Last Friday, the social media company revealed a vulnerability that allowed attackers to steal automated log-in credentials (or “tokens”).

The tokens make it easier for people to log into popular apps and services like Spotify, Pinterest, or Yelp. The flaw, which has been present since July 2017, was discovered last month after Facebook engineers noticed unusual login activity.

While the scope of that attack is still being discovered, independent researchers say the damage could extend far beyond Facebook’s borders.

Jason Polakis, an assistant professor of computer science at the University of Illinois at Chicago, recently co-authored a paper on vulnerabilities in Single Sign-On (SSO) systems, similar to the one used by Facebook.

Polakis says the token breach affects far more than Facebook – it’s a potential backdoor to thousands of third-party apps and websites.

‘Shortcuts have consequences’
Simply put, a token is a unique string of letters and numbers that can be used to automatically log you in to other apps and websites, so you don’t have to keep entering your password.

Unfortunately, from a security standpoint, using Facebook or any other social media app to log into other services is not a smart thing to do, says Dana Simberkoff, chief risk, privacy, and information security officer for enterprise security firm Avepoint.

“It’s easy and convenient, but when when you use shortcuts there can be consequences,” she says. “You should not use one app to log into another, because when one of those systems is compromised, everything else you interact with can be as well.”

This is exactly what happened. Thanks to multiple bugs in Facebook’s View As and video posting features, user tokens were exposed to attackers, who then extracted them from the page’s HTML code.

Once an attacker discovered how to steal one person’s token, it would be a simple matter of automating the process to compromise millions of Facebook accounts, as well as any third-party accounts (like Spotify or Pinterest) that rely on those Facebook tokens.

In response, Facebook disabled the buggy features on its site, changed the tokens for 90 million users, and logged them out. When users log back in, a new token is generated. While that may stop future attackers from stealing their login credentials, it may not do much to mitigate any compromises that have already occurred.

In other words, if attackers have already used your Facebook credentials to log into one of your apps, they may still be there, depending on the app’s security settings, says Polakis.

“If they use tokens to attack third-party apps before the tokens were invalidated, things become much trickier,” he says. “On many websites, we found that attackers could reset the account’s email and then set a password without knowing the account’s actual password. So even if single sign-on no longer works and the attacker no longer has access to that Facebook account, they could still maintain access to the third-party account.”

When testing this attack scenario, Polakis and his fellow researchers accessed accounts on 29 of the web’s most popular sites and were still able to log into 22 of them, even after losing access to the Facebook accounts.

It gets even worse. Even if you’ve never used Facebook’s sign-in for an app or website, an attacker could still use the token to log in as you, provided you use the same email address for both services, says Polakis.

And if you don’t yet have an account on these services, attackers can use tokens to create one in your name, which can sit dormant waiting for you to eventually log in so they can steal your personal information.

As this story was going to press, Facebook issued a new statement declaring that it had found no evidence that attackers accessed any apps using Facebook login, and that apps created using the company’s official software development kit (SDK) should have been protected when user tokens were reset. However, Facebook apps created without the SDK may still be vulnerable.

What can you do?
The Guardian contacted six of the most popular apps and websites, as well as Facebook, asking for their advice on what steps users should take. Yelp had no comment, while a Spotify spokesperson said the music service had not suffered a security breach and advised users to change their passwords. At publication time, no other companies had responded.

Changing your passwords may or may not help, depending on the application, but it’s a reasonable thing to do, says Polakis. If you fear you’ve already been compromised, you should also look for unusual activity on those accounts, he adds.

All users can practice better app hygiene by disabling permissions that may be set by default and removing apps they rarely use, suggests Will LaSala, director of security solutions at the trusted identity platform OneSpan. He also recommends turning on two-factor authentication, when available, which asks for a second factor (like a PIN sent by text message) when the system detects logins from unfamiliar devices.

You can prevent similar attacks in the future by disabling the auto-logins for Facebook and any other third-party authentication systems, such as Google or Twitter, suggests Simberkoff.

In other words, don’t sacrifice security for convenience.

“It may be time consuming and annoying to change the way you authenticate into each system,” she says. “But you should be the captain of your own ship, and the destiny of your personal information is in your hands.”

More about: #Facebook