MANILA - The National Privacy Commission said Sunday it has begun probing the security breach reported by Facebook, which logged out millions of users last Friday.
Facebook had already posted a "security update" statement, explaining how a "security issue" affected around 50 million Facebook accounts.
But lawyer Kiko Acero from the commission's Complaints and Investigation Division said they still need a clearer explanation on what really happened.
"Kung ginamit siya ng isang taong may malicious intent, hinahanap namin sino yung naging pabaya sa problemang 'to… Lahat 'yan tinitignan namin," he said.
(If it was used by a person with malicious intent, we want to know who is liable for this problem. We are looking into all of this.)
In a statement, Facebook said they took immediate measures upon learning the security issue, which caused around 90 million Facebook users worldwide to be logged out of their accounts.
"Our investigation is still in its early stages. But it’s clear that attackers exploited a vulnerability in Facebook’s code that impacted 'View As' a feature," Facebook said.
"This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts. Access tokens are the equivalent of digital keys that keep people logged in," it added.
Manila Bulletin technology news editor Art Samaniego said the Facebook users who were logged out of their accounts could be potential targets of hackers.
Samaniego said this may put all other social media sites and service applications connected to an account at risk because "token sessions" are involved.
"Ito yung digital signature natin na pag nag-log in sa Facebook, malalaman ng apps and services na ikaw 'yun. Pag nag-log in ka via Facebook makukuha 'yung mga details mo," he said.
(This is our digital signature when we log into Facebook, which lets apps and services know that it is you. When you log in via Facebook, your details will be known.)
"Ibig-sabihin pag nanakaw to (token sessions) ng mga hacker. Puwede niya ma-log in 'yun sa mga services na ginagamit mo halimbawa Instagram, WhatsApp, Tindr," he added.
(This means that if these tokens are stolen by hackers, they can log into the services you use like Instagram, WhatsApp, Tindr.)
Samaniego urged users to use two-factor authentication for their accounts. He also discouraged netizens from using the same passwords for different accounts.
source: news.abs-cbn.com
LONDON - Phone numbers and other personal details of senior ministers from Britain's Conservative party were made public by an app security flaw on Saturday, including those of top Brexiteers Michael Gove and Boris Johnson.
Several top MPs reportedly received nuisance calls after their profiles were accessed on the official mobile application for the annual party conference, which kicks off this weekend.
The security breach saw members of the public able to enter the profiles using just the politicians' email addresses -- easily available online -- to view and edit the data stored within.
Former foreign secretary Johnson had his profile picture briefly swapped for pornography and his job title changed to an profane insult, according to several Twitter users.
Meanwhile Environment Secretary Gove's picture was changed to one of media tycoon Rupert Murdoch, his former employer when he was a journalist.
Among the first to report the flaw was Dawn Foster, a columnist for daily The Guardian.
"The Tory conference app allows you to log in as other people and view their contact details just with their email address, no emailed security links, and post comments as them," she wrote on Twitter, using a colloquial name for the party.
"They've essentially made every journalist, politician and attendee's mobile number public. Fantastic."
A Conservative party spokesperson apologized for the breach, saying the technical issue had "been resolved and the app is now functioning securely".
Britain's data watchdog, the Information Commissioner's Office (ICO), said it was investigating the data breach related to the app, which was developed by an Australian firm called Crown Comms.
The opposition Labor Party said the blunder showed the ruling party could not be trusted in matters of security.
"They can't even build a conference app that keeps the data of their members, MPs and others attending safe and secure," said shadow cabinet office minister Jon Trickett.
The breach is the latest embarrassment for Prime Minister Theresa May's embattled party, whose yearly gathering begins on Sunday in the city of Birmingham in central England.
Last year's conference was peppered with mishaps, with May's attempt to move past Brexit splits marred by a protest, a collapsing set and a coughing fit.
During the 2017 event, a prankster interrupted the leader's address by handing her a P45 -- a form given to those leaving a job.
No sooner had she resumed, May began coughing uncontrollably and continued to struggle on and off throughout the rest of the speech, as 2 letters fell off the slogan on the wall behind her.
source: news.abs-cbn.com
