Facebook said its website was “targeted in a sophisticated attack” last month with the “zero-day” Java exploit. But the social media giant found there was “no evidence” that users’ data was compromised.
Facebook’s security team said in a blog posting Friday evening that the attack took place when employees visited a mobile developer’s website that happened to be compromised.
After analyzing the incident further, Facebook’s security team discovered that the compromised website was using the “zero day” malware which then installed previously unseen malware on the computers.
“The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops,” the post reads, adding that these laptops “were fully-patched and running up-to-date anti-virus software.”
When it was learned that the laptops were compromised, Facebook removed the problem from the infected computers. The company later alerted authorities and started an investigation.
“As part of our ongoing investigation, we are working continuously and closely with our own internal engineering teams, with security teams at other companies, and with law enforcement authorities to learn everything we can about the attack, and how to prevent similar incidents in the future,” the Menlo Park, Calif.-based company said.
The company said it also reported the “zero-day” exploit to Oracle, the manufacturer of Java, and “they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability.”
Facebook’s admission that some of its computers were compromised comes after recent hacking attempts on U.S.-based companies including The New York Times, the Wall Street Journal, the Federal Reserve, and others in the past few weeks.
“Facebook, like every significant internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure. As such, we invest heavily in preventing, detecting, and responding to threats that target our infrastructure,” Facebook said.
However, it said that it was not the only entity targeted in the attack.
“It is clear that others were attacked and infiltrated recently as well. As one of the first companies to discover this malware, we immediately took steps to start sharing details about the infiltration with the other companies and entities that were affected,” the blog post reads.
The Epoch Times publishes in 35 countries and in 21 languages. Subscribe to our e-newsletter.
Friends Read Free