> series: anatomy_of_a_breach —— part: 118 —— target: facebook —— tokens_stolen: 50,000,000 —— vulnerability: view_as_feature<span class="cursor-blink">_</span>_
On 28 September 2018, Facebook disclosed that attackers had exploited a chain of three vulnerabilities in the platform's 'View As' feature — which allows users to see how their profile appears to others — to steal access tokens for approximately 50 million accounts. Access tokens are the digital keys that keep users logged in to Facebook; possessing a user's access token allows full account access without needing their password. Facebook forced a token reset for 90 million accounts (including 40 million as a precautionary measure).
The attack chained three bugs: a flaw in the video uploader that appeared in the 'View As' mode, a vulnerability that caused it to generate an access token with the permissions of the user being 'viewed as' (rather than the viewer), and a third flaw that allowed the generated token to be extracted. The vulnerability chain had been introduced in a code change in July 2017 — meaning it had existed for over a year before discovery. The breach was reported to the Irish Data Protection Commission under GDPR's 72-hour notification requirement — one of the first major breaches to test the new framework.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Facebook breach demonstrated vulnerability chaining — the combination of multiple individually minor bugs into a critical exploit. No single vulnerability in the chain would have been catastrophic alone; together, they enabled full account takeover of 50 million accounts. This is exactly why our web application testing examines the interactions between features, not just individual vulnerabilities — because the most dangerous flaws are often chains, not single bugs.
The Facebook breach teaches that security testing must examine feature interactions, not just individual components. Vulnerability chaining — where minor bugs in different features combine into critical exploits — requires the kind of creative, manual testing that automated scanners cannot replicate. Our web application penetration testing includes logic testing, authentication flow analysis, and cross-feature interaction assessment.
API testing assesses token security and session management. Cyber Essentials establishes baseline application security. SOC in a Box monitors for anomalous authentication patterns that indicate token theft. And UK Cyber Defence provides incident response when token compromise is detected.
Our <a href="/penetration-testing/web-application">web application testing</a> examines feature interactions and vulnerability chaining. <a href="/penetration-testing/api">API testing</a> assesses token security.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call