Facebook shoots first, ignores questions later; account lock-out attack works
1–10 of 90 posts
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#2Many IT security standards actually require account lock-outs. For example, PCI-DSS requires it. No one seems to understand that the goal of the attack may be to deny access. The attackers may not want to compromise the account, only to keep someone (or a group of people) locked out for a bit while they do something bad elsewhere.
Edit: I'm surprised an account would be locked by a DMCA request though. Block or remove the content (if it's a legit DMCA notice) but keep the account alive. That's just one more way to carry out this sort of denial of service attack.
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#3It looks more like facebook PAGE lock-out. Furthermore, aren't they legally obligated to do this under DMCA?
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#4It looks more like facebook PAGE lock-out. Furthermore, aren't they legally obligated to do this under DMCA?
Yes. It's similar to when YouTube pulls a video temporarily over copyright claims. I don't see how a page can go down several times, though - there are only so many copyright holders.
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#5It seems like someone clever could easily turn this policy against itself by reporting popular facebook pages for DMCA violations. Not that I would encourage or condone such activities.
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#6It looks more like facebook PAGE lock-out. Furthermore, aren't they legally obligated to do this under DMCA?
If it's a valid notice, they have to take some action to stop infringement. It seems they should verify beforehand, but I'm sure they don't want to dedicate resources to that, so the easy thing for them to do is to lock or block access to the content and put the burden on the end-user.
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#7My boss recently went trough something similar. His profile was locked and he just received a generic email offering no explanation as to why that has happened. He sent them an email asking why he was locked out and received no response. After about 14 days he finally got an email from FB that his account was locked because of an error or something like that.
The saddest part is that now he can't use FB's advertising tools anymore, there is just some text there saying that he is locked out. No explanation. No form he could fill to resolve the issue. No nothing. And he has spent several thousands euros on FB adverts for our products (and was planning on spending even more). I really can't say anything else but what the fuck Facebook?!
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#8This is what happens when people and businesses choose to lock themselves in a walled garden they do not control.
All the businesses out there actively marketing their Facebook page should take heed. Set up and market a proper website; utilize a mailing list for client communication.
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#9It looks more like facebook PAGE lock-out. Furthermore, aren't they legally obligated to do this under DMCA?
The email Ars received doesn't mention DMCA, so it's likely not the case. If it were, there are specific requirements that Facebook would need to follow including allowing Ars to file a counterclaim which then reinstates the content and absolves Facebook of liability -- the third party would then need to follow-up directly with Ars over their infringement claims.
Re: Facebook shoots first, ignores questions later; account lock-out attack works
#10Counter-notice, but only if you are positive it's a bogus takedown.
https://www.chillingeffects.org/dmca/counter512.pdf (not actually a pdf)
They have to put it back online with a counter-notice.