happen?
The vulnerability was introduced on the site in July 2017, but Facebook didn’t know about it until this month, on September 16, 2018, when it spotted a spike in unusual activity. That means the hackers could have had access to user data for a long time, as Facebook is not sure right now when the attack began.
Who would do this?
Facebook doesn’t know who attacked the site, but the FBI is investigating, it says.
However, Facebook has in the past found evidence of Russia’s attempts to meddle in American democracy and influence our elections — but it’s not to say that Russia is behind this new attack. Attribution is incredibly difficult and takes a lot of time and effort. It recently took the FBI more than two years to confirm that North Korea was behind the Sony hack in 2016 — so we might be in for a long wait.
How did the attackers get in?
Not one, but three bugs led to the data exposure.
In July 2017, Facebook inadvertently introduced three vulnerabilities in its video uploader, said Guy Rosen, Facebook’s vice president of product management, in a call with reporters. When using the “View As” feature to view your profile as someone else, the video uploader would occasionally appear when it shouldn’t display at all. When it appeared, it generated an access token using the person who the profile page was being viewed as. If that token was obtained, an attacker could log into the account of the other person.
Is the problem fixed?
Facebook says it fixed the vulnerability on September 27, and then began resetting the access tokens of people to protect the security of their accounts.
Did this affect WhatsApp and Instagram accounts?
Facebook said that it’s not yet sure if Instagram accounts are affected, but were automatically secured once Facebook access tokens were revoked. Affected Instagram users will have to unlink and relink their Facebook accounts in Instagram in order to cross post to Facebook.
On a call with reporters, Facebook said there is no impact on WhatsApp users at all.
Are sites that use Facebook Login also affected?
If an attacker obtained your Facebook access token, it not only gives them access to your Facebook account as if they were you, but any other site that you’ve used Facebook to login with, like dating apps, games, or streaming services.
Will Facebook be fined or punished?
If Facebook is found to have breached European data protection rules — the newly implemented General Data Protection Regulation (GDPR) — the company can face fines of up to four percent of its global revenue.
However, that fine can’t be levied until Facebook knows more about the nature of the breach and the risk to users.
Another data breach of this scale – especially coming in the wake of the Cambridge Analytica scandal and other data leaks – has some in Congress calling for the social network to be regulated. Sen. Mark Warner (D-VA) issued a stern reprimand to Facebook over today’s news, and again pushed his proposal for regulating companies holding large data sets as ““information fiduciaries” with additional consequences for improper security.
FTC Commissioner Rohit Chopra also tweeted that “I want answers” regarding the Facebook hack. It’s reasonable to assume that there could be investigators in both the U.S. and Europe to figure out what happened.
Can I check to see if my account was improperly accessed?
You can. Once you log back into your Facebook account, you can go to your account’s security and login page, which lets you see where you’ve logged in. If you had your access tokens revoked and had to log in again, you should see only the devices that you logged back in with.
How can I protect my data while those platforms are hacked or data are leaking?
You can try some decentralized platforms such as Cuckoo can well store your video based on P2P connection, there won't be any hacking or leaking because all the data will be stored as fragments.
Should I delete my Facebook account?
That’s up to you! But you may want to take some precautions like changing your password and turning on two-factor authentication, if you haven’t done so already. If you’re weren’t impacted by this, you may want to take the time to delete some of the personal information you’ve shared to Facebook to reduce your risk of exposure in future attacks, if they were to occur.
:no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/10461699/Screen_Shot_2018_03_20_at_10.54.55_AM.png)
:no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/10461507/Screen_Shot_2018_03_20_at_10.19.08_AM.png)
:format(webp):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/10461699/Screen_Shot_2018_03_20_at_10.54.55_AM.png)
:format(webp):no_upscale()/cdn.vox-cdn.com/uploads/chorus_asset/file/10461507/Screen_Shot_2018_03_20_at_10.19.08_AM.png)