Over the weekend news developed around a Facebook blog post on protecting people on the social site. In the post, the Facebook Security team notified users that several employee laptops had been attacked last month. They assured users that the issue was spotted quickly and addressed, protecting private user data.
According to the Facebook article:
This attack occurred when a handful of employees visited a mobile developer website that was compromised. The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement, and began a significant investigation that continues to this day.
Sean Gallagher detailed the hack that used a zero-day Java attack for ArsTechnica:
Facebook’s internal security team worked with a third party to “sinkhole” the attackers’ command server, taking over the network traffic coming into it from systems infected by its malware. They discovered traffic coming from several other companies, according to Facebook Chief Security Officer Joe Sullivan. Facebook notified those companies of the attack, and it has turned the case over to federal law enforcement. An investigation is still ongoing. While some of the affected companies were aware of an ongoing attack, others were unaware of the problem before being notified by Facebook.
The attack was discovered when a suspicious domain was detected in Facebook’s Domain Name Service request logs. According to Sullivan, the requests were tracked back to the laptop of an engineer working on mobile application development projects. Forensic analysis of the files on the laptop led to the discovery of a number of other compromised systems.
Every report published to date stresses that private Facebook user data was never accessed and remains secure. The Java security weaknesses have been chronicled over the last few weeks and include hacks into Twitter that prompted the micro-blogging community to reset over 250,000 user passwords.
Since Facebook’s business model is based on monetizing user data for ad targeting, they must maintain a high degree of trust in their security measures. If users begin to lose faith in the privacy provided by the largest social network on the planet, they can be counted on to simply stop sharing. If that happens, Facebook would no longer rake in the massive amounts of data on user activity they package for Facebook advertisers and application developers.
What are your thoughts? Is it only a matter of time before there is a major breach in Facebook user security? Does this vulnerability make you rethink the way you interact online?
Image Credit: Aurich Lawson
