Suppose Facebook suddenly encounters a bug that allows people to log into any account without a password. Users are unable to change their settings. All posts can be viewed by everyone. After about half an hour and a lot of on-line protest, when Facebook tries to address the issue, they find that they are unable to modify their own code, neither are they able to stop it. Most of the code initially written for FB has been deleted.

They realise that all their servers across all offices have been infected and are being controlled remotely. They take all their servers off-line by manually disconnecting them. On further investigation, they also find that every computer that they're using has an embedded code in its operating system that permits this. Most people suspect that this has been planned for, and that insiders must have played a major role in it.

6 hours have passed, and now various organisations have been contacted. There has been no information from the hackers themselves. Facebook has copied all the data from the computers into secure hard drives.

12 hours have passed, and no major leads have been found. People are seriously beginning to question whether the events that just happened were even logically possible and there are small groups with the company itself who are starting to believe in paranormal explanations.

Days pass, and no information has been found. Facebook has suffered heavy economical losses.

What will happen now?

Will they try restarting from scratch, buying new hardware and rewriting all the code required?

Or will they create an interim website that allows people to download their data, following which they will shut down?


closed as primarily opinion-based by o.m., Mikey, JDługosz, Frostfyre, March Ho Nov 11 '15 at 23:04

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 18
    $\begingroup$ I can't answer the O.P.'s question right now, but I want to celebrate the birth of a new genre! Nerd Horror!!!! Welcome to the World! Can't wait to write some! $\endgroup$ – Henry Taylor Nov 11 '15 at 15:23
  • $\begingroup$ @HenryTaylor I'm sorry, I didn't get you. Is the question not appropriate or something? $\endgroup$ – ghosts_in_the_code Nov 11 '15 at 15:29
  • 1
    $\begingroup$ Everyone can just download everyone's data anyway. $\endgroup$ – djechlin Nov 11 '15 at 16:03
  • 1
    $\begingroup$ Cthulhu in the shell??? $\endgroup$ – Joe Bloggs Nov 11 '15 at 16:08
  • 2
    $\begingroup$ You seem to have described how Facebook works right now..... $\endgroup$ – Thucydides Nov 11 '15 at 20:34

They've already lost everything. There is no scenario in which a company like Facebook can come back from an exploit of such magnitude. Even if they find the hacker (which you've said they don't), even if they find the insider at the company (which you've said they don't), even if they can harden the system against another attack; the fact still remains:

For an undetermined amount of time, Facebook was totally compromised.

You don't know how long these hackers have had total control. Every piece of information going through Facebook (an organisation that relies on its image and has already run into privacy issues) has been exposed to persons unknown, and those same people may be able to take control again just as easily. No-one is ever going to trust Facebook again, and as such whether they come back saying 'It's fine, we fixed the bug', or just pack it in completely, the result is the same: Facebook dies. Other organisations take over, filling in the niches, and they harden their physical/digital security protocols at the same time.

Essentially: The kind of massive exploit you've described is a total wipeout for any organisation that's supposed to be able to hold information securely. That's why large companies that deal in this kind of data spend a lot of time and money securing everything, both physically and digitally. It's also why they invest in systems designed to track changes made to their machines/software, and employ people to watch like hawks for any potential attacks.

Making an unsolicited change to the OS of every piece of hardware that Facebook uses to allow total root control, remaining undetected and not being traceable even after the cybersecurity experts get their hands on the data? Either your hackers are uberl33tz0rs on a level that's well over 9000, or Facebook's security is pants. Either way Facebook is dead, and if it's the former scenario: So is any non-trivial application of the internet.

  • 1
    $\begingroup$ Don't other organizations also die because if Facebook can be hacked that hard... $\endgroup$ – djechlin Nov 11 '15 at 16:02
  • 2
    $\begingroup$ I mean, hacker skills aside, people no longer trust anyone's security. I guess this was out of scope for the question, but it's more interesting to me how the non-Facebook part of the world will be impacted. $\endgroup$ – djechlin Nov 11 '15 at 16:05
  • 1
    $\begingroup$ Honestly I wish this would happen. So many reasons to hate FB. $\endgroup$ – Daniel Nov 11 '15 at 16:07
  • 2
    $\begingroup$ So many reasons to not want the prospect of an utterly anonymous megahacker hanging over the heads of every internet-based or connected business... $\endgroup$ – Joe Bloggs Nov 11 '15 at 16:10
  • 1
    $\begingroup$ @JDługosz: it's/its again... My fingers seem to be hardwired for apostrophes! $\endgroup$ – Joe Bloggs Nov 12 '15 at 10:02

Honestly, that would likely kill Facebook. If people are not able to access their accounts for several weeks, most would find a new social site to move to. Many would do it right away either because they feel betrayed by Facebook or because they 'need' the interaction.

No matter what, even if they are able to get back up and running in a month, they will never be the same. Their name will be mud and many will have moved on, skittish to come back.

Apparently there are MANY other social networking options out there and I've seen a study that many teenagers don't use their Facebook account for much any more, they use other sites, likely because their parents have Facebook and they don't want to 'share' what they did last weekend with family.

  • $\begingroup$ This. When it comes to 15 - 20 year olds, Facebook has become a smoke screen to keep parents off their backs anyway, younger folks are far and away the most active users of social media. Facebook dies...except for all the grandparents who don't understand what a data breach is...they stay. $\endgroup$ – James Nov 11 '15 at 16:02
  • $\begingroup$ I think you nailed the most important point: people move on, and without a strong incentive to come back, they won't. $\endgroup$ – Burki Nov 11 '15 at 16:21

Similar things have happened before. Sony Online was hacked (with a simple SQL Injection of all things) and still came back from it. Security agencies have been hacked and are still in business with our and other governments. 'The Sony Archives' and the 'Wikileaks: The GIFiles' are all information that has been hacked and stolen from companies that hardly blinked an eye (or so it would seem from our point of view).

Knowing similar events have taken place and didn't utterly destroy the companies I'm inclined to say Facebook would be back up within a week. If thepiratebay can have all their servers confiscated and still be back up and running strong then I see no reason a social media site that has no comparable competitor and near endless budget wouldn't be able to purchase new servers, configure them, and do a full restore from scratch in a week.

Furthermore (not to make people paranoid), a virus that has taken advantage of multiple weaknesses in a windows os (i think it was 3 of the 5 openeings were used) has already be made (presumable by the US Government), deployed, and successfully used. Odds are it's actually infected you'r computer. It's called Stuxnet and it was used to target a very specific micro-controller used in some machine that helps weaponize uranium (or plutonium? idk i'm not a chemist) for nuclear weapons. The problem was that the facility had it's own closed off intranet, so the only way to infect it was to have someone bring it in from the outside. If I remember right, the main theory was somebody that worked there had unknowing brought it in from the outside. So an infected USB stick or something. Not knowing who to infect though, the easiest solution was to infect everybody and wait until one of the employees made that big 'whoops' and infected the whole system.

While this scenario differently sounds like the beginning of a new genre, nerd horror (btw whoever came up with that, you're my hero) it isn't fantasy or fiction at all. It has already happened, and it is already a threat. Unfortunately things that don't make the newspaper (news sites? are papers even delivered anymore) largely go unnoticed.

Netflix has a show on this titled "StuxNet: Cyberwar" http://www.imdb.com/title/tt1950374/

I would suggest watching it as it's very interesting.

  • $\begingroup$ Sony's case was a far cry from the level stated in the question. As you said, it was only a simple SQL injection, without compromising the actual hardware. $\endgroup$ – March Ho Nov 11 '15 at 23:06
  • 1
    $\begingroup$ @MarchHo Honestly, I agree completely with you. From our informed point of view, Sony's case was a utter joke. Unfortunately I'm sure there are those that feel as if the fact of being hacked is just as bad as being hacked and having information stolen. I guess it's being equated to cars or something? They broke into your car and didn't take anything this time, but who's to say they won't next time? For some reason I feel like that would be their "reasoning" for this paranoia - which would still go along with the whole 'they lost face now' and 'untrustworthy now' thing. $\endgroup$ – user3164339 Nov 11 '15 at 23:17
  • $\begingroup$ @user3164339: The OP's scenario is more like: They broke into your car, rebuilt it so they could remote control it without anyone noticing, waited until you'd been driving around in it for three months with your wife and newborn child, suddenly slammed on the brakes and opened all the doors, and nobody knows how they did it, including the mechanics who MOT'd your car two months ago and the guard who was watching your very expensive car collection. In that scenario paranoia is justified. $\endgroup$ – Joe Bloggs Nov 12 '15 at 10:11
  • $\begingroup$ And stuxnet is like breaking into a whole load of cars and hiding dogbiscuits in the upholstery on the offchance that a dog will tear up the cushions. Very widespread: but also massively specific. $\endgroup$ – Joe Bloggs Nov 12 '15 at 10:13
  • $\begingroup$ @JoeBloggs haha made me laugh. I mostly mentioned Stuxnet since it's so widespread people are (or at least were) able to get a hold of the code and reuse it for another purpose, perhaps target facebook? dog biscuits though, haha. $\endgroup$ – user3164339 Nov 12 '15 at 21:13

After a breach like this, Facebook is dead. Other answers covered that already, so I'm going to focus on something else.

Consider all the sites that use Facebook for login. Presumably, a hack like this would also allow the hacker to use any other site where they farmed their account authentication to Facebook. They would probably lose fewer users to this, but may have to completely reset backups on the accounts linked to Facebook and may have to completely rework the site if the only authentication method was Facebook. With that in mind, many of these sites allow Google+ authentication as well so Google+ market share would go up.

Additionally, something that this question doesn't examine is the impact of making the actual Facebook site compromised. Luckily browser security is quite a bit better now than it was, and just visiting a site is somewhat less dangerous, but most likely whoever is doing this figured out at least a few zero-day exploits that work on browsers to infect anyone who goes to facebook.com, and additionally any site that links to Facebook's scripts. Now think of every site on the Internet that links to a Facebook "like" button. In the worst case scenario, every computer that connects to those sites before they remove the malicious code and doesn't block that code from running is now part of this hacker's botnet. That's a lot of news sites, blogs, forums, etc. In an even worse case, perhaps those sites use a server-side code to execute Facebook's API, which means all of their servers are compromised as well.

In terms of longterm effects, my guess is that inter-site authentication/functionality will become less common, many more sites will download JS libraries to their site rather than rely on third party repositories, and in general hopefully people will become more concerned about security. Maybe they'll even stop posting their nude photos on social media sites (they won't).



In his answer to a very similar fictional scenareo says people fall into three main groups:

  • defenders
  • detectives
  • burners

He also has Facebook disabling all logins even though the problem was with Google.

  • 2
    $\begingroup$ Would it be possible to summarize the contents of the video in case it is ever deleted? $\endgroup$ – Thunderforge Nov 11 '15 at 17:59
  • $\begingroup$ That was the purpose of the three bullet points. $\endgroup$ – JDługosz Nov 11 '15 at 18:58
  • 1
    $\begingroup$ It's hard to understand what he means by those three categories without understanding a bit of context. What is the "very similar fictional scenario" that he is describing? What exactly is a "burner"? $\endgroup$ – Thunderforge Nov 11 '15 at 19:00
  • $\begingroup$ I marked the answer as Community, so if anyone wants to post a synopsis fresh after (or while) watching the video it won't get credited to me. $\endgroup$ – JDługosz Nov 11 '15 at 19:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.