Facebook Hacked In 'Sophisticated Attack,' Company Reveals

Facebook said Friday that its internal computer network was breached in "a sophisticated attack" last month, but said no user data was compromised.

The attack occurred when employees of the social network visited an infected website belonging to a mobile developer. The compromised site downloaded malicious software, or malware, onto employees' laptops. Facebook did not name the developer whose website caused the attack.

"As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement, and began a significant investigation that continues to this day," the company said in a blog post Friday.

"Facebook was not alone in this attack," the post said. "It is clear that others were attacked and infiltrated recently as well. As one of the first companies to discover this malware, we immediately took steps to start sharing details about the infiltration with the other companies and entities that were affected. We plan to continue collaborating on this incident through an informal working group and other means.

Facebook said it was working with its engineers and outside security experts to "learn everything we can about the attack, and how to prevent similar incidents in the future."

The employees whose laptops were hacked were running up-to-date antivirus software. But Facebook said the hacker used what is called a "zero day" exploit, or a piece of malicious software that had never been used before, making it impossible for security tools to stop it.

Facebook is one of a few companies who pay security researchers to report flaws in its code that could be exploited by hackers for malicious purposes. But those financial rewards, known as "bug bounties," are far less than what researchers can earn by selling "zero day" attacks on the black market, experts say.

Facebook said it reported the malware to Oracle, which makes the Java software that the attackers were able to bypass to infect the employees' laptops. Oracle has since fixed the flaw that led to the attack.

But Oracle has faced growing criticism for flaws in Java -- a programming language that is widely used by website designers -- that allows hackers to break into users' computers and install malware. The Russian security company Kaspersky Lab has said that Oracle's Java software was responsible for about half of all cyber attacks last year.

Many security experts and the Department of Homeland Security have advised users to disable Java from their Web browsers. An article on Slate.com offers instructions to users on how to disable it from their browser to avoid getting hacked.