Phishing Leads to U of M Facebook Hack

If you are in the IT department of the higher education institution with the sixth largest Facebook audience in the United States and you get calls in the middle of the night saying there is inappropriate content on your page, you panic a little.  This happened to those in IT at the University of Michigan recently. The school with largest number of Facebook followers for collegiate football and basketball, was the victim of a social media hacking incident. According to a case study that the school released, it occurred around 3:30 in the morning on August 12 and affected three of their popular Facebook pages.

The timeline is posted on the University’s website along with details on how they figure out how it happened. In a nutshell, < spoiler alert> it was not a disgruntled employee. Instead, someone with administrator access fell victim to phishing on the Facebook Messenger app. 

A link was sent via that app that asked users to verify their identity for Facebook pages. It asked for name, email, password, and the URL to their Facebook page. What it really did was steal the credentials of the person with these administrator privileges to the Facebook fan pages for the University. This allowed someone with ill intentions to post inappropriate content about celebrities, twerking Santas, and various other forms of what is termed “clickbait.” Clickbait is content that has a sensational or provocative nature to it that piques curiosity and draws users to particular web pages to increase online advertising revenue.

Once the hackers got the password from this particular user who was allowed to publish content to the affected Facebook pages, they could wreak all kinds of havoc; and they did.

For organizations who use social media and for those who have administrator rights to social media pages, there are many good lessons to be learned from this:

Facebook will not send official communication to its customers via the Messenger app.

Keep those entrusted with administrator rights to the pages to a minimum. The fewer who have access, the lower the risk of someone getting credentials to do harm like this.

• Facebook will not ask users or administrators to verify credentials by entering them into a form. It will only ask at the website directly.

• Teach administrators and those with special privileges how to identify scams and phishing attempts. In this case, the original message received in the Messenger app and the form that asked for verification were filled with spelling and grammatical errors and if the user had paid closer attention, he or she probably would have been suspicious.

• To that no one should click links or attachments in email or texts or messenger messages that are even the slightest bit suspicious. This is true if they come from someone known, but still don’t seem quite right.

• For Facebook in particular, but for any social media that is used for business purposes, make sure that two-step authentication is activated. This adds another layer of security to the log in process and if someone attempts to log in that should not be doing so, there will be flags.

The lesson that the University of Michigan team learned is that password authentication is not sufficient on its own. It is taking the information the team members learned during this incident and doing something about it. They have initiated the process of implementing two-step authentication and are evaluating third party security applications. And although it was not made clear in the case study, it appears they did have a plan in place to react to such situations. By 7am the morning it occurred, they had started communications to the affected departments. By 10am, they had shut down the first wave and by the middle of the afternoon of the same day, they had it completely figured out and contained.

If your organization doesn’t have a security incident response plan in place, this is a good reminder to put one in place. And don’t forget to review and update it annually, at least.