Internet Security

Tech Tip – Find Out When You’re Visiting A Site That’s Been Hacked

Posted on by Andy Miller

If you use Google Chrome and you’d like to make sure that you know when you’re visiting a site that’s been hacked, and you’d like to set up a watch list for sites that you regularly visit, or those that store personal data, here’s a handy browser extension that could help.

The HackNotice extension for Google Chrome could help you to add another layer of security to your browsing.  To use it:

In Chrome, Google ‘hacknotice extension’.

Click on the link.

Click on the ‘Add to Chrome’ button (top right).

Follow the instructions.

SIM Swap Scam Warning

Posted on by Andy Miller

A recent investigation by BBC TV’s Watchdog Live revealed evidence that some mobile phone shop staff are not conducting proper ID checks for replacement SIM requests, thereby enabling some customers to become victims of SIM swap scams.

What is a SIM Swap Scam?

SIM swap scams are believed to have been in existence for the last four years in one form or another.  In its current form, the SIM swap scan happens when a fraudster goes into a mobile operator’s shop and claims a false identity i.e. the identity of one of that operator’s customers.  The fraudster knows that the person they are claiming to be is a customer of that operator because of personal details that have been stolen in previous malware or cyber-attacks, and those details have been posted or sold on the dark web.

In the shop, while pretending to be that customer, the fraudster claims that their phone has been lost or stolen and asks to be issued with a replacement SIM. Once the fraudster has the replacement SIM, the victim’s SIM no longer works, and the fraudster can then access any online service that requires security codes to be sent to the phone, as well as being able to access any other of the victim’s personal details that are stored on the SIM.

In the past (London 2016), a similar version of the scam worked when fraudsters used an intercepted bank statement from the victim (or information found on social media) to call the person’s mobile operator, pass security checks, and get a blank SIM card.  The fraudsters were then able to access the unique codes sent by the victim’s bank to log into their account and transfer funds.

What Should Happen When Someone Requests a Replacement SIM?

At the moment, mobile operators should conduct i.d. checks for replacement SIMs, but it is not compulsory.  Also, the Watchdog Live investigation revealed that checks for contract customers and Pay As You Go customers may differ.  For example, O2 said that it only asks for photo ID when replacing SIMs on monthly contracts, and that Pay As You Go customers will be sent an authorisation code if someone is trying to access the number.

What Happened in Reality?

In the investigation, which involved the secret filming of Watchdog Live’s own ‘King Con’ former fraudster in multiple EE, O2, Three and Vodafone stores, EE and Three staff conducted all the necessary checks, but Vodafone blamed rogue employees for not doing so.  Also, replacement SIMs were obtained from O2 stores and the authorisation codes that the company says it sends out were not received.

What Does This Mean For Your Business?

It appears that this relatively old fraud is still very much alive and is a reminder of how valuable our personal details can be to criminals. Bearing in mind how serious this fraud can be to the victims, it is shocking that photo ID checks for replacement SIMs are not made to be compulsory for all operators in all situations.  Mobile operators could help themselves and customers by introducing compulsory measures and by making sure through training and in-built systems that all staff conduct satisfactory checks.

It is also worrying that the investigation appears to have revealed a two-tiered security system, with Pay As You Go customers afforded less protection.

In the meantime, one way that we can help ourselves is to regularly check both our phone and bank statements, and if you have a contract with e.g. O2, contact them to confirm that no replacement SIMs have been issued in your name.

Free VPN Tools May Be Linked To China

Posted on by Andy Miller

A new investigation by Metric Labs of the top free VPN (Virtual Private Network) apps in Apple’s App Store and Google Play has revealed that more than half are run by companies with Chinese ownership.

What’s A VPN?

A ‘Virtual Private Network’ (VPN) is generally used to keep internet activity private, evade censorship / maintain net neutrality and use public Wi-Fi securely e.g. avoid threats such as man-in-the-middle attacks.  A VPN achieves this by diverting a user’s traffic via a remote server in order to replace their IP address while offering the user a secure, encrypted connection (like a secure tunnel) between the user’s device and the VPN service.

Popular Free Apps

VPNs (Forbes, 2017) are the most searched-for apps in the world, partly because people have become much more concerned with privacy and they have become more afraid of government surveillance of their digital activities.  For example, the UK government’s Investigatory Powers Bill), which was passed into 29th November 2016 as the Investigatory Powers Act (“Snooper’s charter”) means that a large list of UK agencies, including various police forces and government departments, can ask for any UK citizen’s stored browsing history (details of every website and instant messaging apps that you have visited or used in the past 12 months).

China Links To Free VPNs – Security & Privacy Concerns

Bearing in mind that the main reason for getting a VPN is to preserve your privacy and security, the problem with the results of the Metric Labs survey is that they show that over half of the top free VPN apps that people can find e.g. in the App Store and Play Store for UK and US, have Chinese ownership or are based in China.

The problem with being linked to (or based in) China, according to the report about the Metric Labs (top10vpn) survey, is that China tightly controls access to the Internet from within the country, has clamped down on VPN services, and many of the free VPN services with links to China offer little or no privacy protection and no user support.

How Bad Are They?

The investigation revealed that 17 of the 30 top free VPN apps available from simple online searches have links to China and 86% of those apps have security issues.  It was also discovered that 64% of apps have no dedicated website, and 86% of apps have unacceptable privacy policies with many being presented in an amateur fashion e.g. posted on a Free WordPress sites with ads.  Some of the privacy policies either give no information about the sharing of information with third parties, have no privacy policy at all, use a stock privacy policy not related to VPNs, or simply state that information will be shared with China.

What Does This Mean For Your Business?

When you bear in mind that the reason for downloading a VPN app is to preserve privacy, the results of this investigation indicate that simply trusting one of the free VPN apps available online, and without pausing to look at its privacy information or look too much into it could be a mistake.  If your privacy is valuable to you (and you’ve not already been provided with a trusted VPN), it may be worth seeking out a trusted paid-for service. There are many lists available online from Tech magazines that offer useful comparisons and information to help you choose a VPN that will give you the right levels of performance and security.

Firefox Quantum Browser’s ‘Monitor 2.0’ Will Warn You About Security Breaches

Posted on by Andy Miller

Mozilla’s latest update for its Firefox Quantum browser includes the Firefox Monitor 2.0 security tool, which can tell you whether a site you’re visiting has suffered a security breach in the last 12 months and whether your details have been leaked online.

Developed in Partnership with HIBP

Back in June, the Mozilla blog detailed how it was testing the Firefox Monitor tool which was being developed in partnership with HaveIBeenPwned.com (HIBP), a service run by Troy Hunt, described by Mozilla as “one of the most renowned and respected security experts and bloggers in the world”.  At the time of testing, it was announced that Monitor, through its HIBP / Firefox partnership, would be able to check a user’s email address against the HIBP database in a private-by-design way.  Mozilla said that visitors to the Firefox Monitor website would be able to check (by entering an email address) to see if their accounts were included in any known data breaches, with details on sites and other sources of breaches and the types of personal data exposed in each breach. It was also announced that the Firefox site would offer recommendations on what to do in the case of a data breach, and how to help the user to secure their accounts.

Rolled Out

The Monitor 2.0 security tool that’s just been rolled out in the latest Firefox Quantum update can tell you if your details have been leaked online (if you visit monitor.firefox.com), provide a desktop notification /alert when you visit a website that’s been compromised in the last 12 months, and give extra security details such as how many accounts were affected by a breach and what happened in the breach.

You Can Turn Notifications Off

Mozilla has been quick to point out that the Monitor tool has been designed to help but not annoy users and as such, if you’ve already been told about the potential security issues, you can navigate back without being told again and you can disable the notifications altogether with a just few clicks, if you’d prefer not to see them.

What Does This Mean For Your Business?

Google Chrome dominates the browser market, but there is still a lot of competition among those fighting it out with a less than 10% share of the market – Apple’s Safari, Firefox, Microsoft’s Internet Explorer & Edge.  Adding this tool, that’s linked to a renowned security expert, to the Firefox browser could add some real value at a time when the news is full of major security breaches, but most of us may not know how to check whether our details have been stolen, and what to do next.

Businesses always need to be very security-conscious, particularly since the introduction of GDPR, and being able to see notifications about pages that have been breached may be another way that business users can help to protect themselves.

The tips and personal stories of those who have been affected by a data breach highlighted on the Firefox website for Quantum business users may also help raise awareness about online privacy and could help provide prompts and ideas to help keep improving data protection and cyber resilience in businesses.

Adult Site Visits on Work Computer Lead to Network Infection

Posted on by Andy Miller

The extensive online porn-accessing habit of an employee of a US government department known as the US Geological Survey (USGS) is being blamed for a government computer network becoming infected with malware.

9,000 Pages

In an investigation, highlighted in a paper (published online) by the US Office of the Inspector General, it was discovered that the unnamed employee is alleged to have accessed 9,000 pages on adult pornography websites.

Infected

It is believed that the infection of the government network happened after the employee used their work laptop to visit pornographic websites, some of which originated in Russia and contained malware, thereby compromising and infecting the laptop. It was from this laptop that the malware was able to spread to the government network.

The employee is also reported to have saved images from the infected websites onto an unauthorised USB device, and to a personal Android phone that was connected to the government-issued computer. This resulted in the Android phone also becoming infected with malware.

Stealing Information

The big risk with malware is, of course, that it is designed to steal information and spread to other systems, and in the case of ransomware, for example, to destroy files, lock-down systems, and extort money.

Malware

In the UK, a government report from April this year found that nearly half the businesses in the UK have fallen victim to cyber attacks or security breaches in the last year, and that the most common breaches involved fraudulent emails e.g. phishing, attempts by scammers to impersonate the organisation online, as well as viruses and malware. The annual Verizon data breach investigations report from April showed that ransomware is the most popular form of malware used in cyber-attacks, and this type of malware is responsible for 40% of all successful malware attacks. The use of ransomware has doubled over the last year.

What Does This Mean For Your Business?

In this case, the use of USB devices and government computers for personal use was against the rules, but this didn’t appear to be actively monitored and / or enforced. As the government department discovered to their cost, and too late, it may have been better to address such obvious security vulnerabilities by restricting web access to certain types of websites (and monitoring this), disabling USB connections on government-issued computers, providing IT security training, and developing a well-communicated IT security policy.

This story also highlights the risks of policies such as ‘bring your own device’ in businesses. BYOD policies allow employees to bring in their personally owned laptops, tablets, smart-phones and even storage devices, and use them to access company information and applications, and solve work problems. Unfortunately, as shown in this story and in a study by SME card payment services firm Paymentsense back in May, BYOD schemes and using USB storage devices can increase the cyber-security risks for businesses and organisations. The most popular types of BYOD security incidents in the last 12 months include malware, which affected two-thirds (65%) of SMEs, and viruses (42%).

These days, secure cloud storage and storage on secure company systems are provided, and this, combined with adequate security training and forbidding the use of USB ports (closing USB ports) on company computers could be ways of minimising this kind of security risk for many businesses.

Ubicoustics Overhears Everything You Do … And Understands

Posted on by Andy Miller

Researchers in the US have presented a paper based on their research that identified a real-time, activity recognition system capable of interpreting collected sounds that could well be used by home smart speakers.

Identify Other Sounds, and Issue Responses

Researchers at Carnegie Mellon University in the US claim to have discovered a way that the ubiquity of microphones in modern computing devices, and software that could use a device’s always-on built-in microphones could be used to identify all sounds in room, thereby enabling context-related responses from smart devices. For example, if a smart device such as an Amazon Echo were equipped with the technology, and could identify the sound of a tap running in the background in a home, it could issue a reminder to turn the tap off.

Ubicoustics

The research project, dubbed ‘Ubicoustics’, identified how using an AI /machine learning based sound-labeling mode, drawing on sound effects libraries, could be linked to the microphone (as the listening element) of a smart device e.g. smart-watches, computers, mobile devices, and smart speakers.

As Good As A Human

The sound-identifying, machine-learning model used in the research system was able to achieve human-level performance in recognition accuracy and false positive rejection. The reported accuracy level of 80.4%, and the misclassification level of around one sound in five sounds, means that it is comparable to a person trying to identify a sound.

As well as being comparable to other high-performance sound recognition systems, the Ubicoustics system has the added benefit of being able to recognise a much wider range of activities without site-specific training.

Applications

The researchers noted several possible applications of the system used in conjunction with smart devices e.g. sending a notification when a laundry load finished, promoting public health by detecting frequent coughs or sneezes and enabling smart-watches to prompt healthy behaviours after tracking the onset of symptoms.

Privacy Concerns

The obvious worry with a system of this kind is that it could represent an invasion of privacy and could be used to take eavesdropping to a new level i.e. meaning that we could all be living in what is essentially a bugged house.

The researchers suggest a potential privacy protection measure could be to convert all live audio data into low resolution Mel spectrograms (64 bins), thereby making speech recovery sufficiently difficult, or simply running the acoustic model locally on devices so no audio data is transmitted.

What Does This Mean For Your Business?

The ability of a smart device to be able to recognise all sounds in a room (as well as a person can) and to deliver relevant responses could be valued if used in a responsible, helpful, and not an annoying way. It doesn’t detract from the fact that, knowing that having a device with these capabilities in the home or office could represent a privacy and security risk, and has more than a whiff of ‘big brother’ about it. Indeed, the researchers recognised that people may not want sensitive, fine-grained data going to third-parties, and that operating a device with this system but without transmission of the data could provide a competitive edge in the marketplace.

Nevertheless, it could also represent new opportunities for customer service, diagnostics for home and business products / services, crime detection and prevention, targeted promotions, and a whole range of other possibilities.

New Tech Laws For AI Bots & Better Passwords

Posted on by Andy Miller

It may be no surprise to hear that California, home of Silicon Valley, has become the first state to pass laws to make AI bots ‘introduce themselves’ (i.e. identify themselves as bots), and to ban weak default passwords. Other states and countries (including the UK) may follow.

Bot Law

With more organisations turning to bots to help them create scalable, 24-hour customer services, together with the interests of transparency at a time when AI is moving forward at a frightening pace, California has just passed a law to make bots identify themselves as such on first contact. Also, in the light of the recent US election interferences, and taking account of the fact that AI bots can be made to do whatever they are instructed to do, it is thought that the law has also been passed to prevent bots from being able to influence election votes or to incentivise sales.

Duplex

The ability of Google’s Duplex technology to make the Google Assistant AI bot sound like a human and potentially fool those it communicates with is believed to have been one of the drivers for the new law being passed. Google Duplex is an automated system that can make phone calls on your behalf and has a natural-sounding human voice instead of a robotic one. Duplex can understand complex sentences, fast speech and long remarks, and is so authentic that Google has already said that, in the interests of transparency, it will build-in the requirement to inform those receiving a call that it is from Google Assistant / Google Duplex.

Amazon, IBM, Microsoft and Cisco are also all thought to be in the market to get highly convincing and effective automated agents.

Only Bad Bots

The new bot law, which won’t officially take effect until July 2019 is only designed to outlaw bots that are made and deployed with the intent to mislead the other person about its artificial identity for the purpose of knowingly deceiving.

Get Rid of Default Passwords

The other recent tech law passed in California and making the news is a law banning easy to crack but surprisingly popular default passwords, such as ‘admin’, ‘123456’ and ‘password’ in all new consumer electronics from 2020. In 2017, for example, the most commonly used passwords were reported to be 123456, password, 12345678 and qwerty (Splashdata). ‘Admin’ also made number 11 on the top 25 most popular password lists, and it is estimated that 10% of people have used at least one of the 25 worst passwords on the list, with nearly 3% of people having used the worst password, 123456.

The fear is, of course, that weak passwords are a security risk anyway, and leaving easy default passwords in consumer electronics products and routers from service providers has been a way to give hackers easier access to the IoT. Devices that have been taken over because of poor passwords can be used to conduct cyber attacks e.g. as part of a botnet in a DDoS attack, without a user’s knowledge.

Password Law

The new law requires each device to come with a pre-programmed password that is unique to each device, and mandates any new device to contain a security feature that asks the user to generate a new means of authentication before access is granted to the device for the first time. This means that users will be forced to change the unique password to something new as soon as the device is switched on for the first time.

What Does This Mean For Your Business?

For businesses using bots to engage with customers, if the organisation has good intentions, there should not be a problem with making sure that the bot informs people that it is a bot and not a human, As AI bots become more complex and convincing, this law may become more valuable. Some critics, however, see the passing of this law as another of the many reactions and messages being sent about interference by foreign powers e.g. Russia, in US or UK affairs.

Stopping the use of default passwords in electrical devices and forcing users to change the password on first use of the item sounds like a very useful and practical law that could go some way to preventing some hackers from gaining easy access to and taking over IoT devices e.g. for use as part of a botnet in bigger attacks. It has long been known that having the same default password in IoT devices and some popular routers has been a vulnerability that, unknown to the buyers of those devices, has given cyber-criminals the upper hand. A law of this kind, therefore, must at least go some way in protecting consumers and the companies making smart electrical devices.

How Business Emails Are Vulnerable

Posted on by Andy Miller

Research by digital risk management and threat intelligence firm Digital Shadows has revealed that company credentials and emails that can be easily accessed on the web are making it easier for cyber-criminals to target businesses with attacks.

What’s Are The Problems?

According to the research, businesses may be suffering targeted attacks because several key problems that are caused by the results of previous hacks and breaches, and by current poor security practices. These problems are that:

  • Around 12.5 million company email archive files are publicly accessible due to misconfigured archive storage drives e.g. FTP and Amazon S3 buckets. Business emails contain sensitive personal and financial information e.g. the research uncovered 27,000 invoices, 7,000 purchase orders and 21,000 payment records. These things are valuable to cyber-criminals as they help them to target attack methods such as phishing.
  • Improper backing-up of email archives has contributed to their exposure online.
  • Criminal forums e.g. on the dark web, now contain some 33,568 finance department email addresses that have been exposed in third-party breaches, 27,992 of which have passwords associated with them. These forums also contain large numbers of the business of email access credentials, some of which are reported by the research to be worth $5,000 for a single username and password pair to cyber-criminals.
  • Email hacking services can be purchased for as little as $150, with results available in a week or less. The researchers were even offered a 20% share of the proceeds that could be harvested from exploiting email vulnerabilities.

What Does This Mean For Your Business?

Business email credentials have a high potential return on investment to cyber-criminals, and therefore have a high value, which is why many cyber-criminals feel that it is worth looking for them and paying substantial amounts for them on criminal forums. The high value may mean that criminals may even collaborate to target larger organisations. Hacks and breaches over time, together with the subsequent buying and selling of the stolen email credentials may mean that many businesses are exposed to multiple types of email attack such as phishing, and man-in-the-middle attacks without even knowing it.

One thing the research does show is that by tightening up email security practices, businesses could reduce the risks that they face. Measures that companies could take to help reduce such risks include:

  • Including business email compromise (BEC) in business continuity planning and disaster recovery planning.
  • Strengthening wire transfer / BACs controls by e.g. building-in manual controls and as well as multiple-person authorisations to approve significant amounts.
  • Improving staff training to enable them to follow practices that minimise company email and other security risks.
  • Continuously monitoring for any exposed credentials (particularly those of finance department emails), and conducting assessments of executives’ digital footprints e.g. using Google Alerts to track new web content related to them.
  • Preventing email archives from being publicly exposed e.g. by making sure that archive storage drives are configured correctly.
    Being very careful where contractors back-up emails on network-attached storage (NAS) devices is concerned. Making users have passwords, disabling guest / anonymous access, and insisting on NAS devices that are secured by default could help.

Goodbye Skype Classic, Hello Blockchain-as-a-Service

Posted on by Andy Miller

Just as November will see Microsoft asking Skype users to switch from Skype Classic to version 8, tech commentators are predicting that Microsoft and other companies will be looking to start reaping the financial benefits of offering blockchain as a service (BaaS).

Skype Classic Replaced By Version 8

Microsoft has announced that it will be moving all users of the Classic version of its Skype video call software to version 8 of the software from 1st November for desktop, and 15th November for mobile and tablets.

The company says that it will be sending out notifications to those using the older versions of Skype by the end of October to warn them that they may lose functionality if they don’t switch to version 8.

Why?

The reason for the move is to ensure that users of desktop and smaller screens i.e. tablets or mobiles have the same experience of the program. This is because version 8 applications have been optimized to work in conjunction with modern, mobile-friendly cloud services architecture.

Fewer Features, For Now

Microsoft has admitted that the newer version of Skype won’t offer the same features as the previous versions, but the company has said that it plans to re-introduce some of those features.

Meanwhile, Skype’s Insider community is able to access and test the new ‘Skype 14’ via the Microsoft Store.

Making The Most of Blockchain

Tech commentators have noted that Microsoft and many of the other big tech companies, including Amazon and Oracle, are now looking to make the most of the growing blockchain as a service (BaaS) market. Microsoft was one of the first software vendors to offer BaaS on its Azure cloud platform as far back as 2015, but the predictions are that from the end of this year onwards, the market (estimated to be worth $7billion) will start to grow rapidly.

What Is Blockchain?

Blockchain, the open-source, free technology behind crypto-currencies like Bitcoin, is an incorruptible peer-to-peer network (a kind of ledger) that allows multiple parties to transfer value in a secure and transparent way. Blockchain’s Co-Founder Nic Carey describes blockchain as being like “a big spreadsheet in the cloud that anyone can use, but no one can erase or modify”.

Why?

The BaaS market is likely to take off in a much bigger way because it offers enterprises the chance to deploy distributed ledgers without the cost or risk of deploying it in-house, and without needing to find in-house developers.

Big Tech Companies Well-Placed

Tech commentators have noted that as well as Microsoft, big companies who look well-placed to have the resources claim a major stake in the BaaS market include Amazon, Oracle, Salesforce.com, and VMware.

It is also believed that large online real-estate/mortgage companies such as Redfin, Zillow, and LendingTree could benefit from using blockchain-based online services in the transfer of property.

Real-World Blockchain Examples

The benefits of blockchain technology are already being in enjoyed by many companies, and some of the ways that it is currently being deployed include:

  • Walmart’s pilots where the time it takes to trace a food item from shop to farm was reduced, through the use of blockchain, from 7 days to just 2.2 seconds.
  • A pilot project between car-maker BMW and start-up Circulor with a view to eliminating battery minerals produced using child labour. In that project, blockchain is being used to help provide a way to prove that artisanal miners are not using child labour in their cobalt mining activities.
  • Using the data on a blockchain ledger to record the temperature of sensitive medicines being transported from manufacturer to hospital in hot climates. The ‘incorruptible’ aspect of the blockchain data gives a clear record of care and responsibility along the whole supply chain.
  • Using an IBM-based blockchain ledger to record data about wine certification, ownership and storage history. This has helped to combat fraud in the industry and has provided provenance and re-assurance to buyers.
  • Shipping Company Maersk using a blockchain-based system for tracking consignments that addresses visibility and efficiency i.e. digitising a formerly paper-based process that involved multiple interactions.
  • Start-up company ‘Electron’ building a blockchain-based system for sharing information between those involved in supplying energy which could speed up and simplify the supplier switching process. It may also be used for smart grid processes, such as local load-balancing of supply and demand.

Launches

It has also been reported that Hewlett-Packard Enterprise (HPE) has launched a BaaS flexible charging offering, and SAP has also launched BaaS on its Leonardo digital software platform.

What Does This Mean For Your Business?

The fact that we now use mobiles devices more than desktop computers for work and leisure made it more or less inevitable that Microsoft would want to make changes to Skype to make the mobile experience of the program a priority.

The benefits of blockchain technology are just starting to be realised and exploited by many different companies around the world. The BaaS market is, therefore, still at the beginning of the curve, and it makes sense that big tech companies are well placed to be in the market early with their enterprise offerings. BaaS offers businesses the opportunity to harness the power and unique benefits of blockchain without the costs, and difficulties of trying to develop their own in-house offerings. Blockchain has already proven itself to be a technology that can save time and costs, provide fast and secure traceability, visibility and efficiency, and provide a real competitive advantage for companies that are willing to investigate how it could be used to add value to their particular business.

Even governments and cities around the world have realised the benefits and are committing considerable resources to the use of blockchain. For example, Dubai has committed to putting all of its documents on blockchain in the next few years and has founded a public-private initiative called the Global Blockchain Council to foster the development and use of blockchain technology in and between local government teams, local businesses and international start-ups.

Facebook Hack Keeps Getting Worse

Posted on by Andy Miller

As if the recent Facebook hack of 50 million user accounts that was discovered on 25th September wasn’t bad enough, it became apparent that it could also affect “Facebook Login” service, which allows other apps to use people’s Facebook account to login.

What Happened?

On Tuesday 25 September, Facebook engineers discovered that hackers had used a vulnerability in Facebook’s “View As” feature (which lets people see how their profiles appear to others) to steal digital keys known as “access tokens” from any accounts of people whose profiles were searched for using the “View As” feature. This meant that hackers were able to move from one Facebook friend to another, taking control of all those accounts along the way. It is estimated that the staggering number of 50 million user accounts were compromised in this way.

It has been reported that Facebook had noted a spike in the number of people using the “View As” feature in relations to Facebook’s video uploading feature for posting “happy birthday” messages (a known, year-old vulnerability), but didn’t put two and two together at that point. Even though the hack was reported to have been discovered by Facebook on Thursday 25th September, It is now thought that the hack actually took place on 16th September.

Reporting Problems

Even though less than 10% of the 50 million Facebook accounts affected by the security breach were in the European Union, this is still a significant number, and required a report within 72 hours of discovery of the breach to comply with GDPR. It has been reported, however, that Ireland’s Data Protection Commission (DPC) has said that Facebook’s initial notification to the regulator about the breach (on Thursday) didn’t have enough detail, and this could lead to an official investigation and possibly some (substantial) fines. Facebook’s discovery of the breach on the Tuesday, and notification to Ireland DPC on the Thursday meant that, at least it kept within the 72-hour disclosure deadline required under GDPR.

Worse – Other Services Using Login By Facebook Could Be Affected

One of the things that has made the breach even worse than was previously thought is that, if you use Facebook to log into other services, such as Instagram (owned by Facebook), Tinder, Spotify and even Airbnb, the attackers could also use the stolen access tokens to gain the same level of access to any of these, and may have been able to steal all of your profile info, photos, private messages and more. The fact that the hackers have stolen tokens means that they don’t need to enter a username and password to access a site because the token is a signal that they’re already logged in.

Fixed, Says Facebook

Facebook has reported that it has now fixed the flaw by logging everyone out of their accounts and suspending the “view as” feature.

What Does This Mean For Your Business?

This hack was on a massive scale, and was the biggest in Facebook’s history, coming not long after the revelations about Facebook’s sharing of its customer data with Cambridge Analytica for political purposes. This has undoubtedly dealt another blow to Facebook’s reputation but more importantly, it could lead to further problems for Facebook’s users. The fact that the hackers were able to steal tokens, thereby rendering strong passwords and multi-factor authentication useless (which is frightening in itself), means that the attackers could use any personal data and information that they may have harvested from Facebook and other Facebook login sites to target users in future cyber attacks. The information taken could, for example, be used in phishing attacks, fraud, and even blackmail. The information used for blackmail (photos, private messages, etc) could even cause damage to personal and work relationships.

Once again, it seems, we can’t trust a major tech company to adequately protect our personal data and information, even after it has gone to the trouble, over the last few months, of spending large amounts on advertising campaigns to tell us how much it can be trusted. Even though the initial crime appears to be a large-scale hack, the fact is that users could find themselves being the victim of cyber attacks in future because of the information that has been stolen.