Facebook says millions had phone numbers, search history and location stolen

https://www.washingtonpost.com/technology/2018/10/12/facebook-says-fewer-users-were-affected-by-data-breach-more-information-was-taken

by nopacience • 8 years ago

257 40 8 years ago

washingtonpost.com

pwaivers• 8 years ago

User messages could have been exposed in one specific use case, officials said. If an affected user had been the administrator of a Facebook page, and the page had received a message from another user, that message may have been compromised, Facebook said.

Isn't this a common use case? Are we administrator to our own FB account?

close04• 8 years ago

A Facebook page is different from a Facebook profile in the way it's presented so most likely the messages are made available through different mechanisms. I guess they are suggesting the particular hack didn't directly give the attackers full access to the users' profile pages (including messages) but when it comes to Facebook pages the messages are directly exposed.

With FB and Google getting free passes (as in no penalty that hurts) after this kind of incident I don't see them doing much else beyond the minimal diligence.

Scoundreller2• 8 years ago

All the time. I often get vendor support through Facebook because there’s no hold time.

Emails go into the ether with lots of vendors.

the vendor cares more about people that could bash them to all their friends without typing a new URL.

Recent examples: i’ve Dealt with an airline and a post service over Facebook messenger, complete with ticket information, name, phone numbers and addresses.

cpeterso• 8 years ago

More Facebook user data leaked or "stolen"? Must be a Monday.

atonse• 8 years ago

Here we go... the slow trickle of them saying every few days that the data breach is MUCH worse than what they had said days ago. Boil the frog.

1 month from now, compare what they've said to what they said this week.

Bartweiss3• 8 years ago

Among other interesting things, this was initially sold as an attack that enabled 'View As' for attackers who shouldn't have had access to it. It's been described like another issue in the same vein as Cambridge Analytica and Google+.

I don't doubt that setting was involved, but it's obvious by now that this wasn't equivalent to the others - there's no "View As" which will show you someone's search and location history. This isn't just a public/private breakdown but an actual breach of Facebook's internal-only data, and unlike the prior stories this ought to seriously challenge people's reliance on features like Facebook-based app sign-ins.

fcarraldo• 8 years ago

I’m not sure this is entirely true. The hack was reported to have exploited a flaw in the View As feature to retrieve user access tokens. With an access token, a user can view their own location history. This isn’t internal-only data, but it is supposed to be private to the user.

iodiniemetra• 8 years ago

there's no "View As" which will show you someone's search and location history

Not in the UI, no. But once you have the token, which is what this was, then you can request that from many of the UI API interfaces facebook provides.

When this first leaked, anyone who worked with auth systems immediately assumed it was a game over scenario.

paulcole• 8 years ago

Except they're going backwards this time.

First they said, "exposure of information from nearly 50 million of its users" and now it's "directly affected 29 million people on the social network".

John Gruber claimed the same thing a couple weeks ago:

https://daringfireball.net/linked/2018/09/28/facebook-hack

Surprisingly quiet this time since it doesn't fit the narrative he wanted.

Scoundreller2• 8 years ago

It’s a cumulative thing.

Each time you load the page, it’s a separate publication about a different 50 million /s.

StreamBright2• 8 years ago

Great that Facebook stores these things, otherwise it could not have been stolen.

thaumasiotes3• 8 years ago

People put their phone number and location on Facebook for public display. It seems hard to blame Facebook for storing them.

amag• 8 years ago

...and what about search history? I don't use Facebook but do people also put their search history on display there?

jakear• 8 years ago

This isn’t just public phone numbers. This is also private numbers that should have only been used for 2FA. (If that wasn’t bad enough already...)

StreamBright2• 8 years ago

Factually incorrect.

https://www.theverge.com/2018/3/25/17160944/facebook-call-hi...

https://www.theguardian.com/technology/2017/jul/03/facebook-...

ionised• 8 years ago

Seems pretty easy to blame them to me.

CryoLogic• 8 years ago

Why is it that all of the times Facebook claims a "hack" it's really Facebook giving away or selling user data via an API, getting caught and than claiming it as a "hack" to avoid responsibility?

JustSomeNobody• 8 years ago

I think you answered your own question. They wish to avoid responsibility.

Bartweiss3• 8 years ago

This story looks like the exception, though?

The app piggybacking and the initial "View As" stories constituted Facebook handing out data sloppily. But location records, search history, and TFA-only phone numbers are internally held data Facebook wasn't showing to anyone. This moves things from "faulty visibility settings" and "shady data sales", which we've seen before, to "outright security breach".

jowiar2• 8 years ago

Recent search history is accessible in the UI when you click on the search box. Assuming someone could see "what FB looks like from your perspective", they'd be able to access the last dozen-or-so searches.

quest88• 8 years ago

Where does FB say it sells your data? Was there a news article about it?

I see this repeated about other tech companies as well but I can never find where they say they sell my data. It seems weird companies would sell their most valuable asset, rendering themselves moot.

My understanding is these companies allow advertisers to target users, but never sell the data.

onetimemanytime• 8 years ago

search history is the most problematic, IMO, shows intent. But combine all three and you have a problem.

I think we need a new internet rule /law:

if it's online, it will hacked /stolen soon or later.

So they should not save most of the stuff.

colejohnson66• 8 years ago

Isn’t that what GDPR aims to do?

thrower123• 8 years ago

Hmm, Facebook has said that I was not included in this latest data breach, but on the other hand, the amount of spam that I've received in the email address that Facebook knows about has skyrocketed in the last few days... Correlation doesn't necessarily imply causation, and there's a million and one ways that spammers could get that address, but it certainly is curious.

nkkollaw• 8 years ago

Looks like the first huge GDPR fine the EU will be able to get.

throwaway292939• 8 years ago

Imagine if "page views" of your friends profiles were leaked...

ravenstine• 8 years ago

LOL Then we could no longer pretend that Facebook doesn't still exist because of e-stalking unrequited loves and exes.

intopieces• 8 years ago

Are all these the same hack? I’m losing track.

heuiop• 8 years ago

Is this the search history that appears in the activity tab? So, if you keep that clear, nothing could have leaked, right?

JVIDEL• 8 years ago

Good thing I never gave them my phone

And that I got tracking and location blockers specifically for fb

Facebook says millions had phone numbers, search history and location stolen

Related Stories