If you’re awake at about 1am-ish on 29th September 2018 – maybe after a night of partying or late night Friday overtime, then you might have realized all of your devices – desktops, laptops, smartphones,, everything has been logged out of Facebook. It happens concurrently to all devices, and that happened twice, actually.
Why did that happen? That’s because Facebook got hacked. Yes – hacked. The entire “story” behind it is actually quite bizarre.
How it happened
For those who want to start pointing fingers and put the blame on someone, then direct all your fingers to Facebook. Why? Because one of their features – which lets you see your own profile through someone else’s eyes. It’s called the “view as” feature which is available on your own profile right now.
How you actually get “hacked” this time around is someone use the “view as” feature. Because the flawed coding that this feature has, you can actually get the authentication token injected into your browser. You are basically logged in as the user you’re viewing as. This is clearly a security flaw due to poor coding from Facebook engineers.
The usual login process – in a simplified manner – works like this:
- Enter login credentials into the page
- Sends information to the server, authenticates the login
- “Challenges” the login attempt by 2-factor authentication (2FA), if enabled
- If passes the challenge, then the login is considered valid
- An authentication token is stored in your browser to tell the server that you’re already logged in validly
The authentication token is the main “cryptic key” that authenticates your login session with the server. If someone “stole” your authentication key, then they’re essentially in your account already.
The solution?
By logging out of Facebook from every single device you have. That way, Facebook will invalidate all authentication token and will require you to generate a new one. That’s the only way to essentially “fix” this issue.
Of course, Facebook has disabled the “view as” feature until further notice.
I’ve also seen many people recommending you to turn on 2FA or change your password. I have to emphasize that this does not matter as the authentication token is at the end of the password process. Even if you have the most complex password with 2FA enabled, stealing your authentication token will bypass all of that.
By looking at the login process that we highlighted earlier, you’ll know why.
Facebook’s statement
It’s a big issue and everyone knows that. Facebook’s share even dropped more than 3% according to BBC News.
Facebook official statement essentially said that the attack was discovered on 25th September 2018, but only logged out everyone on 28th September 2018. They have about 3 days to gather user’s authentication tokens. Also, Facebook does not know if any of these hacked accounts are compromised.
Mark Zuckerberg himself also stepped out to say something about this security flaw. In summary, Mark mentioned that the flawed feature has been taken offline (which we verified to be true) and once again, they do not know if any accounts are compromised.
There’s nothing anyone can do at this point around. What’s stolen by the hackers are already gone. Facebook needs to tighten up their security – and most importantly their quality assurance for whatever codes/features/products they’re pushing to the users.
Like our Facebook Page here at NasiLemakTech.com for more news and in-depth reviews! Also, join our Facebook Group for insightful information and memes!
Subscribe to our YouTube channel too!
