Alleged stolen Facebook accounts selling for $3 to $12 – report

MANILA, Philippines (UPDATED) – Facebook accounts, allegedly the ones stolen from the massive September 2018 Facebook hack, have started to appear on the dark web, an online black market for illicit goods, according to UK newspaper The Independent. 

The Independent went into the dark web where it found Facebook accounts being sold: the cheapest they saw priced at $3, and the most expensive, at $12. If all 50 million of the affected Facebook accounts were sold here, the hackers would reel in anywhere from $150 million to  $600 million – not an inconsequential sum, and certainly enough that stealing Facebook accounts would remain appealing to hackers. (READ: Facebook may get $1.63 billion fine in EU due to recent hack) 

To see screenshots of the ads, go to their article page.

The mode of purchase is via cryptocurrencies like bitcoin and bitcoin cash. Buyers of the stolen accounts may use the information to “commit identity theft or blackmail Facebook users,” security experts told the newspaper. (READ: 50M Facebook users hacked? ‘Tip of the iceberg’ – expert)

The ads were seen on the dark web market place Dream Market which, the newspaper noted, made use of a user rating system like the ones used by legitimate online sites like Amazon and eBay. The users selling the Facebook ads were said to have high trust ratings, suggesting that the Facebook accounts being hawked may indeed be authentic. (READ: What to do after the massive Facebook hack)

Prior to The Independent’s peek into the dark web, a UK credit comparison website, Money Guru, also published a similar report in June 2018, several months before the Facebook hack happened. It found Facebook accounts selling at £3 when it did the study.

Counterpoint

An expert from cybersecurity Sophos, however, contests the findings above, saying the accounts seen in the report may not have been from the recent hack. “Only tokens were accessed at Facebook and they have been revoked. It is incredibly unlikely that any account thefts happened, and if they did they are almost certainly not on the dark web yet,” explained Chester Wisniewski, Sophos’ principal research scientist. (Rappler Talk: Legal ramifications Facebook faces in PH for security breach)

Wisniewski adds that, at the moment, he does not see evidence on the dark web that points to new Facebook accounts being sold there. “No evidence that I see. The few posts have been there for months if not years. No indication of new activity,” he said. 

Even so, the expert does say that the hacked Facebook accounts are plentiful, which is why they’re going for so cheap in the online black market. The reason they’re plentiful is that people are not using strong enough passwords, he says. 

There are bound to be bugs with a platform as big as Facebook, he says, and so, users should be very careful about what information they put online:

“As with any social media platform, users should assume their information may be made public, through hacking or simply through accidental oversharing. This is why sensitive information should never be shared through these platformsFor now, logging out and back in is all that is necessary. The truly concerned should use this as a reminder and an opportunity to review all of their security and privacy settings on Facebook and all other social media platforms they share personal information with.” – Rappler.com