Hackers gained entry to Facebook’s internal corporate network for several months, with access to hundreds of the social network’s employee usernames and passwords.
The hackers, which were actively exploiting Facebook’s network in July and September last year and possibly as recently as February this year, were discovered by a security researcher performing penetration testing on Facebook’s corporate network.
Having discovered seven security vulnerabilities with Facebook’s corporate tools, including a file transfer service, Devcore security researcher Orange Tsai found that at least one hacker, possibly two, had compromised Facebook and were operating within its corporate network.
Tsai said: “While collecting vulnerability details and evidences for reporting to Facebook, I found some strange things on web log.
“The hacker created a proxy on the credential page to log the credentials of Facebook employees. These logged passwords were stored under web directory for the hacker to use [collect] every once in a while.”
According to Tsai, the logged Facebook employee credentials could have given the hackers access to email accounts, Facebook’s virtual private network and other company tools. Facebook user data is stored separately to its corporate network; it is unknown whether the right Facebook employee credentials could have given the hackers access to Facebook user data.
Tsai said: “At the time I discovered these, there were around 300 logged credentials dated between 1–7, from 1 February, mostly ‘@fb.com’ and ‘@facebook.com’. Upon seeing it I thought it was a pretty serious security incident.”
The penetration testing – a series of attempts by security researchers to find and report holes in a site or service’s cyber security – was conducted as part of Facebook’s Bug Bounty, which sees the social network pay people who find and disclose vulnerabilities to the company.
Facebook was alerted to the hack on 5 February by Tsai. The company launched an internal investigation, which concluded on 20 April, allowing Devcore to publish the details of the hack.
Commenting on Hacker News, a Facebook security team member called Reginaldo said: “On this case, the software we were using is third party. As we don’t have full control of it, we ran it isolated from the systems that host the data people share on Facebook. We do this precisely to have better security.
“We determined that the activity Orange detected was in fact from another researcher who participates in our bounty program. Neither of them were able to compromise other parts of our infra-structure.”
Facebook has not responded to request for comment.
