Cybercriminals are everywhere. Meta, Facebook’s parent company, has just paid the price. The American company has just laid off about twenty employees behind a network of user account hijacking. The information was revealed this Thursday, November 17 by our colleagues from wall street journal.
Members of a security company
In details, these are “more than two dozen workers“Employees by Meta who allegedly resorted to unsavory practices. The employees allegedly misused an internal tool to intervene on the Facebook or Instagram accounts of several users. According to a report cited by the newspaper, the employees incriminated could have restored locked accounts at the request of people outside the company, sometimes against a sum of money.
Occasionally, even thousands of dollars in bribes have been paid by hackers, all to compromise or gain access to user accounts. These revelations follow an internal investigation conducted by Meta. According to several internal sources, the perpetrators of these hijackings are mainly security agents under contract with the company Allied Universal. The latter were in charge of the physical surveillance of Meta’s premises.
To commit their misdeeds, the corrupt employees relied on software used internally by Meta collaborators. Named “Oops” for Online Operations (online operation), it was used to restore access to Facebook or Instagram accounts, in a legitimate way and in certain very specific cases (official account, death, close to Mark Zuckerberg, etc.). According to the wall street journalthe use of this tool has increased in recent years, from 22,000 uses in 2017 to 50,270 in 2020.
Asked by CNBC, Meta claims to put “regularly updated“its security measures to prevent such attacks.”No one should buy or sell accounts or pay for an account recovery service as it violates our Terms of Service“, recalls Andy Stone, director of communication of Meta. And to add: “Individuals selling fraudulent services always target online platforms, including ours, and adapt their tactics in response to detection methods that are commonly used in the industry.“
These new revelations could further weaken user confidence. Already in 2019, a cybersecurity specialist had revealed that “hundreds of millions“Passwords were stored in plain text on Facebook’s internal servers, without any protection. Between 200 and 600 million users may have been affected by this breach at the time.