28 ms·
Facebook Says Hackers Stole Detailed Personal Data from 14M People
- prolikewh0a 8y agoSo they've just participated in Facebook's exact business model, just never paid for the data. Anything really concerning here?
- Ibethewalrus 8y agoHa!
- vuln 8y agoSo much this!! Facebook's mad they didn't makes any cash off it.
- anigbrowl 8y agoThis dataset seems more than usually worth procuring for the demographic data rather than the PII.
- shiado 8y agoAs with any breach it is always interesting to see how the scope gets broadened day by day. Tomorrow there might be some headline like "Hackers actually took all of your location data, a timestamp of every breath you took in the last week, and 4K video of everything you looked at through your eyes for the last ten years."
- bogomipz 8y agoAnd of course they make sure that the bad news comes out on a Friday. FB has the all the credibility of a greasy politician at this point.
- donalhunt 8y agoFacebook posting: https://newsroom.fb.com/news/2018/10/update-on-security-issue/ https://newsroom.fb.com/news/2018/10/update-on-security-issu... Check if you are affected here: https://www.facebook.com/help/securitynotice https://www.facebook.com/help/securitynotice (posting because it took 10+ mins to find it - many media outlets are not linking directly to it)
- ryandrake 8y agoThey should not require you to log in to their site to look up whether they have victimized you. I used to have a FB account but threw the random password away. Was I affected? No way to know?
- EnFinlay 8y agoLikewise. They should send a notification to all e-mails on record for compromised accounts.
- marricks 8y agoNot to mention those of us with deleted Facebook accounts. It looks like I’m not affected but to anyone who had an account during those dates and deleted it since, how do they find out? Yet another reason they should email affected users, guess they care more about not publicizing bad information than taking responsibility.
- staticassertion 8y agoThey explicitly state they will email impacted users.
- coreypreston 8y agoDoes a user with a deleted account qualify as an impacted user? I think the visibility is an issue. As one of those people, this summer I encountered a spotify issue where my spotify would randomly start playing Cannabis Club ATL. Others had the same issue. Perhaps unrelated, too difficult to tell, especially if FB doesn't consider me an active user.
- jlmorton 8y agoIf Facebook could go back in time and choose between: a) Paying out a $1m USD bug bounty, or b) Accepting the reputational hit from a successful exploit I wonder which they would choose with perfect hindsight? Facebook runs a great bug bounty program, but given Facebook's size, data footprint, and profitability, perhaps it's worth increasing the rewards.
- therein 8y agoPerhaps any vulnerability reported that can lead to the compromise of user data at a scale should be automatically paid out $1M.
- tantalor 8y agoAre you suggesting requiring this by law?
- Buge 8y agoIf facebook offered a single $1m bug bounty, it would have likely gone to some other vulnerability besides this. I would guess facebook gets a fair number of bug bounty reports of equal or greater severity than this one. Also in the past on HN when people argue that the payout of a bug bounty is too low, there have been comments saying web vulnerabilities are pretty much worthless on the black market. https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=9041017 https://news.ycombinator.com/item?id=16001371 https://news.ycombinator.com/item?id=16001371 https://news.ycombinator.com/item?id=12172699 https://news.ycombinator.com/item?id=12172699
- sorokod 8y agoShould it not be "Hackers Stole Detailed Personal Data of 14 Million People from Facebook" ?
- miles 8y agoExactly this. Please forgive me reposting an old comment[0]: This sort of victim blaming is all too common in the mainstream press: IRS Says More Taxpayers May Have Been Hacked http://time.com/4000659/irs-taxpayer-hacked-cybercrime/ http://time.com/4000659/irs-taxpayer-hacked-cybercrime/ It wasn't the taxpayers that were hacked - it was the IRS. Hackers stole personal information from 104,000 taxpayers, IRS says https://www.washingtonpost.com/news/federal-eye/wp/2015/05/26/hackers-stole-personal-information-from-104000-taxpayers-irs-says/ https://www.washingtonpost.com/news/federal-eye/wp/2015/05/2... Hackers did not steal personal information from 104,000 taxpayers - they stole it from the IRS. Smaller media outlets often get it right: Over 700,000 People Got Screwed in Last Year's IRS Data Breach http://gizmodo.com/over-700-000-people-got-screwed-in-last-years-irs-data-1761565531 http://gizmodo.com/over-700-000-people-got-screwed-in-last-y... [0] https://news.ycombinator.com/item?id=13681544 https://news.ycombinator.com/item?id=13681544
- crunchiebones 8y agoI guess directly mentioning the user makes it sounds more personal, and click-worthy
- Zelphyr 8y agoExactly. If it’s “hackers stole my data from [insert company here]” then it should really be my data. In which case, I want those companies to either delete it or pay me for it.
- nathanaldensr 8y agoTitle says 14M people but Facebook's notice says this: >We have now determined that attackers used access tokens to gain unauthorized access to account information from approximately 30 million Facebook accounts.
- smelendez 8y agoThey got 30 million users' access tokens. They didn't do anything with 1 million of them but grabbed contact info from 29 million people and additional profile info from 14 million of them, according to Facebook.
- thelastidiot 8y agoThat's one of the numerous reasons I'll never use fb as a payment or ecommerce platform when they launch these products.
- ams6110 8y agoI doubt other payment or ecommerce platforms are any more secure. Given its size, I assume Facebook has a lot of smart people working on security. And they still screw it up. How are smaller platforms, who can't attract or pay for the very best talent, going to do any better (other than by being smaller targets, I guess)?
- ppeetteerr 8y agoA payment company needs to worry about payment. Facebook has a ton of other features, any of which can be a vector for a hack.
- Yhippa 8y agoAs we just saw with Google and Google+.
- the_narrator 8y ago> I assume Facebook has a lot of smart people working on security. I am not willing to roll the dice on that assumption.
- jedberg 8y agoI am. I know a bunch of them personally. They are definitely the some of the best security people I know. They just have a really hard problem to solve. If you think about it, a breach of 30 million accounts out of 2 billion ain’t that bad.
- saagarjha 8y ago> a breach of 30 million accounts out of 2 billion ain’t that bad That we know of. These sorts of leaks always seem to end up having a much wider impact than initially reported.
- bargl 8y agoThis is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that. I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name of the babysitter with curly finger nails. I remember that and no one can figure it out based on the internet.
- dhimes 8y agoBut you can give that answer to any question they ask. That's what fake answers are all about.
- munk-a 8y agoIt depends, in the cases that they ask you for the answer you have control, but sometimes security question like things will just end up being personal data queries like "To what address did we send account statements in June of 2016" and if a bank (or whatever) asks questions like that to confirm identity over the phone there's no way you can compel them to do otherwise, short of taking your business elsewhere. Techniques like asking them to add a note to your account or flag it as locked... those only work if the CS people read and obey them, often times social engineering attempts will re-dail CS lines until they find someone who is tired or generally sloppy and get them to push the change through.
- ppeetteerr 8y agoThe hackers stole session tokens. It's not about passwords and security (well it is, but not on the user level), it's about better securing access to certain data.
- nathanaldensr 8y agoI use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
- lisardo 8y agoI'm among the hacked people. I'm feeling so disappointed.
- w8rbt 8y agoDon't feel bad... everyone, everywhere has been compromised. The corporations that say they have not are either ignorant or lying.
- ams6110 8y agoThat's where I've ended up. I just assume that anything I enter on any website or app is potentially public. I've seen no real evidence that we as technologists and tech companies are able to do better.
- spike021 8y agoLogged in today and found: "[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party accessed your name, email address and phone number. We acted quickly to secure the site and took action to protect your account, and we're working closely with law enforcement to address the incident." Ridiculous.
- cobookman 8y agoGot the same message. So what's the recommended thing to do. Rotate all your passwords and security questions?
- notimetorelax 8y agoI guess in this case, - rotate all your names, phone numbers, and addresses. :( In all earnestness, Facebook would have required password reset if it were needed.
- SketchySeaBeast 8y ago> name, email address and phone number I kind of work on the assumption that those things are largely public. I mean, phone books were a thing for a very long time. Don't get me wrong, leak bad, very bad, but they didn't leak my bank accounts or a list of my worst fears.
- jimnotgym 8y agoThe multi-billion dollar question is still... how many of them were EU citizens?
- kasey_junk 8y agoWhy? Do you think they didn't report this breach to a supervisory authority? Even though they made it public?
- jimnotgym 8y agoThat is not the only thing you can get fined for under GDPR.
- kasey_junk 8y agoI’m fairly knowledgeable in the GDPR and I’m legitimately curious what you think the fine basis would be related to this breach.
- jimnotgym 8y agoA few things made me wonder 1) https://news.ycombinator.com/item?id=18203002 https://news.ycombinator.com/item?id=18203002 This comment suggests that they discovered the vulnerability and spent two days working out how to fix it, whilst leaving the site live for exploitation. 2) Did they report the breach in a timely manner. That is not clear to me yet 3) Until a detailed analysis is done we don't know if there was anything negligent about this. 4) If in other investigations into Facebook it is found that Facebook were storing data they had no right to, and it transpired that they had lost some in this attack, they would be culpable because they shouldn't have had the data to lose. So nothing specific, but lots of maybees
- kasey_junk 8y agoWe don’t have a lot of case law to go on but generally speaking most experts assume article 33 will be the easiest part of gdpr to conform to. Even under the most harsh interpretations 3 days is the standard & that comes with all kinds of outs. To the rest of your other points they largely are not at all covered by GDPR. For instance I’ve never seen an interpretation of the GDPR that required a timeframe for remediation. Further there is no requirement to allow a supervisory authority investigatory power after a breach. In any case this appears to be a Facebook acting with extreme transparency. Exactly what the regulators want. It would be weird if this lead to negative ramifications.
- cmpb 8y ago> For about 14 million people the hackers accessed information such as the last 10 places that person checked into, their current city and their 15 most-recent searches... I imagine such information will be very useful for fine-tuning phishing scams. E.g. something like “we saw you the other day at the Baton Rouge State Fair, and it’d be a shame if anyone saw what you did there. Send 0.5 BTC here so no one finds out.”
- silveira 8y agoEnough to subvert a few democracies.
- tw1010 8y agoWhat's the most sci-fi worst case scenario that could come of this?
- ry_ry 8y agoPublic collectively shrugs, sites get hacked all the time and nothing bad ever happens to them, so it's just people getting worked up over nothing. I consider that pretty scary, at least.
- tw1010 8y agoOh come on. Mass blackmail, that'd be pretty cool. Or models trained on our behaviour, subtly affecting the market to make us do silly things purely for the enjoyment of some accidental bitcoin millionaire, never detectable by governmental or human-intution anomaly-detectors because all effects are below the noise level. Something cool like this must be going on somewhere, and I want to read a (non-fiction) book about it.
- deleted 8y ago[deleted]
- makecheck 8y agoSo: “We collected detailed personal data on 14M people, much of it not directly given to us by those people. This created an enticing target for data thieves. Despite our obscene profits from data, we disproportionately reinvested in protection of this sensitive information. Since we lacked security and have a unique ability to hold more data in one place than anyone else, thieves got more of your data than they could have dreamed of.” Did I miss anything?
- myth_buster 8y agoHey it's election season. Time to refresh DB. /s
- barrad0s 8y agoI guess I don't really understand the frustration of some people. I do but I don't. I don't have a facebook account, or instagram, or any social media, haven't had one in many years. No one NEEDS to have one. I guess to me, if you don't want this info to be exposed, just don't have an account. Assume the worst can happen. This is not like other sites, I get that you're "trusting" them with your info, but you are willingly putting your information there, just don't.
- reaperducer 8y agoYou forget that you don't need to have a Facebook account for Facebook to create a profile for you. You just have to exist. The same is true for many other social networks. So while you're posting about being all smug and happy that you never signed up for one of these services, your personal data is still in their servers, ready to be exploited by both the company and hackers.
- barrad0s 8y agoOh yes I understand that very much, but I do what I can not to help them. The point I was making is about people who willingly put all of their info there, photos, addresses, location etc.
- ubernostrum 8y agobut you are willingly putting your information there, just don't I know you're the Area Man Constantly Mentioning He Doesn't Own a TV[1], but... Facebook probably has a profile on you containing personally identifiable information. If literally anyone who has ever had your phone number or email address also had a Facebook account, and gave Facebook access to their contacts, that's the ballgame. So maybe be a little less sanctimonious about telling others not to give away their data, because I'd bet all the money in my wallet Facebook has data on you. [1] https://www.theonion.com/area-man-constantly-mentioning-he-doesnt-own-a-televisi-1819565469 https://www.theonion.com/area-man-constantly-mentioning-he-d...
- s73v3r_ 8y ago"No one NEEDS to have one. " So what? That doesn't change a single thing. All you are doing with this line of thinking is blaming the victim. The fault here is Facebook's and the attacker's. No one else's.
- 40acres 8y agoRegulation is coming. If data is the new oil these are the oil spills that lead to the EPA.
- adanto6840 8y agoSpot on. Another comment here sounds like it may be suggesting mandatory bounties -- at first glance that sounds very bad for small players, but some thresholds and/or percentages of revenue make the concept more palatable. The users themselves should be able to receive some kind of equitable relief too, but it's difficult when a single user's data is worth <$100 yet the cost to the user is potentially a much larger sum. Regardless, I completely agree - that's almost surely where this is headed.
- envy2 8y agoThe current administration is actively dismantling the EPA, so I'm not sure this is the best analogy. There's no real appetite for regulation of commercial data use in the US on either end of the political spectrum. And this is a good thing, because GDPR-style regulation would do nothing but further entrench the big players and crowd out innovation.
- deleted 8y ago[deleted]
- fpalacios10 8y agoLuckily i deleted my facebook account over the summer, One less account to have to worry about now.
- rustcharm 8y agoThank you for letting us know.
- fpalacios10 8y agono problem
- nafizh 8y agoWhen will we start prosecuting these companies for letting user data getting hacked? If you cannot protect user data, you have no business dealing with them. At the very least, there should be monetary compensation.
- aaaaaaaaaab 8y agoWe’ve accepted their terms on signup...
- 40acres 8y agoInteresting trend I'm noticing with Facebook data controversies: 3rd parties are exploiting Facebooks connectedness to exponentially scale the # of accounts targeted by an attack. Both Cambridge Analytica and these hackers were able to launch a successful attack on a relatively small number of accounts and through Facebook's graph like network were able to leverage the initial attack to affect more people. Social networks mirror real life networks; they can be attacked with virus like tendencies.
- madrox 8y agoTo me, this is less about what a devil Facebook is, but that nothing is worth the risk that comes from putting too much of your data in one place.
- WindowsFon4life 8y agoThey mean that what they already sell, was stolen without being paid for?
- nyokodo 8y agoA downside to having deleted my facebook account before this security breach was reported is that I cannot find out if my data was compromised.
- AsyncNoTimeout 8y agoThey’d be admitting they kept info about you they were supposed to delete no?
- LeicaLatte 8y agoThe Facebook has the media by its balls.
- zaphirplane 8y agoThe headline made sense to me as - Facebook; says hackers, stole Or as - Facebook says, hackers stole
- rlt 8y agoI'm one of the unlucky 400,000 who had the most information stolen. Complete notification: Is my Facebook account impacted by this security issue? Yes. Based on what we've learned so far in our investigation, attackers accessed the following Facebook account information: * Name. * Primary email address. * Most recently added phone number. Additionally, the attackers also accessed other account information, including: * The following information associated with your Facebook account: * Username. * Date of birth. * Gender. * Types of the devices you've used to access Facebook. * The language you choose to use Facebook in. * If you previously added this specific information to your Facebook account, it was also accessed: * Relationship status. * Religion. * Hometown. * Current city. * Work. * Education. * Website. * The 10 most recent locations you've checked in to or been tagged in. These locations are determined by the places named in the posts, such as a landmark or restaurant, not location data from a device. * The 15 most recent searches you've entered into the Facebook search bar. * People or Pages you follow on Facebook. A small subset of Facebook accounts, including yours, had additional Facebook information made available to the attackers. Learn more about how this information was made available. This is specifically information that appears when viewing your own profile and includes additional information, such as: * Posts from your timeline. * Your Friends list. * Messenger conversation names, but not their contents. * If you are a Page admin, you may have also had messages to your Page made available to the attackers. * Groups you're a member of. Based on what we've learned so far in our investigation, the attackers did not gain access to certain information, such as: * Account passwords. * Payment card or credit card information.
- gizmo385 8y ago> If you are a Page admin, you may have also had messages to your Page made available to the attackers. That seems to stand out to me as a bit of an outlier. Depending on the kind of page that an affected individual operates, that could be pretty big.
- gukov 8y agoAll companies that deal with personal data should be required to display a list similar to the above as a warning: "In case of a security breach, your personal information will be made available, including but not limited to: ..." The warning should be displayed during registration and then repeated monthly as a reminder.
- thinelvis 8y agoFacebook is just pissed that a marketing or analytics company didn't pay them.
- propman 8y agoIf I type my full name on google, I can find my home and cell phone number, age, all family members, home address, my last home address, and my google + (fb and LinkedIn I changed settings so not searchable). And it’s a pain to ask them to delete the info. It’s obscure and time consuming and no guarantees. That in my mind is worse than anything here. I didn’t allow that info to be public, we need more privacy laws.
- alain94040 8y agoSounds like a startup opportunity. For only $5, we'll file take down notices left and right for all the info that is available online about you.
- grenoire 8y agoI think you'll be burning through a lot of VC money to pay anybody to do it for five bucks, hell, why not Fiverr?
- lsmarigo 8y agoalready multiple players in this space but last time I checked none were very reputable or well reviewed so hey still an opportunity.
- vuln 8y agoUse the block chain to track it ??? Profit
- blazespin 8y agoRight to be forgotten
- dirkgently 8y ago1. The problem isn't Google. It's those companies that make your details available on internet. 2. Your personal data is already collected meticulously by companies like Acxiom and Equifax for anyone who is ready to pay. You would be amazed how much information they have on you already. What are you going to do about it?
- aviv 8y agoYep... https://news.ycombinator.com/item?id=18095071 https://news.ycombinator.com/item?id=18095071
- 8bitsrule 8y ago"Hackers Stole" ... Yeah. It's all their fault. Dumb fucks. /s
- jwbensley 8y agoA detailed tech breakdown of the hack would be great, I assume this is out of the question?
- dsr_ 8y agoAnd you know it's stolen, because they didn't pay Facebook for it the way they should have.
- Alterlife 8y agoThe wording of this is so off. Hackers stole personal information stored by FACEBOOK not 'people'. It sounds like they are creating a new way for their company to avoid responsibility, just like banks created 'identity theft'.
- exodust 8y agoNever been a member, but I do receive regular notification emails from a Fb account/person I don't know, and an account I've never had anything to do with. Yesterday after news of stolen data emerges, I received a "Facebook password reset" email sent to my gmail address. I ignore all and filter as spam, but sometimes I see them. The email headers do show the source is facebook. Seems like Facebook allows new account sign up from unverified email addresses. That's a flaw in their policy against spam and abuse, making these hacking events worse when they happen. They need to use activation codes in the email used to sign up with.
- xab9 8y agoI still think that facebook can be tremendously useful, even if I unfollowed everyone and have zero posts (mostly to see events, access facebook-homepages, let people find my email address or just occasionally tell someone to send me an email instead of writing on messenger) - but heck, this latest breach is a bit too much to swallow.
- mike22223333 8y agoIncrease the bug bounty rewards for such things to depend on the scale so $1M-$10M bounty should be given. Otherwise face a reputation hit.
- wimgz 8y agoAnd after that they want to put a Facebook camera in your living room?
- sam1r 8y agowhat are the chances that a class lawsuit will follow? not an expert on this but haven't seen it mentioned yet on this discussion.
- pbhjpbhj 8y agoMassive GDPR fine coming soon then?
- StreamBright 8y agoExactly the reason why facebook should not store any PII