Assignment Based CA
of
Facebook Security Breaches in 2019
Under Guidance of : Harneet Kaur Ma’am
School of Computer Science and Engineering
Lovely Professional University
Submitted By :
Name :- Navdeep
Reg No :- 11703229
Section :- K17UK
Roll No. :- A17
Facebook Security Breach in 2019
Facebook is an American based online social media platform and social media service
developed by Mark Zukerberg, based on Menlo Park California. Mark Zukerberg the
CEO of Facebook developed a platform for at Harvard University for the use of its
students. It was launched in 2003 and then Mark Zukerberg made it available for
other university students and it to the entire world. Now it is available to every human
on the planet who is above 13 years.
It is the most used social platform in the world with more than 1.3 billion users. It has
collaborated with a large number of online gaming platforms, applications as an
Identity verifying partner. Facebook has takeover WhatsApp and Instagram in the
year 2019 which are also widely used online chatting platforms in the world.
1st Security Breach
In September 2018 Facebook discoverer a big security breach in its application and
website which made a great impact on the security measures of Facebook. The
problem is said to have occurred in the system is that when Facebook made an update
in its application, the Security head of Facebook has given the summary details of 3
vulnerable bugs on Facebook. Two of the bugs were introduced in 2015 as a privacy
security measure for the users while the third one is introduced as a birthday video
uploading option for the users. It is confirmed by Zukerberg’s office that
approximately 50 million account details were compromised. It has confirmed that
hackers have accessed the user's details like Name, Age, Sex and Hometown. It is not
confirmed by the company whether the 3rd party applications account details were
compromised or not.
Due to this breach, Facebook has to lose a great number of user's details, respect for
the company and notice from many of the nation's [Link] has not
revealed the location of the users whose accounts are compromised by hackers to
protect its reputation.
Who performed Breach
After a request by the FBI, Facebook declined to give any information about the
hacker who would behind the attack, or whether users in specific regions were
targeted. According to some reports, It is estimated that the group of hackers behind
this breach may belong to Europe. Facebook has revealed the details that the reason
behind this breach was the shuffling of the security head of Facebook as a head
security officer. Facebook has been making changes in its security teams since Alex
Stamos, its chief security officer, left in August for a teaching position at Stanford
University. Instead of working as an independent group, security team members were
working more closely with product teams in the company. The step, the company
said, is an effort to embed security across every step of Facebook product
development.
The hackers started by using a series of accounts and attacking the accounts of
friends, then friends of friends, and so on down the line, eventually amassing a group
of 400,000 compromised accounts. By making use of some of these accounts, they
managed to steal access tokens for an additional 30 million users before they were
stopped.
Loss to Facebook
Due to this breach, Facebook has lost the personal details of more than 50 million of
its users. Personal details include name, location, contact details, sex of more than 50
million users. Apart from the user's details, Facebook has been fined 5 million dollars
by the USA for losing the personal details of a large number of its citizens. Facebook
has to improve its security features before making more collaborations. Facebook has
been warned by many nation’s governments over this issue.
Shares of Facebook were also affected to a large extent after the data breach
Apart from the various losses the major loss to Facebook, reputation loss to Facebook
users was much high. This breach has widely affected the business of Facebook with
its 1.3 billion users.
Response of Facebook
After getting the news of the security breach, Facebook immediately responded to it
and taken the security measures. Facebook investigated the entire vulnerability and
within few days they found the bugs in the system and removed the particular
option(Birthday Video Option) from Facebook after which the other vulnerabilities
were also discovered by the hackers.
Facebook force logout about 90 million users as a security measure to secure the
personal details of the users. Facebook has also verified the account of approximately
30 million users by their verification processor.
Facebook has created a security check page for its users where users can check
whether their account was impacted by the data breach.
Facebook has confirmed that no other partner application was in problem due to this
vulnerability in the Facebook system.
2nd Security Breach
After a security breach in April-May Facebook faced another security breach in
month of October. This security breach was more severe and big for Facebook which
has created a lot of problem for the online chatting website. This time data breach was
much bigger as data of almost 267 Million Facebook users was compromised. This
time data includes the user ids, phone numbers and full name details of users. The
most dangerous thing which has happened for the Facebook users is that all details are
available on web and can accessed by anyone on this planet which can cause a severe
impact on the privacy of Facebook users.
Who Performed Data Breach
According to the report by comparitech and security researchers of Facebook, this
security breach has not happened and someone has collected the data of Facebook
users who all have public profile. But the statement made by Facebook officials
cannot be acceptable by the users as the database was exposed online for almost two
weeks before the ISP revoked access to the database. Other then this the data of 267
million Facebook users was also available on web for almost 2 weeks before it was
removed by the officials. This is also assumed by the Security experts that hackers
could have exploited a security hole in the Facebook’s API which was updated some
time before by the Facebook officials to protect the application form any of the
security breach in future.
Loss to Facebook
After the news of 2nd data breach in Facebook Application its shares again dropped
175 dollars due to the 2nd security breach occurred in month of August- September.
Facebook was fined $5 million by the US government for losing the personal data of
the users and over privacy violations policy of the USA. UK government also fined
Facebook for $6,44,000 for violating the privacy of its users.
In year 2019 year Facebook has faced a lot of problem due to the 2 security breaches
occurred in the gap of just 2 months.
Response by Facebook
In response to 2nd security breach Facebook has asked and advised its users to opt for
the slightly secure privacy settings, In case any user has public profile should make
some changes in the privacy by following some steps issued by the Facebook
officials.
Step-1 : User has to open Facebook app and tap on the icon on the bottom right
corner(on iOS).
Step-2 : User has to scroll down and tap on the “Setting and Privacy” option and then
tap on the “Privacy Shortcuts”.
Step-3 : User has to tap on “See More Privacy” setting option available in the menu.
Step-4 : User has to set all the fields under “Your Activity”, and make changes in
“How People Can Find and Contact You” and then sub section “Friends” or ”Only
Me”.
Step-5 : Check the availability of user by any other account.
Conclusion
After so many data breaches in many big companies, It is much important for all other
companies to protect themselves from such incidents and this is the main reason that
demand of Cyber Security experts are increasing with a rapid speed. Facebook is
trying to save its application from the hackers along with asking its users to update
their password and follow the guidelines given by the Facebook officials to protect
the data of its users. Everyone should be more careful while using such application
and should make minimum use of such applications where they need to provide lot of
personal data as it can effect their life in very drastic way.
References
[Link]
million-users-exposed-online-1630084-2019-12-20
[Link]
security-snafu-exposes-419-million-user-phone-numbers/#5aee159e1ab7
[Link]