Facebook Finds No Evidence Third-Party Apps Were Hit in Hack

So far, Facebook has uncovered no evidence that third-party apps were also breached in last week's massive hack on the social networking site.

On Tuesday, the company provided an update on the breach, which stole access to almost 50 million Facebook accounts. A lingering question has been whether any third-party apps that use Facebook as a login service were also ensnared in the hack as well.

"We have now analyzed our logs for all third-party apps installed or logged during the attack we discovered last week. That investigation has so far found no evidence that the attackers accessed any apps using Facebook Login," Guy Rosen, Facebook's vice president of product management, said on Tuesday.

Many popular apps such as Tinder, Uber and Airbnb all let you log into them via your Facebook account, removing the need for you to remember another password. The only problem with this approach is it effectively makes your Facebook account the master key. If it gets breached, you could face hacking risks across all your connected accounts. According to security researchers, a hacker could use this access to track your car rides over an Uber account or view your private messages on Tinder.

Last Friday, Rosen himself told journalists that the breach may have affected third-party apps. It still isn't clear who pulled off the attack, but it involved the hackers looting not passwords, but special access tokens for every affected user account.

"These access tokens enabled someone to use the account as if they were the account holder themselves," he said. "This does mean they could have accessed other third-party apps that were using Facebook login."

In reponse to the hack, the company reset the access tokens for 90 million users. This would've forced anyone affected to re-log back into their Facebook accounts and to any third-party apps connected to them. Unfortunately, not every app may check that an access token for a user has become invalid, Rosen said on Tuesday.

To prevent the hackers from exploiting the access tokens on third-party apps, Rosen said, "We're building a tool to enable developers to manually identify the users of their apps who may have been affected, so that they can log them out." In the meantime, Rosen is advising developers to follow Facebook's best practices on login security, which call for instituting automatic checks on access tokens.

Let's block ads! (Why?)