Updated September 5: This article has been updated to clarify that the databases in question contained Facebook data rather than belonged to Facebook itself. "If you enable 2FA," Opdennaker says, and you certainly should if it's available, "then always opt for an authenticator app or hardware security key."Īs Opdenakker concludes, "because we’ve seen a rise in SIM-swapping attacks in several countries recently, it’s important to protect your phone number the best you can.
DOWNLOAD FACEBOOK DATABASE HACK PASSWORD
"While simjacking cases are increasing and data such as mobile phone numbers could be stolen," Moore says, "it is a great time for users to jump across to an authenticator app which doesn’t require a verifying SMS which could potentially get intercepted."Įthical hacker John Opdenakker says that "in general it's best not to provide your phone number to online applications, period." Of course, a lot of services, unfortunately, require phone numbers for password reset or to enable two-factor authentication (2FA) which throws a spanner in the security advice works.
President Trump has shrugged off concern about his Twitter account being hacked in a similar way, but everyone else should be taking notes here. Jake Moore, a cybersecurity specialist at ESET, says that "it seems crazy that personal data of this magnitude could be on a server unprotected in 2019, but this just highlights how data gets forgotten about and mistakes can happen." Moore goes on to say that "even being able to see partial phone numbers can sometimes be just as damaging to users too," by which he means "it could be used to confirm to threat actors the number you use to link to Facebook." Why is this of such value to an attacker? Just ask Jack Dorsey, CEO of Twitter, whose Twitter account was taken over by attackers who pulled off a SIM hijack attack against his mobile phone provider. With the data now entering the public domain, there is a real danger that this information will now be widely disseminated across low-skilled cybercriminals that may abuse it for email or SMS spam, robocalls, extortion attempts, threats, harassment, and more.īelow is a breakdown of the data, per country, as provided by the leaker.What do security experts say about the Facebook data leak? The Database The unsecured Elasticsearch database was 5.5 gigabytes and contained 13,521,774 records of at least 100,000 Facebook users. You can also use Avasts Hack Check tool to monitor your email. If your phone number appears in the leak results, then you’ve been compromised as part of the recent Facebook breach. While the data appears to have been sold in private, it was also used as the backend of a Telegram bot launched in January 2021 that allowed anyone to retrieve the phone number and account details for Facebook users for a small fee. Threatpost has reached out to Facebook for further comment. Checking if your account is part of this breach is easy: Head to Have I Been Pwned to check if your phone number is part of the leak. The attacker collected data in 2019, until Facebook detected the automated process, and cut off their access.
“We found and fixed this issue in August 2019.”Īt the time, an attacker abused a vulnerability in the Facebook contacts importer feature to supply the Facebook platform with a list of phone numbers and get a match for existing profiles, allowing the attacker to link random phone numbers to specific users. “This is old data that was previously reported on in 2019,” a Facebook spokesperson told The Record. Reached out for comment, Facebook confirmed the leak, which according to the company took place two years ago.
0 kommentar(er)
