11 ms·
Private messages from 81,000 hacked Facebook accounts for sale
- fwn 8y agoI think the headline is slightly misleading. > [...] the data had probably been obtained through malicious browser extensions. It appears to actually be hacked browsers, or compromised browsers for that matter.
- tomalpha 8y agoPerhaps, but only slightly imho. To your average HN denizen, 'hacked' implies the account was completely compromised. To the wider world it might well include partial compromise and/or the communications to/from the account even if the attackers didn't gain total control. Which is what this appears to be. My parents, for example, would not understand the difference.
- mrweasel 8y ago>My parents, for example, would not understand the difference. Nor should they be expected to, but the BBC should know the difference. Facebooks stock price could be hurt due to this reporting, even though it shouldn't. This could be seen as an attempt at manipulating the stock price of a public trade company. Of cause it's just incompetence, but still.
- mprev 8y agoThe average tech reporter for a public service broadcaster most likely does not know the difference. How often do you read mainstream tech reporting and find yourself complimenting the journalist on their insight and factual correctness?
- mrweasel 8y agoWell... pretty much all the time. That doesn't mean it's okay if they potentially hurt people and companies financially.
- ht85 8y agoYou have to account for everything when evaluating a company, and that includes negative sentiment of the public about using an application. Even if the company didn't do anything wrong.
- mrweasel 8y agoI would says is roughly the same as posting a news story about fuelling your car at Texaco destroys the cars engine, and that it's a Texaco issue, even if the truth is that someone just accidentally choose diesel, rather than petrol.
- sp332 8y agoTo me it places the blame in the wrong place. In this case Facebook doesn't seem to have done anything wrong.
- grey-area 8y agoGiven the recent complete compromise of FaceBook security allowing stealing access tokens, this is not the only possibility. https://www.cnet.com/how-to/50-million-facebook-accounts-were-compromised-was-yours/ https://www.cnet.com/how-to/50-million-facebook-accounts-wer...
- sbhn 8y agoSo I guess the data is now being shared across the border between security services and rightly so. The data and the story now have significantly more value to those services that bill the tax payer, and those that sell your attention using fear antagonising news media. So when an organisation demands you hand over your data, and it’s for your security, it’s not really, is it?
- Santosh83 8y agoRogue extensions are the Achilles Heels of browsers, yet the ramifications aren't understood by the average user, who happily installs all sorts off addons and extensions. Frankly I'm surprised more sensitive information hasn't already been stolen/harvested all these years. This is why I run my browser with no extensions with the sole exception of uBlock Origin.
- Cthulhu_ 8y agoI wouldn't object to extensions becoming paid and verified - that is, an expert review team doing a code / security review for each update of an extension. Either paid for by the authors, or done for free by e.g. Google because they have plenty of money and they are directly impacted if their platform releases a malicious extension.
- codedokode 8y agoYou have described what antivirus companies usually do with traditional software.
- saagarjha 8y agoAntivirus companies do not have control over the primary distribution method of software.
- _red 8y ago>e.g. Google because they have plenty of money and they are directly impacted if their platform releases a malicious extension. I have some foxes for rent, perhaps you could use them to guard your henhouse.
- icebraining 8y agoGoogle already guards the henhouse, ie, they control who can be listed on the Chrome Store.
- saagarjha 8y ago
- sfcguyus 8y agoIn a GDPR violation who gets the fines? Is it users? the EC? the member state?
- rovr138 8y agoDo you mean the money obtained from a fine?
- icebraining 8y agoThe fines are applied by the regulatory agency of the member state, so that depends on national jurisdiction, but it probably goes to the budget of that member state.
- gnode 8y agoIn this case there might not be a GDPR violation. If the data is taken by compromised browsers, then the breach wouldn't exist within Facebook's control. It's not clear to me from reading the GDPR whether companies are responsible for the loss of personal data outside of breaches in their security. E.g. is a successful phishing campaign against customers a data breach? If not at fault, do they have an obligation to alert customers specifically about the attack?
- sizeofNaN 8y agoYou think a socialist nations laws would ever result in a payment to the people?
- x0x0 8y agoa breach is defined as ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; Given the definition, I think it's a bit hard to argue this isn't a breach. It's a breach of security leading to unauthorised disclosure or personal data.
- petagonoral 8y agoMaybe it's time for the browsers to put more effort into extension network security. 1) Every extension has to declare up front what urls it needs to communicate to. 2) Every extension has to provide schema of any data it intends to send out of browser. 3) Browser locally logs all this comms. 4) Browser blocks anything which doesn't match strict key values & value values and doesn't leave browser in plain text.
- Chazprime 8y agoLast year several coworkers had installed a fake Postman Chrome extension that contained adware. We all reported it to Google, and on inspection others had left reviews to that effect, but Google took over six months to remove it.
- 2sk21 8y agoThis is terrifying - Postman is very widely used.
- duxup 8y agoRelated question, What would you use a Postman Chrome Extension... for? Rather than say just... use Postman? I'm not disagreeing with the use, just wondering how they use it compared to Postman itself. I'm a n00b web dev, I just want to know how others work and why.
- delecti 8y agoI can't speak to Postman specifically, because I barely use it enough for it to make a difference. But in a more general sense, I tend to prefer <thing> in a browser over <thing> but in its own window. It means one fewer program filling my taskbar.
- duxup 8y agoI can see that, but for me it's more: - Dork with code/ routes in one window and/or dorking around with the front end code. - Postman (the stand alone program) in another window to check what the return from the server really is or what the API is doing now. So I've got it on it's on dedicated space (not all the time but often enough).
- Havoc 8y agoIs there a way to check who is affected? Have I been owned style
- sp332 8y agoHopefully Facebook has reported the issue to Chrome and they will remove the extension. Maybe at that point you'll get a notification about an extension being blacklisted by your browser.
- bagacrap 8y agoWhat makes you think it was a single extension? If I were doing this I'd probably create many extensions (with various ostensible purposes packaged along with the spyware) to cast a wider net.
- sp332 8y agoIt probably wasn't a single extension, but the article proposes bookmarking and personal shopper extensions as likely culprits.
- gnode 8y agoIf you've since uninstalled the extension or switched machine / browser, then that's no good for you.
- heinrichf 8y agoNote that (according to the article) they claim to have 120mio accounts, the 81k are a sample posted online and verified by Digital Shadows.
- EForEndeavour 8y agoFor anyone else who read this before the coffee kicked in and thought "120mio" was the name of a startup or something: Mio is an abbreviation for "millions" as a unit indicator in some financial markets, such as the German, Swiss, and Dutch markets. https://en.wikipedia.org/wiki/Mio https://en.wikipedia.org/wiki/Mio
- sct202 8y agoIf I could purge some of my Facebook messages after a certain age, I think that would be great. When I downloaded my archive, I had circa-2006 messages with people who has since deactivated their accounts but their names were labeled "Facebook User."
- fredley 8y agoThis is a problem with almost any online 'space' - everything sticks around forever. You can go left from anyone's Facebook profile picture and see probably the first picture they uploaded to Facebook. Snapchat's USP was that it didn't (not publically) keep stuff around. I think there's a happy middle ground somewhere were I can set an expiration time on anything I post to such a platform (e.g. Facebook/Twitter) so that it goes private after that time - e.g. a year. It wouldn't even harm the bottom line, since all the money is in new content, and I'd still have a private archive of photos if I ever wanted to download them again. All this is moot for me since I don't use services like this at all, but I think there's an opportunity for a company to get this right.
- sct202 8y agoDefinitely is an opportunity I hope that they pursue. Looking back at my first private messages on the platform like 10+ years ago is just full of cringe.
- TeMPOraL 8y agoSo is reading your own journal. And yet people write them. Despite privacy issues, I still think that things sticking around "forever" on the Internet is a good default. Link rot is already a huge problem when you're trying to reference something you read in the past, and that's without auto-expiry.
- jakear 8y agoBut people don’t tend to publish their life’s journals to every random person who recognizes their name in a list of “would you like to friend request X?”
- rwoodley 8y agoIf someone makes money selling my messages - I want to know how!! I'll start selling them. Never thought this was a monetization possibility.
- ppeetteerr 8y agoThey are selling for $0.1 an account. I'll give you $0.1 for your messages.
- j1vms 8y ago> They are selling for $0.1 an account. The important part is why it's 10 cents an account. Most of the accounts are worthless to them. They are looking for the 1 in 10000 that is worth much more. Security, security, security...
- anjc 8y agoWhy aren't Facebook saying which extension caused this, and why aren't people being notified if their messages are leaked?
- ipsum2 8y agoHow does Facebook know what extensions were installed on the users browsers?
- yoaviram 8y agoIf you've had enough of Facebook's negligence and like many others in recent months have closed your account, use this handy website to send them a GDPR request to make sure they delete all your personal data (disclosure, I'm one of the creators): https://opt-out.eu/?company=facebook.com#nav https://opt-out.eu/?company=facebook.com#nav
- gesman 8y agoYou have to be EU resident for that.
- yoaviram 8y agoIt's more complicated then this. The GDPR does not mention residency. According to some interpretations it's enough that you're located in the EU.
- AlphaWeaver 8y agoLook, I hate Facebook as much as the next guy, but this breach was out of their control. Apparently it was a result of browser extensions harvesting the private information.
- czardoz 8y agoI'm curious to see why you think this is Facebook's negligence. There's little they can do to control a user's browser extensions.
- yoaviram 8y agoYou have a point, although we don't know the details of this attack (they haven't even disclosed the name of the extension) so I guess I'm biased against them in light of recent history. My comment was more general than this particular incident.
- deleted 8y ago[deleted]
- baxtr 8y agoAnyone know if this also affects WhatsApp?
- Scoundreller 8y ago> And the data had probably been obtained through malicious browser extensions. Any reason we shouldn’t suspect a malicious mobile app?
- tonyztan 8y agoWe should also consider the possibility that this is related to the Facebook breach discovered in September, in which attackers got access tokens to 50 million accounts. https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html https://www.nytimes.com/2018/09/28/technology/facebook-hack-...
- kerng 8y agoBrowser extension, although super useful freak me out. Its the operating system equivalent of a kernel driver, getting access to everything. They lack transparency, updates can be sketchy and I dont ever know based on what I should make trust decisions (number of downloads, is it an individual or company, permissions,.. )
- pavel_lishin 8y ago> Facebook said its security had not been compromised. I mean, that's demonstrably untrue.