Facebook devs HACKED in 'sophisticated' Java zero-day attack
Company laptops impounded, no evidence user data compromised
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Facebook has been hacked, but the company has found no evidence that user data was affected.
Facebook's systems were "targeted in a sophisticated attack" in January after some of the company's developers visited a mobile-developer website that had been compromised, the company wrote on Friday afternoon.
Malware was installed onto fully-patched Facebook laptops via a Java zero-day vulnerability – a vuln that Oracle patched on February 1.
"As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement, and began a significant investigation that continues to this day," the company wrote.
Facebook realized that the hack had occurred when its security team found a "suspicious" domain within the company's corporate DNS logs that was tracked back to a company laptop.
"Upon conducting a forensic examination of that laptop, we identified a malicious file, and then searched company-wide and flagged several other compromised employee laptops," Facebook reports.
Other companies were targeted in this attack as well, though Facebook did not disclose who. It has formed a working group to share information among the affected parties.
The company is working with law enforcement and other entities to prevent further attacks, it said, and encouraging people to submit security vulnerabilities affecting Facebook to the company's Bug Bounty Program. ®
COMMENTS
Not Fair
Malware isn't allowed to compromise Facebook user data.
Only Facebook is allowed to do that.
Interesting...
When Sony got hacked and had no proof of what, if anything got accesed, they were advised to assume the worst, and the media tore them apart.
When Facebook for hacked, they assumed the best, and the media are all forgiving of it.
The media are pretty irresponsible, Sony didn't really do that much wrong, they stored their credicard details fully encrypted, they stored passwords are salts, and the only things stored in plain text were user's personal info like Name/Address. That's no difference to every other company on the planet....
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
