The National Privacy Commission on Saturday said it was still determining how many Filipino users of social networking site Facebook were affected by the massive data breach by the social media giant.
In a statement, NPC Commissioner Raymund Liboro said that according to the company’s (Facebook) representatives, the investigation is still in its early stages. They have not determined yet how many Filipinos are affected and whether misuse of personal information had resulted from this breach.”
This after Facebook reported on Friday that up to 50 million accounts were breached by hackers, which dealt a blow to the social network’s effort to convince users to trust it with their data.
Zuckerberg said the company is investigating the extent of harm done when hackers exploited a trio of software flaws to steal “access tokens,” the equivalent of digital keys that enable people to automatically log back into the social network.
Zuckerberg said engineers discovered the breach on Tuesday, and patched it on Thursday night.
“We don’t know if any accounts were actually misused,” Zuckerberg said. “This is a serious issue.”
As a precaution, Facebook is temporarily taking down the “view as” feature—privacy tool that let users see how their profiles look to other people.
“It’s clear that attackers exploited a vulnerability in Facebook’s code,” said vice president of product management Guy Rosen.
“We’ve fixed the vulnerability and informed law enforcement.” Facebook reset the 50 million breached accounts, meaning users will need to sign back in using passwords.
But Democratic US Senator Mark Warner said the breach is further proof of the privacy danger of companies such as Facebook and Equifax not adequately protecting the massive amounts of information they gather about people.
“This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users,” Warner said in a statement.
“As I’ve said before—the era of the Wild West in social media is over.”
The breach is the latest privacy embarrassment for Facebook, which earlier this year acknowledged that tens of millions of users had personal data hijacked by Cambridge Analytica, a political firm working for Donald Trump in 2016.
“We face constant attacks from people who want to take over accounts or steal information around the world,” Zuckerberg said on his own Facebook page.
“While I’m glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place.”
Facebook said it took a precautionary step of resetting “access tokens” for another 40 million accounts where the “view as” was used.
This will require those users to log back in to Facebook.
“People’s privacy and security is incredibly important , and we’re sorry this happened,” Rosen said.
But Rosen assured users that no passwords were taken in the breach, only “tokens,” as he said that information hackers appeared interested only in included names, genders, and home towns, but it was not clear for what purposes.
The stolen tokens gave hackers complete control of accounts.
Facebook is trying to determine whether hackers tampered with posts or messages.
Company officials said hackers could have also gotten into third-party applications linked to Facebook accounts, but it was too early to determine whether that happened, according to the social network.
Attackers would have been able to meddle with Instagram accounts lined to Facebook, but could not have tampered with the social network’s WhatsApp messaging service, according to executives.
Facebook said that it noticed an unusual spike in activity on Sept. 16 and nine days later, determined that it was malicious.
Hackers took advantage of a “complex interaction” between three software bugs, which required a degree of sophistication, according to Rosen. The vulnerability was created by a change to a video uploading feature in July of 2017.
“We may never know who is behind this,” Rosen said. “This is not an easy investigation.”
The 50 million figure was the total number of accounts Facebook determined were breached by the attack since July of last year, but the social network did not disclose the earliest incursion.
Rosen said Facebook is now working with data privacy regulators as well as law enforcement and added that the company this year is doubling to 20,000 the number of workers devoted to safety and security.
When asked why people should still trust Facebook with their personal information, Zuckerberg outlined anew ways the social network is ramping up its defenses.
“As I’ve said a number of times, security is an arms race,” Zuckerberg said.
But Harvard law professor and co-founder of the university’s Berkman Klein Center for Internet & Society, Facebook may have deeper problems.
“There is a structural problem here,” Zittrain said in a tweet. “Facebook has one of the best and most well-resourced cybersecurity outfits in the world, yet a breach of its servers appears to have compromised tens of millions of accounts in still-undisclosed ways.” With AFP
