Here’s one notification you don’t want to receive: Facebook will now issue warnings to users whose accounts it believes were targeted by hackers working on behalf of a nation-state.
If an account is under attack or at risk of being compromised, Facebook will send the user a warning message letting them know about the suspicious activity. The notification, an example of which is shown below, specifically says that the threat comes from state-sponsored attackers.
To help people protect themselves from account intrusions, the notifications prompts the vulnerable user to secure his or her account by turning on Login Approvals, Facebook’s two-factor authentication process.
With Login Approvals on, each login attempt from a new computer or browser requires an extra security code, one that Facebook delivers to a mobile phone associated with the account. Without the code, hackers can’t get in, even if they have the account password.
Of course, you don’t have to—and definitely should not—wait for this new prompt before you enable Login Approvals. Facebook introduced the security measure nearly five years ago, and it remains a valuable tool for anyone, not just potential hacking targets.
Earlier this year, Facebook also introduced Login Alerts, a security measure that will notify a user every time someone tries to log into their account. If someone accesses a user’s account from a new browser or geographic location, Facebook sends the user a Login Alert notification that lets them reset their password.
Facebook is using the new prompt specifically for attacks that come from government-sponsored groups, because, as Alex Stamos, the company’s chief security officer, explained in the announcement post, “These types of attacks tend to be more advanced and dangerous than others.”
Because Facebook is such a widely used platform with a wealth of communication tools, from private posts and groups to chats in Messenger and Facebook-owned WhatsApp, the service frequently winds up in the crosshairs of attackers.
Facebook encourages its users to stay vigilant when browsing the site and report any suspicious posts they see. Every post, comment, profile, and page contains a link to report the activity. The report option generally appears in a drop-down menu in the upper-right corner of a post or profile, and it features a variety of options for directing the complaint.
Facebook also runs a program called ThreatExchange that crowdsources threat data from several major online platforms and tracks and details active malware and phishing attempts. Users can sign up for the beta program to receive and provide information about online attacks.
Facebook is the latest major company to take notice of threats from nation states. Google implemented a similar warning for Gmail users in 2012 after being hit by state-sponsored attacks from China that sought information on U.S. government officials, Chinese political activists, military personnel, and journalists. Google’s system also prompts users to enable two-step verification.
Photo via Dennis Skley/Flickr (CC BY ND 2.0)
