Angler Exploit Kit Uses Domain Shadowing technique to Evade Detection

The world’s infamous Angler Exploit Kit has become the most advanced, much more powerful and the best exploit kit available in the market, beating the infamous BlackHole exploit kit, with a host of exploits including zero-days and a new technique added to it.

Angler Exploit Kit's newest technique is dubbed "Domain Shadowing" which is considered to be the next evolution of online crime. Domain Shadowing, first appeared in 2011, is the process of using users domain registration logins to create subdomains.

WHAT IS DOMAIN SHADOWING ?

With the help of Domain Shadowing technique used in a recent Angler campaign, attackers are stealing domain registrant credentials to create tens of thousands of sub-domains that are used in hit-and-run style attacks in order to either redirect victims to the attack sites, or serve them malicious payloads.

Security researcher Nick Biasini of Cisco’s Talos intelligence team analysed the campaign and said the "massive" and ongoing Angler campaign targeting Adobe Flash and Microsoft Silverlight vulnerabilities dramatically shooted up in the past three months.

"Domain shadowing using compromised registrant credentials is the most effective, difficult to stop, technique that threat actors have used to date. The accounts are largely random so there is no way to track which domains will be used next," said Nick Biasini.

"Additionally, the subdomains are very high volume, short lived, and random, with no discernible patterns. This makes blocking increasingly difficult. Finally, it has also hindered research. It has become progressively more difficult to get active samples from an exploit kit landing page that is active for less than an hour. This helps increase the attack window for threat actors since researchers have to increase the level of effort to gather and analyze the samples."

HOW HACKERS MADE IT ?

In the recent campaign, the cyber criminals are taking advantage of the fact that most of the domain owners do not regularly monitor their domain registrant accounts, which are typically compromised through phishing attacks. This leverages attackers to create a seemingly endless supply of sub-domains to be used in further attacks.

A new technique called Fast Flux allows hackers to change the IP address associated with a domain to evade detection and blacklisting techniques. Unlike Domain Shadowing which rotates sub-domains associated with a single domain or small group of IP addresses, Fast Flux rapidly rotates a single domain or DNS entry to a large list of IP addresses.

GODADDY ACCOUNTS AT RISK

Cisco has found up to 10,000 malicious sub-domains on accounts — most of them linked to GoDaddy customers, although the security researchers noted that this was not the result of any data breach, but this is because the GoDaddy controls a third of domains on the Internet.

ATTACK VECTOR

There are multiple tiers to the attack, with different malicious subdomains being created for different stages listed below:

• Users are served malicious advertisements on the web browser.
• The malicious ad redirects the user to the first tier of subdomains known as "gate".
• First tier is responsible for the redirection of victims to a landing page that hosts the Angler Exploit Kit serving an Adobe Flash or Microsoft Silverlight exploit.
• This final page is being rotated heavily and sometimes, those pages are active only for a matter of minutes.

"The same IP is utilized across multiple subdomains for a single domain and multiple domains from a single domain account," Biasini wrote. "There are also multiple accounts with subdomains pointed to the same IP. The addresses are being rotated periodically with new addresses being used regularly. Currently more than 75 unique IPs have been seen utilizing malicious subdomains."

With numerous of evasion techniques, zero-day exploits and high level of sophistication, Angler Exploit Kit has elevated as the more formidable hacker toolkits available in the market.

The previous best-selling exploit kit known as BlackHole was known to be the dangerous toolkit, but last year after the arrest of 'Paunch', the mastermind behind infamous BlackHole exploit kit, the exploit kit disappeared from the market.

thehackernews

Read more »

Problems after Android Lollipop update? Try this to fix them

Android Lollipop was formally announced in the first half of November and since then it is slowly reaching smartphones. The Nexus 4 and the Nexus 5 have already been updated. It is also available for several Android tablets. A few Motorola phones too have got it while many other smartphone companies are working on early versions of the Lollipop update for their phones.

While there is no doubt that Android Lollipop is pretty much an awesome update, a lot of users have reported issues with it. There are reports of poorer battery life, app crashes, random reboots and occasionally slow performance. The odd bit about this update is that not all users have reported these issues. For many the Android Lollipop update has been pretty good. So what is happening?

While we don't exactly have an insight into what is causing problems in some phones after Lollipop update -- there could be thousands of issues -- we do have a theory.

Android Lollipop is a huge change from the earlier versions of the Android. The changes are not limited to the visible ones in the user interface but also part of the under-the-hood revamp. For example, Android Lollipop adds ART, which is a completely new way of how apps are run and memory is managed. Then the Android Lollipop has different way of handing user interface elements like translucency and layers.

It also comes with a new camera API and new way of handling graphics.

To summarise, the Android Lollipop such a big departure from the earlier version of Android that it is bound to have rough edges and bugs. But what really exaggerate the problem, we believe, is over the air update. When people use a phone they collect apps and data in their devices. When you update your phone to something as radically different as Lollipop and make it work with the older data, configuration, settings and apps it is possible to run into glitches.

Incompatibility, even when the compatibility is guaranteed by the OS maker, is one of the reasons why geeks often prefer to install OS updates from the scratch. This was especially true for something like Windows and we believe it is possible that the same approach has to be taken with Android, especially when moving to something that has too many under-the-hood changes.

Now, that we have established the theory, here are the fixes we suggest if you are running into issues after Lollipop update:

-- If your apps are crashing a lot, create a list of these apps. Update them if the update is available.

-- If update doesn't solve the issue, then go to Settings > Apps > The App That Is Crashing > Clear Cache > Force Stop > Restart the phone.

-- If this doesn't solve the issue follow the same process again but this time also CLEAR the app data. Though this will also delete local data, for example Facebook photos you may have downloaded, from your phone. Also, you will have to login again into the app after deleting its data.

-- If this doesn't solve the issue, uninstall the apps that are crashing and reinstall them.

-- If this doesn't solve the issue, do a factory reset of the phone. before doing the factory reset copy any data that you want to save. Copying data from Android is easy so you shouldn't have much problem in saving important photos or music from your phone into a computer.

-- Factory reset will solve the issue. If it doesn't, wipe the phone clean and manually install the Android Lollipop. We had earlier provided a method to manually install the official Android Lollipop update on the Nexus 5. For the Nexus 4 and other devices the process is same. Only the files and drivers change.

Most of the problems with the Android Lollipop are because of issues with the over the air update (OTA) and possibly older data/apps. Ideally, Google should have taken care of it or should have offered to do a clean install through OTA, without keeping the older data intact on the phone, but may be it went with the option that was easiest and most convenient for consumers. Sadly, it looks like this method also caused several issues and glitches.

Read more »

Here's how you can install and try Windows 10 on your phone

Microsoft has finally released the technical preview for Windows 10 on phones and for many it is going to be a major feature bump. That said, there are multiple caveats if you plan on updating your phone immediately, as this is a technical preview, which is limited to select set of phones. Here's what you need to know before you can install Windows 10 on your phones.

 Have you heard about the Windows Insider program?

If the term 'Windows Insider' sounds alien, then it is likely that you are ineligible to get your phone updated to Windows 10. The technical preview is meant for a group that Microsoft calls Windows Insiders, who share data and feedback as the operating system is being developed so that a polished product is released to the public.

How do you become a Windows Insider?

That is simple. You go to the Microsoft Windows Insider page and register yourself as an Insider. Then you register your device to get over the air updates and you are good to go.

So my phone will be updated to Windows 10 technical preview for phones. Right?

Yes, if you have the right model. Microsoft has announced that the technical preview will work on only the Lumia 635, Lumia 636, Lumia 630, Lumia 638, Lumia 730, and Lumia 830. All these models were released in 2014, so if your phone is from 2013 it will not get the update as of now.

So what happens to phones like the Lumia 1020, 1520, 930, 520 or even the HTC Windows Phones?

There is no doubt that the update will be available for phones like the Lumia 1520, and 930. If fact, in the demos Microsoft's Joe Belfiore demoed the OS on a 1520, but right now there is no build of the technical preview out there for these high-end Windows Phones. As for the Lumia 1020, it is likely there will be an update for it too. In fact, Belfiore recently tweeted that his team is also working on an update for Windows Phones running just 512MB RAM like the popular Lumia 520, but right now, there is nothing for these users. The same holds true for HTC's models running Microsoft's OS. In the tweet Belfiore said, that it the ambition of his team to provide the Windows 10 update for all Windows Phone 8.1 smartphones.

What all languages does the operating system support?

The Windows Insider program as Microsoft puts is a global program. This also means that the update for Windows 10 even on the phone supports 25 languages in total including Hindi.  

Why should I update my phone to the technical preview?

Well, if you happen to be a geek or an IT manager then it is worth having the update. It adds a lot of new features like enhanced notifications, an updated action bar, a new web browser, universal apps, and much more. In the future, Microsoft will roll out Office apps and a significantly better email experience with the addition of Outlook to Windows Phone. The update will also add architectural changes to the OS, which will enhance gaming and battery life.  

What could go wrong?

While Microsoft says that it has never bricked a phone while installing the update, it warns that things could go wrong. For this, it advises you to use the Windows Phone recovery tool, which it has designed for the technical preview. Despite using this tool, Microsoft warns things could wrong. In addition, the UI is not complete and you may get the impression that you are using an incomplete operating system.

I am Windows 10 technical preview user on the PC, I think I'll be fine?

Wait, hold your horses. This update is at a very early stage. Microsoft by its own admission says that it is less complete and at an earlier of development than the technical preview out there for PCs. So, you may want to give this update a pass. In fact, many key features of the update are not available in the current build. Things like preview Office apps - Word, Excel, and Powerpoint -- are not a part of the OS. In fact, you don't even get the new Outlook experience, so you may think what is the point.

Anything else?

Microsoft has listed out a long list of known issues. The company makes no bones about this. It admits many bugs and has listed out most of them along with workarounds. It is advisable that you read up on all these issues and then make an informed decision regarding the upgrade. You may be unwilling to deal with all the bugs Microsoft has listed out.

Read more »

How Google's New Wireless Service Will Change the Internet

Google wants more people to get online so they can search around and click on its ads. And it's shaking up the telecom world to do it. The company said at the wireless show in Barcelona, Spain, that it will soon sell data plans for smartphones and tablets in the US. The announcement confirmed leaks and media reports in late January that Google planned to enter the telecom market.

More information will be released "in the coming months," Sundar Pichai, Google Inc's senior vice president of products, said during his presentation.

The move into the wireless market mirrors what Google has been trying to do for hard-wired internet access at home. The Mountain View, California, company currently sells an ultra-fast fiber-optic internet service in a handful of markets scattered across the US in an attempt to pressure long-established broadband providers to improve their prices and cut their prices.

Google conceivably do something similar for wireless by offering discounted data plans that would pressure major carriers such as AT&T Inc and Verizon Communications to offer better deals and services or risk losing customers to a powerful rival.

"Any time there is a new entrant with the resources and imagination of Google, it most definitely could shake up the market," said Gartner analyst Bill Menezes.

Pichai downplayed the competitive threat that Google might pose.

"We don't intend to be a network operator at scale," he said. "Our goal here is to drive a set of innovations which we think the ecosystem should evolve and hopefully will get traction."

Pichai compared Google's latest move to its decision to launch its own line of Nexus smartphones, which he said Google uses not to compete with other smartphone makers, but to introduce innovations in mobile hardware.

Finding a way to provide a "seamless" internet connection when a device moves from Wi-Fi to cellular coverage as one example of goals Google would like to target, Pichai said. He also noted that Google is also working on "Android Pay," a mobile payment system similar to "Apple Pay," that will work across all Android-powered devices.

Google plans to be a "mobile virtual network operator," which means it will lease space on an existing system. Pichai didn't name Google's wireless partners, but previous media reports have identified Sprint Corp. and T-Mobile US Inc. Neither of those carriers has confirmed those plans yet.

Selling Google access to their wireless networks would help Sprint and T-Mobile recoup some of their extensive investments. If Google's entry into the wireless market is successful, the company may even try to take over Sprint or T-Mobile, Menezes said. "This could end up being a `try it and then buy it' strategy," he said.

T-Mobile already has been lowering its prices and rolling out other wireless plans that have undercut the status quo. Some of those changes have prodded AT&T and Verizon to take steps that have helped their existing customers save money.

Google is constantly looking for ways to get more people online in an effort to drive more traffic to its Internet-leading search engine, Gmail and YouTube video site. All those services display the ads that generate most of Google's revenue. Google also collects commissions on millions of ads distributed to other sites.

The company is using solar-powered drones and a fleet of high-altitude balloons to beam Internet service in some parts of the world.

Read more »

BSNL to slash 3G internet rates by 50%

"We estimate that 3G data rates can be reduced by at least 50% compared to prevailing rates under phase 8 of our network expansion," BSNL chairman and managing director Anupam Shrivastav told PTI in an interview here.

The company at present offers 3G mobile internet at par with 2G rates of leading of telecom companies. It sells 1 GB of 3G mobile internet service for Rs 175 and 2GB for Rs 251.

"We have utilized over 90% of 3G capacity. If we reduce tariff right now, there can be sudden increase in traffic and network may not be able to bear the load. Once we expand this capacity to handle adequate traffic under phase 8, we will reduce rates," Shrivastav said.

The company is at present working on phase 7 network expansion plan which has an outlay of about Rs 4,800 crore and is expected to be complete it by June this year.

The public sector firm has started working on phase 8 network expansion plan and expects to start issuing tender for this phase in the first quarter of financial year 2015-16.

The company was allocated 3G spectrum in 2009 but it has not been able to invest between 2009-13 in building network due to various procedural issues and mainly due to cash crunch that it faced after paying for two sets of airwaves — 3G and broadband wireless access spectrum in 2010.

Shrivastav said that to increase mobile internet traffic capacity BSNL is tuning its network for next generation internet ids known as IPv6 and adding more 3G capacity in its regional node centers.

Under phase 8, BSNL has plans to integrate Wi-Fi hotspots that it is rolling out in 2,500 cities and towns with 3G by end of next year to increase network capacity.

"We are integrating our 3G network and these Wi-Fi hotspots for offloading traffic from 3G network. To connect with Wi-Fi, BSNL subscriber would not require any kind of permission. The 3G subscriber will automatically connect with Wi-Fi hotspot once he is within the range and free 3G network," Shrivastav said.

Read more »

Shopping online? Follow these 5 tips to avoid frauds, safe shopping

Shopping online can be fun. There are lots of discounts, all the products are available in single place, in most of the cases you can compare products very well, there is no rush and most of the sites offer full return in case you don't like a product.

But at the same time, there is also a slight risk of fraud. The person from who you are buying something is a virtual entity and before you pay the money - even in the case of the cash on delivery - you do so before actually seeing the product in real. So how can you avoid fraudsters and minimise the risk while shopping online? Follow these steps.

Buy from "official" sellers

In India, websites like Amazon and Flipkart are market places and because they have foreign investors these websites can't actually sell products in India. Instead they can only provide the market place for other sellers. Yet, not all sellers on these websites are equal. A couple of them are almost like "official sellers" even though they are not actually Amazon or Flipkart.

In the case of Flipkart, this seller is WS Retail. Buying something from WS Retail is almost 100 per cent safe. So when you are buying a product from Flipkart, make sure you get it from WS Retail. Though on most occasions, the prices of WS Retail are also "official", which means on higher side. But a premium of a few per cent in price is worth paying for safer and better shopping experience. WS Retail is also the only seller on Flipkart that offers 30-day return guarantee. The others offers 7-day or 10-day return guarantee.

On Amazon, a similar seller is called CloudTail.

On Jabong and Myntra, most of the stuff is sold by official seller. But both also have a lot of products sold by third-parties. As much as possible, buy goods directly sold by Myntra and Jabong. Usually these have faster shipping times. Both websites make the identity of the seller in the product description. So watch that, especially if you want the product delivered with a day or two.

Buy goods that are already in warehouse

Amazon, FlipKart and SnapDeal have their warehouses where goods, even those by third-party sellers, are stored. Once a consumers buys these goods, the shipping process is handled not by seller but by Amazon or Flipkart. If possible buy the goods that are already in warehouses managed by e-commerce companies. On Amazon, these products carry a tag called Amazon Fullfilled. On FlipKart, Flipkart Advantage while on the SnapDeal the tag is SafeShip.

Seller rating is important

Before you hit the buy button, check the seller rating. This is especially true for websites like eBay and Snapdeal. Ideally, you should buy from sellers who have done lots of transactions, say something 50 or more, and have a rating of more than 90 per cent or four stars. A good rating means the seller is efficient and is doing business in a professional and serious way.

On eBay use PaisaPay

While cash-on-delivery is a great way to shop, it is not always the safest, especially for eBay transactions. On eBay, if you use PaisaPay, the seller is not paid until you have got your goods and are satisfied with what you have got. If there is some problem, eBay withholds the money, steps in and tries to resolve the problem. This means your money is safe and in case the seller can't satisfy you, there is an option for you to cancel the transaction and get the money back. But this works only if you use PaisaPay. If you choose to pay seller directly, eBay can't help you much.

If it is too good to be true, avoid it

We all are familiar with the online shopping horror stories. In most cases, it is something like this: A person sees an expensive product selling for a ridiculously low price. He or she orders it. When the product is delivered it turns out to be a few pieces of stone or a plastic or something similar.

If you come across a deal that is too good to be true, it probably is. The only way you should go for extraordinarily good deals is if they are offered by reliable sellers or official sellers. If it is from someone on eBay who has a seller rating of 50% and has done only 20 transactions, avoid it.

Read more »

Google Play offering free apps, games, and movies on third anniversary

On its third birthday, Google Play will be giving away free as well as discounted apps and games to its users. 17 'hot deals' are available through various categories, and Google Pay US has listed 33 such deals.

Games such as Racing Rivals are up for grabs for free. Other free app downloads include Wunderlist, whereas Runtastic Running PRO and Runtastic Sit-Ups PRO Trainer, and Facetune are available for Rs.6. 

Also, movies on Google Play India include Bean, Honey, I shrunk the kids, High School Musical 3 Senior Year, Hannah Montana The Movie, Race 2, ABCD, Ek Main Aur Ekk Tu, and Barfi. Some books on the list are Breaking Out and Making Big, A No-nonsense Book on Start-Ups and Entrepreneurship, Feel Fit, Look Fantastic, and Jail Diary. 

Whereas, in the US version, Runtastic Runner app is now selling for $0.10, while Kill Bill Volume One and Two are available at $2.99 each. To recap things, Google rebranded Android Market into Google Play in 2012. 

Read more »

Google breaks promise of data encryption on Android Lollipop

Google seems to have silently backed out from its promise. Last year, the tech giant had announced that all its upcoming devices running android 5.0 Lollipop would require full-disk encryption.

With the new phones running Lollipop are out in the market, they don't seem encrypted by default making it clear that the company has quietly pulled back its promise.

Last year, Google had said that the devices running its next version of Android a 5.0 Lollipop will require full-disk encryption on all upcoming phones by default.

Google's Android 5.0 compatibility definition for full-disk encryption states, "For devices supporting full-disk encryption, the full-disk encryption should be enabled all the time after the user has completed the out-of-box experience. While this requirement is stated as should for this version of the Android platform, it is very strongly recommended as we expect this to change to must in the future versions of Android."

However, a report pointed out by ArsTechnica reads, "At some point between the original announcement in September of 2014 and the publication of the Android 5.0 hardware requirements in January of 2015, Google apparently decided to relax the requirement, pushing it off to some future version of Android".

Another report by 9To5Google said that the Galaxy S6 demo units showcased at MWC are reportedly not encrypted.

Now it is just a matter of time and you need to wait until the final shipping starts.

Read more »

Signal 2.0 — Free iPhone App for Encrypted Calls and Texts

An open source software group, Open Whisper Systems, has announced the release of Signal 2.0 — the second version of its free and open source messaging application for iPhone and iPad users.

Signal app is specifically designed to make secure and easy-to-use encrypted voice calling. But that’s what the application was providing in its previous release introduced last July with Signal 1.0.

Apple’s iMessage also provides encrypted communication, but it was challenged by security researchers in 2013, revealing that Apple controls the key infrastructure and could, in turn, be compelled to change a key anytime they want, and read the content of your messages.

But there was no way to send secure messages from an iPhone iMessage to an Android phone, or vice versa, unless you signed up for a monthly subscription plan and got the person you wanted to communicate with to sign up for it too.

GAME CHANGER: SIGNAL 2.0

Signal 2.0 lets you send end-to-end encrypted messages to users on different platforms for free, no matter which smartphone you own, and no login, no username, no PIN required.

Signal 2.0 allows users to send end-to-end encrypted group, text, picture, and video messages between Signal on iPhone and TextSecure on Android.

"We’re going to unify TextSecure and RedPhone into Signal on Android, release a desktop version of Signal, and keep working to push the envelope of secure protocols and private communication," saidMoxie Marlinspike, the founder of Open Whisper Systems on Monday.

SIGNAL 2.0 KEY FEATURES

• The end-to-end encrypted messaging support added to Signal 2.0 for iPhone is Free and Open Source. 
• Besides sending text, images and videos, Signal also supports free calls.
• Signal app doesn’t require a login, usernames or PINs. It uses only your phone number and address book to get you started with end-to-end encrypted texting and calling.
• Signal makes your conversation end-to-end encrypted in such a way that nobody, including the company, can tap into calls or read your conversations.
• Signal also supports forward secrecy, so if an attacker steals your encryption key, they cannot go back and decrypt messages they may have collected in the past.
• With Signal 2.0 release, you can message across iOS and Android (via a third-party app called TextSecure) without any fees or set up.

"We cannot hear your conversations or see your messages, and no one else can either." 

Washington-based software firm Silent Circle, offers encrypted calling and texting services for a monthly subscription, and is a partner in Geneva-based SGP Technologies which makes the BlackPhone, a security minded device that offers 'PrivatOS' that allows users to make and receive secure phone calls, exchange secure texts, encrypted file storage, secure video chat, and anonymize your activity through a VPN (virtual private network).

However, with Signal 2.0 you can send and receive strongly encrypted messages and voice calls for free via a simplest and easiest interface yet, making it usable for those users who doesn't know too much about encryption to use.

HOW TO SET UP ?

Installing Signal to your devices requires some simple steps.

• Just verify your device’s phone number through a one-time code that is sent to you via an SMS.

According to Marlinspike, the high-profile coverage of government spying is increasing demand for encrypted messaging apps such as Signal and Telegram, an app that offers strong encryption has already sent over 40 million messages.

"Every time [Intercept parent company] First Look publishes a story, our installs go up," Marlinspike toldFusion. "It’s well-documented that calls and messages you send over [phone networks] are not private. Things like Signal are a way to have private communication from your phone and also a better experience. Sending media messages to your friends will be frictionless and high quality and a lot better than sending MMS."

Signal costs nothing to use and is funded by community donations and grants. It’s also open source, means its source code is available on Github, so it gives app developers as well as you opportunity to verify the app’s integrity. So, in case you feel WhatsApp suspicious and Telegram complex for you, Signal is free on the App Store to use

source thehackernews

Read more »

Facebook Employees can Access your Account without Password

Do you know that your Facebook account can be accessed by Facebook engineers and that too without entering your account credentials? Recent details provided by the social network giant show who can access your Facebook account and when.

No doubt, Facebook and other big tech companies including Google, Apple and Yahoo! are trying to keep their data out of reach from law enforcement and spies agencies by adopting encrypted communication and end-to-end encryption solutions in near future, but right now they have access to your personal data, and at least few of their employees can access it with one click.

Earlier this week, director at the record label Anjunabeats, Paavo Siljamäki, brought attention to this issue byposting a very interesting story on his Facebook wall. During his visit to Facebook office in LA, a Facebook engineer logged into his Facebook account after his permission, but the strange part — they did it without asking him for the password.

ACCESS WITHOUT NOTIFICATION

Facebook even didn’t notify Siljamäki that someone else accessed his private Facebook profile, as the company does when your Facebook account is accessed from any new device or from a different Geo-location.

Siljamäki got in contact with Facebook in order to know how many of Facebook's staff have this kind of 'master' access to anyone's Facebook account and when exactly they can access users’ private data, and also, how would anyone know if his/her Facebook account has been accessed.

When the social network giant asked about how the employee got access to user’s Facebook account without entering the account credentials, Facebook issued the following statement:

"We have rigorous administrative, physical, and technical controls in place to restrict employee access to user data. Our controls have been evaluated by independent third parties and confirmed multiple times by the Irish Data Protection Commissioner’s Office as part of their audit of our practices."

WHO CAN ACCESS MY FACEBOOK ACCOUNT?
The company didn’t explain exactly who can access what, but it assured its users that the accounts access is tiered and limited to specific job function. The access to accounts are granted to most employees in order to reply to a customer request for information or error report.

"Designated employees may only access the amount of information that’s necessary to carry out their job responsibilities, such as responding to bug reports or account support inquiries," Facebook goes on explaining. "We have a zero tolerance approach to abuse, and improper behavior results in termination."

In short, the social network giant has a customer service tool that can grant Facebook employees access to a user’s account. Facebook runs two separate monitoring systems that generate weekly reports on suspicious behavior which are then reviewed and analyses by two independent security teams, specifically a selected group of employees.

Facebook gives a strict warning when hired employees to use this tool and fired any employee directly who abuse it. So, you need not to worry about Mark Zuckerberg accessing your account, unless you yourself ask Facebook for help with something and have given permission.

SOURCE :thehackernews

Read more »