Huge Facebook breach leaves thousands of other apps vulnerable
Huge Facebook breach leaves thousands of other apps
vulnerable
The breach affecting 50m accounts took advantage of
‘tokens’, a system used by third-party platforms such as Spotify
Dan Tynan Tue 2 Oct 2018 20.51 EDT
Remember the Facebook hack last week that compromised at
least 50m accounts? It’s worse than you think.
Last Friday, the social media company revealed a
vulnerability that allowed attackers to steal automated log-in credentials (or
“tokens”).
The tokens make it easier for people to log into popular
apps and services like Spotify, Pinterest, or Yelp. The flaw, which has been
present since July 2017, was discovered last month after Facebook engineers
noticed unusual login activity.
While the scope of that attack is still being discovered,
independent researchers say the damage could extend far beyond Facebook’s
borders.
Jason Polakis, an assistant professor of computer science
at the University of Illinois at Chicago, recently co-authored a paper on
vulnerabilities in Single Sign-On (SSO) systems, similar to the one used by
Facebook.
Polakis says the token breach affects far more than
Facebook – it’s a potential backdoor to thousands of third-party apps and
websites.
‘Shortcuts have consequences’
Simply put, a token is a unique string of letters and
numbers that can be used to automatically log you in to other apps and
websites, so you don’t have to keep entering your password.
Unfortunately, from a security standpoint, using Facebook
or any other social media app to log into other services is not a smart thing
to do, says Dana Simberkoff, chief risk, privacy, and information security
officer for enterprise security firm Avepoint.
“It’s easy and convenient, but when you use shortcuts
there can be consequences,” she says. “You should not use one app to log into
another, because when one of those systems is compromised, everything else you
interact with can be as well.”
This is exactly what happened. Thanks to multiple bugs in
Facebook’s View As and video posting features, user tokens were exposed to
attackers, who then extracted them from the page’s HTML code.
Once an attacker discovered how to steal one person’s
token, it would be a simple matter of automating the process to compromise
millions of Facebook accounts, as well as any third-party accounts (like
Spotify or Pinterest) that rely on those Facebook tokens.
In response, Facebook disabled the buggy features on its
site, changed the tokens for 90 million users, and logged them out. When users
log back in, a new token is generated. While that may stop future attackers
from stealing their login credentials, it may not do much to mitigate any
compromises that have already occurred.
In other words, if attackers have already used your
Facebook credentials to log into one of your apps, they may still be there,
depending on the app’s security settings, says Polakis.
“If they use tokens to attack third-party apps before the
tokens were invalidated, things become much trickier,” he says. “On many
websites, we found that attackers could reset the account’s email and then set
a password without knowing the account’s actual password. So even if single
sign-on no longer works and the attacker no longer has access to that Facebook
account, they could still maintain access to the third-party account.”
When testing this attack scenario, Polakis and his fellow
researchers accessed accounts on 29 of the web’s most popular sites and were
still able to log into 22 of them, even after losing access to the Facebook
accounts.
It gets even worse. Even if you’ve never used Facebook’s
sign-in for an app or website, an attacker could still use the token to log in
as you, provided you use the same email address for both services, says
Polakis.
And if you don’t yet have an account on these services,
attackers can use tokens to create one in your name, which can sit dormant
waiting for you to eventually log in so they can steal your personal information.
As this story was going to press, Facebook issued a new
statement declaring that it had found no evidence that attackers accessed any
apps using Facebook login, and that apps created using the company’s official
software development kit (SDK) should have been protected when user tokens were
reset. However, Facebook apps created without the SDK may still be vulnerable.
What can you do?
The Guardian contacted six of the most popular apps and
websites, as well as Facebook, asking for their advice on what steps users
should take. Yelp had no comment, while a Spotify spokesperson said the music
service had not suffered a security breach and advised users to change their
passwords. At publication time, no other companies had responded.
Changing your passwords may or may not help, depending on
the application, but it’s a reasonable thing to do, says Polakis. If you fear
you’ve already been compromised, you should also look for unusual activity on
those accounts, he adds.
All users can practice better app hygiene by disabling
permissions that may be set by default and removing apps they rarely use,
suggests Will LaSala, director of security solutions at the trusted identity
platform OneSpan. He also recommends turning on two-factor authentication, when
available, which asks for a second factor (like a PIN sent by text message)
when the system detects logins from unfamiliar devices.
You can prevent similar attacks in the future by
disabling the auto-logins for Facebook and any other third-party authentication
systems, such as Google or Twitter, suggests Simberkoff.
In other words, don’t sacrifice security for convenience.
“It may be time consuming and annoying to change the way
you authenticate into each system,” she says. “But you should be the captain of
your own ship, and the destiny of your personal information is in your hands.”
Comments
Post a Comment