This morning, Facebook disclosed a widespread security flaw that could have allowed hackers or other malicious third parties to access an affected user’s account by gleaning their security token. The flaw affected as many as 50 million people, and Facebook says it’s forcibly making around 90 million users log back into their accounts in full today to be safe. The company says that’s because in addition to the impacted accounts, around 40 million additional people simply used the exploitable feature since the exploit was active starting in July of 2017
It also says it’s fixed the issue and alerted law enforcement, indicating that this is not an engineering mistake, but a purposeful exploit discovered and used by some third-party organization or hacker. The company says its engineering team was made aware of the issue on September 25th, but Guy Rosen, Facebook’s vice president of product management, says it’s not clear whether accounts were compromised, when the issue was exploited, or who might have been behind the attack.
Read more: https://www.theverge.com/2018/9/28/17914524/facebook-bug-50-million-affected-security-token-access-view-as-feature