Facebook Admits To New Security Breach, 50 Million People At Risk
The company said hackers targeted the social network's "view as" feature.

Write comment (96 Comments)

Even if you never log into Facebook itself these days, the other apps and services you use might be impacted by Facebooklatest big, bad news.

In a follow-up call on Fridayrevelation that Facebook has suffered a security breach affecting at least 50 million accounts, the company clarified that Instagram users were not out of the woods — nor were any other third-party services that utilized Facebook Login. Facebook Login is the tool that allows users to sign in with a Facebook account instead of traditional login credentials and many users choose it as a convenient way to sign into a variety of apps and services.

Third-party apps and sites affected too

Due to the nature of the hack, Facebook cannot rule out the fact that attackers may have also accessed any Instagram account linked to an affected Facebook account through Facebook Login.Still, itworth remembering that while Facebook can&t rule it out, the company has no evidence (yet) of this kind of activity.

&So the vulnerability was on Facebook, but these access tokens enable someone to use [a connected account] as if they were the account holder themselves — this does mean they could have access other third party apps that were using Facebook login,& Facebook Vice President of Product Management Guy Rosen explained on the call.

&Now that we have reset all of those access tokens as part of protecting the security of peopleaccounts, developers who use Facebook login will be able to detect that those access tokens has been reset, identify those users and as a user, you will simply have to log in again into those third party apps.&

Everything you need to know about Facebookdata breach affecting 50M users

Rosen reiterated that there is plenty Facebook does not know about the hack, including the extent to which attackers manipulated the three security bugs in question to obtain access to external accounts through Facebook Login.

&The vulnerability was on Facebook itself and we&ve yet to determine, given the investigation is really early, [what was] the exact nature of misuse and whether there was any access to Instagram accounts, for example,& Rosen said.

Anyone with a Facebook account affected by the breach — you should have been automatically logged out and will receive a notification — will need to unlink and relink their Instagram account to Facebook in order to continue cross-posting content to Facebook.

How to relink your Facebook account and do a security check

To do relink your Instagram account to Facebook, if you choose to, open Instagram Settings > Linked Accounts and select the checkbox next to Facebook. Click Unlink and confirm your selection. If you&d like to reconnect Instagram with Facebook, you&ll need to select Facebook in the Linked Accounts menu and login with your credentials like normal.

If you know your Facebook account was affected by the breach, itwise to check for suspicious activity on your account. You can do this on Facebook through the Security and Login menu.

There, you&ll want to browse the activity listed to make sure you don&t see anything that doesn&t look like you — logins from other countries, for example. If you&re concerned or just want to play it safe, you can always find the link to &Log Out Of All Sessions& by scrolling toward the bottom of the page.

What Instagram users need to know about Facebooksecurity breach

While we know a little bit more now about Facebookbiggest security breach to date, therestill a lot that we don&t. Expect plenty of additional information in the coming days and weeks as Facebook surveys the damage and passes that information along to its users. We&ll do the same.

Write comment (92 Comments)

Some users are reporting that they are unable to post todaybig story about a security breach affecting 50 million Facebook users. The issue appears to only affect particular stories from certain outlets, at this time one story from The Guardian and one from theAssociated Press, both reputable press outlets.

When going to share the story to their news feed, some users, including members of the staff here at TechCrunch who were able to replicate the bug, were met with the following error message which prevented them from sharing the story.

Facebook blocked users from posting some stories about its security breach

According to the message, Facebook is flagging the stories as spam due to how widely they are being shared or as the message puts it, the systemobservation that &a lot of people are posting the same content.&

Update:After attention was drawn to it, the bug appears to be resolved, according to updates on FacebookTwitter account. We still don&t have more official information about how or why the behavior occurred.

Facebook blocked users from posting some stories about its security breach

To be clear, this isn&t one Facebook content moderator sitting behind a screen rejecting the link somewhere or the company conspiring against users spreading damning news. The situation is another example of Facebookautomated content flagging tools marking legitimate content as illegitimate, in this case calling it spam. Still, itstrange and difficult to understand why such a bug wouldn&t affect many other stories that regularly go viral on the social platform.

This instance is by no means a first for Facebook. The platformautomated tools — which operate at unprecedented scale for a social network — are well known for at times censoring legitimate posts and flagging benign content while failing to detect harassment and hate speech. We&ve reached out to Facebook for details about how this kind of thing happens but the company appears to have its hands full with the bigger news of the day.

While the incident is nothing particularly new, itan odd quirk — and in this instance quite a bad look given that the bad news affects Facebook itself.

Everything you need to know about Facebookdata breach affecting 50M users

Write comment (100 Comments)

Betterment, which Barronrecently declared the largest independent online financial adviser, is betting that the future of online investing includes a blend of robot and human advisers. And the plan is working, according to chief executive Jon Stein.

However, incumbents like Vanguard have leveraged existing strengths to move in to the market, and other startups like Robinhood have carved out swathes of the fast-growing market. In response, Betterment has launched a series of new high-touch features on the platform, including &advice packages& that its users can buy to receive one-time advice from professional human experts.

In the interview below, Stein shares new details on the companygrowth, its plans to fend off the rise of commission-free trading, an eventual bear market and the many other challenges in the space, and eventually going public.

Gregg Schoenberg: Things have changed a lot for Betterment and the entire sector since we first sat down in early 2017. What are Bettermentassets under management these days

Jon Stein: We now have $15.5 billion under management and we&ve crossed 400,000 customers.

GS: Congratulations. Is each billion getting easier to accumulate or harder

JS: We&ve seen acceleration every year we&ve been in the business. Back in the day, I like to say that it took us a year to get to our first $10 million under management. And then six months to get to $20 million, and three months to get to $30 million. Today, $10 million is a bad day. So the scale is far greater today because assets beget assets.

GS: Thatimpressive, but when you look at the competitive environment, there are clearly some other online peers that have managed to build traction, and perhaps the incumbents watch you more closely now. Whatyour core reason for optimism that when the dust settles, Betterment emerges better off

JS: Part of it is our customer obsession and commitment to innovate around what the customer wants in financial services, and part of it is that itstill very early in the journey for us. Just as Jeff Bezos always talks about his Day One, thathow I feel about our space. We&ve got a long list of projects that we are working on and thereso much more for us to do.

Itabout trust, and itabout who you want to manage your money. Is it somebody whose sole focus is to help you make the most of it Or somebody who is trying to gamify it or trying to make money off you in ways they&re not telling you about

GS: But at the same time, you&re aware of Acorns and Robinhood and some others that are also building traction. Robinhood, for example, talks about becoming a full-service financial institution.

JS: I think some of these firms have different philosophies than what we do. I started this company because people were coming to ask me, &What should I do with my money& Ita really hard question, but we sought to excel on the three pillars that we think are most important in answering it: performance, convenience and peace of mind. I think that none of the companies you&ve mentioned do a better job than we do.

GS: Okay, but you have to acknowledge that dangling free commissions before a younger investor starting out is enticing, right I mean, free works. Look at how Google and Facebook have trained a generation of people to expect free.

JS: Free isn&t new, right There have been free offers for millions of years. I&ll agree with you that itpowerful, but people are wise to the fact that companies are making money. And if the product that you&re being sold is free, well, you know, you&re the product.

GS: Right.

JS: And probably in ways that are less well aligned with your interests as a customer. We&ve always been transparent about our fee. Italways been up front. Thatone of the ways we establish peace of mind. Because the only way we make money is that 25 basis point fee that we charge. Thatit. These other companies are selling you data, they&re trading against you—

GS: —You&re referring to selling the order flow

JS: I&m saying order flow. I&m saying they&re actually selling trade data to other firms who can trade against you. They&re not there principally to make the most of your money. Betterment is. Betterment is a mission-driven company thatgoing to make the most of our customermoney, which is an increasingly unique position.

GS: So you&re really speaking to the issue of trust.

JS: Itabout trust, and itabout who you want to manage your money. Is it somebody whose sole focus is to help you make the most of it Or somebody who is trying to gamify it or trying to make money off you in ways they&re not telling you about

GS: Letturn to the incumbents. Recently, your new board member, Donna Wells, said this: &Betterment is directly causing people to ask better informed and pretty uncomfortable questions of the incumbents.& Doesn&t that serve the ends of the Schwabs and Vanguards who have massive marketing and tech budgets Haven&t you just motivated the behemoths

JS: [Charles] Schwab is still trying to put everyone into cash and paying nothing on that cash. They&re trying to put all of their customers into their own funds and they make a lot of money off those funds — even though those funds probably aren&t whatbest for the customer. So they&re not acting in their customers& best interests with the products they&re selling. Vanguard is a great company. We&ve learned a lot from them, but the only funds they&ll put you in on their platform are Vanguard funds. They refuse to look at other funds.

GS: But you use Vanguard funds.

JS: Yes, we use a lot of Vanguard funds, but they&re not right for everything. Vanguard is a mutual fund sales company. Thatall they&re doing … selling you mutual funds. So these companies are not thinking about the customer. And none of these incumbents can do that because they have so much to lose from the way that they are doing business today. Also, ita big market. There are lots of companies out there. You named a couple of big ones. But if we think more broadly about financial services competition, there are other big firms out there. ThereRaymond James and Edward Jones and thereFinancial Engines, J.P. Morgan Chase, Goldman Sachs, Bank of America, etc.

GS: Right, and we&ll get back to J.P. and Goldman in a moment, but the competition&

JS: &All of these firms see what we&re doing. And I think our vision probably isn&t as unique as it was eight years ago because we&ve moved the industry forward. We&ve set a standard of what customers should expect. And lots of people are trying to run at that now. But we keep moving the standard down the field. And I think itgoing to get harder and harder for these firms to catch up. Will one or two get there I wouldn&t be surprised. There are a lot of smart people running these firms. Will all of them get there No. But it doesn&t worry me that we&ll have competition. Therealways been competition in this space.

GS: Fair enough, but when you talk specifically about Vanguard, whose robo has crossed $100 billion in assets under management, and Schwab&s, which has over $30 billion, what you&re saying is that you&re not fazed because your near-$16 billion is unconflicted.

JS: Thata big piece. I could also expand on why we&re better than them from a customer perspective. Our mobile and web apps are better than what they produce. We also have higher-performance services; the tax management that we do is better than what anybody else offers. The kinds of reporting and tools that you get are better than anybody else&s. The behavioral guard rails that we have are better, too. So we give you more performance, more convenience, and I believe better peace of mind.

GS: I think that JP and Goldman are especially interesting to touch on. JPYou Invest, as you know, is dangling free trading out there and Goldman has embraced retail customers through Marcus, buying Clarity Money, etc.

JS: I think itgreat that more and more folks are going after the zero commission model. Because I&ve always thought that commissions should be zero. And thatgoing to compete things away, to where thereno longer a real competitive advantage in having zero commissions. Right It should just be the way it is. But ultimately, trading stocks is not a productive activity for most Americans.

GS: Some people like to be self-directed.

JS: Therea segment that wants to do that because itlike a hobby. But itnot actually the way to make the most of your money. I compare the financial system that we&ve built to the healthcare system. Imagine if you had all the drugs on the shelf, and anyone could take as much as they want of anything. Itall cheap, but there are no doctors. You would never design a healthcare system that way because everyone would basically have to become an expert in managing their own situation. And thatreally expensive for people who are engaged in other careers and have busy lives.

Something like 40% of the 2,000 people that we surveyed thought that the market hadn&t gone up since 2008.

GS: Despite Bettermentcustomer-centric attributes, itnot immune to the competitive realities out there. In fact, Betterment, by virtue of the teaser rates that it offers, is playing the game, too.

JS: Yes, we do have a deal where people get three months free if you refer a customer. Thatalways been the No. 1 way that we&ve attracted people. And thatkept our cost of customer acquisition low, and kept us growing faster and faster, while spending less money each year. And so I think we&ve got a model that continues to generate return. By the way, with all the competition that you&re talking about, we&re still growing more customers at a lower cost than we have in any year ever.

GS: Is there any color you can give me on your customer acquisition costs

JS: We don&t reveal our customer acquisition costs publicly, but they are a fraction of the numbers that I see quoted publicly. They&re also a fraction of what I see in the financials of the big competitors out there.

GS: If you put Bettermentname on a stadium, I&m going to call you out on that, Jon. I want to turn to the topic of individual stock trading and specifically, to this recent commercial you&re airing featuring the actress, Maggie Siff.

JS: Yes, they&re filming &Billions& near me.

GS: The commercial, as you know, features your tagline, Outsmart Average.

JS: Yes.

GS: As you also know, her character on &Billions,& Wendy Rhoades, isn&t helping Bobby Axelrod pick a diversified portfolio of low-cost ETFs. So while I understand your view that most people shouldn&t be in individual stocks, aren&t you using the Wendy Rhoades character to send your target market another message

JS: Well, Maggie is a strong spokesperson, because across a number of different characters, sheplayed someone whowise, a coach and a leader. This campaign came out of a place of shifting the conversation away from Betterment versus the old way of investing, which conjures up images of boiler-room brokers and all those bad practices that traditional finance is peddling. But the problem with talking about all of the negative things in the industry is that people often don&t want to hear that.

GS: We&ve heard it ad nauseam.

JS: Yes, most people don&t want to hear that they&ve been doing the wrong thing with their money for a long time. But what we discovered is that we can shift away from talking about the industry, and shift the focus on our customers. There are people who are okay with the way things are, and there are people who are constantly striving for more. For example, I&ve got the right credit card for going to restaurants because it gives me 4 percent back. I&ve also got the right one for buying other stuff.

GS: You get 4 percent cash back at restaurants

JS: Yes, the Uber card gives you 4 percent back on certain restaurants. So I&m an optimizer. When I go on a vacation, I&ll look at a number of sites and figure out exactly whatthe best place to go, and then I&ll book an Airbnb in the best neighborhood. Itthe same when it comes to my money. I want it managed really well and I demand more than whatever the status quo provides. Thatwho we serve and thatwhat we&re saying in the commercial. Itabout people who demand better than the status quo.

GS: But no individual stocks

JS: Individual stocks are fine. Therenothing wrong with managing your money that way. Itjust not the way most people want to manage their money.

GS: Lettalk about the bear market, which I&m absolutely certain will happen in our lifetimes. As you know, many of Bettermentcustomers have never lived through a bear market as an investor. The standard thing to say is that when it comes, the right thing to do is to stay the course, think long-term, etc.

JS: Yes.

I&ve always said, we&re building an institution and building to go public. Itsomething that we want to ultimately do. My view is we&ll probably be at least twice as big as we are today before we go out.

GS: What happens when the market headlines get really ugly and people start seeing a sea of red in their Betterment account

JS: A bear market is bad for everyone in this industry, not just Betterment. And we&ve been preparing for that in a number of ways. One, we have messaging that we&ve tested and have shown can help make those customers stay the course. We&ll also do things like suggest that instead of just pulling all your money out, maybe you want to think about changing your allocation. Take 2008, for example. Betterment wasn&t yet in business, but we saw a lot of people blow themselves up by getting out of the market.

GS: It was very tempting to run for cover.

JS: Actually, we ran a survey of customer attitudes since then and it was shocking to me that something like 40 percent of the 2,000 people that we surveyed thought that the market hadn&t gone up since 2008.

GS: Wow.

JS: Yes, itsad. And I think back to our mission, which is to help people make the most of their money and keep them invested. So itimportant to us that we do that throughout the cycle. We&re also preparing for it by thinking about our strategic options.

GS: Can you elaborate

JS: Just this month, we launched a smart saver account, which gets you a higher yield on your cash. Itcurrently paying 1.83 percent net of all of our fees, and itactually higher than that if you consider that ita tax advantaged account.

GS: So thatnot FDIC-insured then.

JS: Itnot FDIC-insured, but itSIPC-insured. Another area that we think is an interesting countercyclical play is our B2B business. Throughout the market cycle, people are contributing to their retirement, which makes our 401k business an attractive place for us to be. Similarly, our Betterment for Advisors business is a good place for us to be investing.

GS: How do you feel about adding life insurance and college savings products

JS: Actually, many people already are saving for college with Betterment through things like IRAs, which can be used for college. As far as life insurance is concerned, we&re talking to a lot of financial partners about it because we think itinteresting.

GS: I agree. So last topic: When does Betterment go public

JS: I&ve always said, we&re building an institution and building to go public. Itsomething that we want to ultimately do. My view is we&ll probably be at least twice as big as we are today before we go out. Is that going to take two years or five years I can&t tell you exactly when itgoing to be because It will depend not just on our scale, but also on the capital markets, and a lot of other factors. But we continue to drive towards it, and I believe we&re in a great position. We&re audited, we have an amazing finance team, we&ve got great risk management, security processes … all of those things that companies that are preparing to IPO ought to be doing.

GS: Well, you appear to be big enough, and you have a great customer base and everybody knows who Betterment is. But as you said, timing matters.

JS: Yes, and they&re probably aren&t enough public companies out there today. But thereinnovation happening around how companies go public, which is needed. I&m also really encouraged by what some of our peers are doing out in the market, and I want us to continue to innovate in financial services, even around our IPO.

GS: On that note, Jon, I wish you and the team great luck.

JS: Thanks very much, Gregg.

This interview has been edited for content, length and clarity.

Write comment (95 Comments)

The promise of artificial intelligence is immense, but the roadmap to achieving those goals still remains unclear. Onstage at TechCrunch Disrupt SF, some of AIleading minds shared their thoughts on current competition in the market, how to ensure algorithms don&t perpetuate racism and the future of human-machine interaction.

Here are five takeaways on the state of AI from Disrupt SF 2018:

1. U.S. companies will face many obstacles if they look to China for AI expansion

5 takeaways on the state of AI from Disrupt SF

Sinnovation CEO Kai-Fu Lee (Photo: TechCrunch/Devin Coldewey)

The meteoric rise in Chinafocus on AI has been well-documented and has become impossible to ignore these days. With mega companies like Alibaba and Tencent pouring hundreds of millions of dollars into home-grown businesses, American companies are finding less and less room to navigate and expand in China. AI investor and Sinnovation CEO Kai-Fu Lee described China as living in a ¶llel universe& to the U.S. when it comes to AI development.

&We should think of it as electricity,& explained Lee, who led Google entrance into China. &Thomas Edison and the AI deep learning inventors & who were American & they invented this stuff and then they generously shared it. Now, China, as the largestmarketplace with the largest amount of data, is really using AI to find every way to add value to traditional businesses, to internet, to all kinds of spaces.&

&The Chinese entrepreneurial ecosystem is huge so today the most valuable AI companies in computer vision, speech recognition, drones are all Chinese companies.&

2. Bias in AI is a new face on an old problem

5 takeaways on the state of AI from Disrupt SF

SAN FRANCISCO, CA & SEPTEMBER 07: (L-R) UC Berkeley Professor Ken Goldberg, Google AI Research Scientist Timnit Gebru, UCOT Founder and CEO Chris Ategeka, and moderator Devin Coldewey speak onstage during Day 3 of TechCrunch Disrupt SF 2018 at Moscone Center on September 7, 2018 in San Francisco, California. (Photo by Kimberly White/Getty Images for TechCrunch)

AI promises to increase human productivity and efficiency by taking the grunt work out of many processes. But the data used to train many AI systems often falls victim to the same biases of humans and, if unchecked, can further marginalize communities caught up in systemic issues like income disparity and racism.

&People in lower socio-economic statuses are under more surveillance and go through algorithms more,& said Google AITimnit Gebru. &So if they apply for a job thatlower status they are likely to go through automated tools. We&re right now in a stage where these algorithms are being used in different places and we&re not event checking if they&re breaking existing laws like the Equal Opportunity Act.&

A potential solution to prevent the spread of toxic algorithms was outlined by UC BerkeleyKen Goldberg who cited the concept of ensemble theory, which involves multiple algorithms with various classifiers working together to produce a single result.

We&re right now in a stage where these algorithms are being used in different places and we&re not even checking if they&re breaking existing laws.

But how do we know if the solution to inadequate tech is more tech Goldberg says this is where having individuals from multiple backgrounds, both in and outside the world of AI, is vital to developing just algorithms. &Itvery relevant to think about both machine intelligence and human intelligence,& explained Goldberg. &Having people with different viewpoints is extremely valuable and I think thatstarting to be recognized by people in business… itnot because of PR, itactually because it will give you better decisions if you get people with different cognitive, diverse viewpoints.&

3. The future of autonomous travel will rely on humans and machines working together

5 takeaways on the state of AI from Disrupt SF

Uber CEO DaraKhosrowshahi (Photo: TechCrunch/Devin Coldewey)

Transportation companies often paint a flowery picture of the near future where mobility will become so automated that human intervention will be detrimental to the process.

Thatnot the case, according to Uber CEO DaraKhosrowshahi. In an era thatracing to put humans on the sidelines,Khosrowshahi says humans and machines working hand-in-hand is the real thing.

&People and computers actually work better than each of them work on a stand-alone basis and we are having the capability of bringing in autonomous technology, third-party technology, Lime, our own product all together to create a hybrid,& saidKhosrowshahi.

Khosrowshahi ultimately envisions the future of Uber being made up of engineers monitoring routes that present the least amount of danger for riders and selecting optimal autonomous routes for passengers. The combination of these two systems will be vital in the maturation of autonomous travel, while also keeping passengers safe in the process.

4. Thereno agreed definition of what makes an algorithm &fair&

5 takeaways on the state of AI from Disrupt SF

SAN FRANCISCO, CA & SEPTEMBER 07: Human Rights Data Analysis Group Lead Statistician Kristian Lum speaks onstage during Day 3 of TechCrunch Disrupt SF 2018 at Moscone Center on September 7, 2018 in San Francisco, California. (Photo by Kimberly White/Getty Images for TechCrunch)

Last July ProPublica released a report highlighting how machine learning can falsely develop its own biases. The investigation examined an AI system used in Fort Lauderdale, Fla., that falsely flagged black defendants as future criminals at a rate twice that of white defendants. These landmark findings set off a wave of conversation on the ingredients needed to build a fair algorithms.

One year later AI experts still don&t have the recipe fully developed, but many agree a contextual approach that combines mathematics and an understanding of human subjects in an algorithm is the best path forward.

&Unfortunately there is not a universally agreed upon definition of what fairness looks like,& said Kristian Lum, lead statistician at the Human Rights Data Analysis Group. &How you slice and dice the data can determine whether you ultimately decide the algorithm is unfair.&

Lum goes on to explain that research in the past few years has revolved around exploring the mathematical definition of fairness, but this approach is often incompatible to the moral outlook on AI.

&What makes an algorithm fair is highly contextually dependent, and itgoing to depend so much on the training data thatgoing into it,& said Lum. &You&re going to have to understand a lot about the problem, you&re going to have to understand a lot about the data, and even when that happens there will still be disagreements on the mathematical definitions of fairness.&

5. AI and Zero Trust are a &marriagemade in heaven& and will be key in the evolution of cybersecurity

5 takeaways on the state of AI from Disrupt SF

SAN FRANCISCO, CA & SEPTEMBER 06: (l-R) Duo VP of Security Mike Hanley, Okta Executive Director of Cybersecurity Marc Rogers, and moderator Mike Butcher speak onstage during Day 2 of TechCrunch Disrupt SF 2018 at Moscone Center on September 6, 2018 in San Francisco, California. (Photo by Kimberly White/Getty Images for TechCrunch)

If previous elections have taught us anything itthat security systems are in dire need of improvement to protect personal data, financial assets and the foundation of democracy itself. Facebook ex-chief security officer Alex Stamos shared a grim outlook on the current state of politics and cybersecurity at Disrupt SF, stating the security infrastructure for the upcoming Midterm electionsisn&t much better than it was in 2016.

So how effective will AI be in improving these systems Marc Rodgers of Okta and Mike Hanley of Duo Security believe the combination of AI and a security model called Zero Trust, which cuts off all users from accessing a system until they can prove themselves, are the key to developing security systems that actively fight off breaches without the assistance of humans.

&AI and Zero Trust are a marriage made in heaven because the whole idea behind Zero Trust is you design policies that sit inside your network,& said Rodgers. &AI is great at doing human decisions much faster than a human ever can and I have great hope that as Zero Trust evolves, we&re going to see AI baked into the new Zero Trust platforms.&

By handing much of the heavy lifting to machines, cybersecurity professionals will also have the opportunity to solve another pressing issue: being able to staff qualified security experts to manage these systems.

&Therealso a substantial labor shortage of qualified security professionals that can actually do the work needed to be done,& said Hanley. &That creates a tremendous opportunity for security vendors to figure out what are those jobs that need to be done, and there are many unsolved challenges in that space. Policy engines are one of the more interesting ones.&

Disrupt SF 2018

Write comment (93 Comments)

Facebook is cleaning up after a major security incident exposed the account data of millions of users. Whatalready been a rocky year after the Cambridge Analytica scandal, the company is scrambling to regain its users trust after another security incident exposed user data.

Hereeverything you need to know so far.

What happened

Facebook says at least 50 million users& data were confirmed at risk after attackers exploited a vulnerability that allowed them access to personal data.The company also preventively secure 40 million additional accounts out of an abundance of caution.

What data were the hackers after

Facebook CEO Mark Zuckerberg said that the company has not seen any accounts compromised and improperly accessed — although itearly days and that may change. But Zuckerberg said that theattackers were using Facebook developer APIs to obtain some information, like &name, gender, and hometowns& thatlinked to a userprofile page.

Facebook says at least 50 million users affected by security breach

What data wasn&t taken

Facebook said that it looks unlikely that private messages were accessed. No credit card information was taken in the breach, Facebook said. Again, that may change as the companyinvestigation continues.

Whatan access token Do I need to change my password

When you enter your username and password on most sites and apps, including Facebook, your browser or device is set an access tokens. This keeps you logged in, without you having to enter your credentials every time you log in. But the token doesn&t store your password — so thereno need to change your password.

Is this why Facebook logged me out of my account

Yes, Facebook says it reset the access tokens of all users affected. That means some 90 million users will have been logged out of their account — either on their phone or computer — in the past day. This also includes users on Facebook Messenger.

When did this attack happen

The vulnerability was introduced on the site in July 2017, but Facebook didn&t know about it until this month, on September 16, 2018, when it spotted a spike in unusual activity. That means the hackers could have had access to user data for a long time, as Facebook is not sure right now when the attack began.

Who would do this

Facebook doesn&t know who attacked the site, but the FBI is investigating, it says.

However, Facebook has in the past found evidence of Russiaattempts to meddle in American democracy and influence our elections— but itnot to say that Russia is behind this new attack. Attribution is incredibly difficult and takes a lot of time and effort. It recently took the FBI more than two years to confirm that North Korea was behind the Sony hack in 2016 — so we might be in for a long wait.

How did the attackers get in

Not one, but three bugs led to the data exposure.

In July 2017, Facebook inadvertently introduced three vulnerabilities in its video uploader, said Guy Rosen, Facebookvice president of product management, in a call with reporters. When using the &View As& feature to view your profile as someone else, the video uploader would occasionally appear when it shouldn&t display at all. When it appeared, it generated an access token using the person who the profile page was being viewed as. If that token was obtained, an attacker could log into the account of the other person.

Is the problem fixed

Facebook says it fixed the vulnerabilityon September 27, and then began resetting the access tokens of people to protect the security of their accounts.

Did this affect WhatsApp and Instagram accounts

Facebook said that itnot yet sure if Instagram accounts are affected, but were automatically secured once Facebook access tokens were revoked. Affected Instagram users will have to unlink and relink their Facebook accounts in Instagram in order to cross post to Facebook.

On a call with reporters, Facebook said there is no impact on WhatsApp users at all.

What Instagram users need to know about Facebooksecurity breach

Are sites that use Facebook Login also affected

If an attacker obtained your Facebook access token, it not only gives them access to your Facebook account as if they were you, but any other site that you&ve used Facebook to login with, like dating apps, games, or streaming services.

Will Facebook be fined or punished

If Facebook is found to have breached European data protection rules — the newly implementedGeneral Data Protection Regulation (GDPR) — the company can face fines of up to four percent of its global revenue.

However, that fine can&t be levied until Facebook knows more about the nature of the breach and the risk to users.

Another data breach of this scale & especially coming in the wake of the Cambridge Analytica scandal and other data leaks & has some in Congress calling for the social network to be regulated. Sen.Mark Warner(D-VA)issueda stern reprimand to Facebook over todaynews, and again pushed his proposal for regulating companies holding large data sets as &&information fiduciaries& with additional consequences for improper security.

FTC Commissioner Rohit Chopra also tweeted that &I want answers& regarding the Facebook hack. Itreasonable to assume that there could be investigators in both the U.S. and Europe to figure out what happened.

Facebook hack could hasten regulation as Sen. Warner says Congress must &step up&

Can I check to see if my account was improperly accessed

You can. Once you log back into your Facebook account, you can go to your accountsecurity and login page, which lets you see where you&ve logged in. If you had your access tokens revoked and had to log in again, you should see only the devices that you logged back in with.

Should I delete my Facebook account

Thatup to you! But you may want to take some precautions like changing your password and turning on two-factor authentication, if you haven&t done so already. If you&re weren&t impacted by this, you may want to take the time to delete some of the personal information you&ve shared to Facebook to reduce your risk of exposure in future attacks, if they were to occur.

Write comment (100 Comments)