Facebook Security Lapse Affects Millions More Instragram Users Than First Stated

April 19, 2019 TH Author headline,privacy,data loss,password,facebook,social

Facebook chose one of the busiest news days in American politics this year to admit that millions more Instagram users were affected by a security lapse than it had previously disclosed.

At 10 am ET on Thursday, as the attorney general, William Barr, wrapped up his news conference on the release of the report of the special counsel, Robert Mueller, Facebook updated a 21 March blogpost, which revealed it had mistakenly stored the passwords of hundreds of millions of users unencrypted, to include a sentence admitting that millions more Instagram accounts had been affected.

The 21 March post initially said “hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users” had data stored in an insecure way.

In the update, the company said it had discovered additional logs of Instagram passwords being stored in a readable format. “We now estimate that this issue impacted millions of Instagram users,” it noted.

The clear implication of the timing of its admission is that Facebook is trying to bury this privacy oversight in the midst of its larger scandals of the week, said Evan Greer, deputy director at Fight for the Future, a privacy advocacy non-profit.

“Exactly zero people are surprised that Facebook would try to bury this damning story by releasing their response today,” she said. “It fits their MO of deflecting, downplaying and apologizing without addressing the fundamental problem: that their current business model is incompatible with user privacy and human rights.”

Facebook stored millions of passwords without encryption for years, a story from security reporter Brian Krebs initially reported. It is standard practice in the industry to store passwords with encryption so that even if they are hacked, stolen passwords cannot be read or used. In this case if passwords were taken they could have more easily been used.

A Facebook spokesman told the Guardian there is no evidence of abuse or misuse of the passwords.

“This is an issue that has already been widely reported, but we want to be clear that we simply learned there were more passwords stored in this way. There is no evidence of abuse or misuse of these passwords.”

The Mueller report released on Thursday mentioned Facebook more than 80 times in relation to potential efforts to affect results of the 2016 elections. It found the Internet Research Agency, an election interference group affiliated with the Russian government, paid more than $100,000 to Facebook for more than 3,500 advertisements.

Fake accounts and advertisements sponsored by the agency reached as many as 126 million Americans, the report found. The IRA also promoted and organized political rallies using Facebook events. Announcing additional security problems in the midst of scrutiny over 2016 election activity was no accident, said Ed Zitron, a tech industry public relations veteran and CEO of EZPR.

The timing of the announcement was the equivalent of Facebook “mumbling it under your breath while someone is playing loud music and hoping no one will hear,” he said. “The crazy thing is that they think they can still do this … They are acting like they’re still a cute startup, but they’re not.”