Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

21–30 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#21

Post by Applejinx »

albertgoeswoof wrote: post #7

Fascinating blog post. However I don’t know why it took him so long to reach out to Facebook support, everyone knows that to get your account unlocked you just need to write a viral blog post about your experience and use your existing popularity to ensure someone at Facebook reads it, realises you’re not one of their typical peasant end users and unlocks your account for you.

The interesting question is whether this process still functions if you're identified as a person of interest to Facebook.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#22

Post by jsnell »

Here's my guess at what happened:

How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might).

Why was the account was banned with such finality, with no chance of appeal? Probably for something outright illegal, like the hijacker uploading CSAM to the account. It's totally plausible that in an obvious enough case, the policy is e.g. to refer the case to law enforcement and keep the account disabled.

Why did the attacker want to get the account permanently disabled? Maybe an account disable doesn't stop ad campaigns on FB. So the attacker sets up an ad campaign, and then gets the account banned so that the owner can't reverse it.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#23

Post by cs2733 »

theshadowknows wrote: post #13
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

For work things I often have to enter a code from one or another app that expires every few seconds. I've always wondered how exactly that works. Where might I go to find out about that? Is it as straight forward as googling "how two factor authentication works" or is there some other terminology?

They're called Timed One-Time Passwords or TOTP and they're one form of 2FA

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#24

Post by ianburrell »

recursive wrote: post #15
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

How is that possible? Codes from authenticator apps I've seen are 6-digit decimal codes. I don't know much about how it works. But I can't see how this is immune from mitm. I pretend to $SERVICE and ask you for your authenticator code. If you fall for it, you'd give me the code, which I can use to impersonate you for the next 30 seconds.

U2F/WebAuthn doesn't use six digit codes. You plug in USB key, press button on top of key, and browser does exchange with key and passes result to site.

The exchange between browser and key includes the domain of the site. It only works on the same site where registered the key.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#25

Post by jokoon »

unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

I think they are at a point where they would rather side with a scammer since they generate more money from this situation.

I guess they have data that shows this particular kind of user will almost never buy ads ever again, so at least let a scammer do it.

You're right, this is weird, but if you look at the profit model, it makes sense, and there are no laws that would really protect the user.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#26

Post by ImuMotive »

only_as_i_fall wrote: post #6
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

How does an sms hijacking attack typically work? I know sms isn't secure, but how does one go from having a password to bypassing the sms confirmation? Is it as easy as having the number and carrier?

It happened to me. Cellular carriers, in my case T-Mobile, didn't require any confirmation to port a number to a new phone/sim.

Eventually some required the last 4 of your social security number to port a number, which we all know at this point are pretty much public anyway.

T-Mobile now lets you set an arbitrary pin, which my parents promptly set to their DOB :facepalm:

I haven't looked more into it, but as far as I know, sim swap/port attacks were hilariously simple to execute which is why I only use SMS verification when it's the only option.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#27

Post by drummer »

jsnell wrote: post #22

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might). Why was the account was banned with such finality, with no chance of appeal? Probably for somethi…

That is correct; ads keep running while account is blocked.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#28

Post by madars »

recursive wrote: post #15
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

How is that possible? Codes from authenticator apps I've seen are 6-digit decimal codes. I don't know much about how it works. But I can't see how this is immune from mitm. I pretend to $SERVICE and ask you for your authenticator code. If you fall for it, you'd give me the code, which I can use to impersonate you for the next 30 seconds.

Codes from those apps are typically TOTP: a deterministic output given a shared secret (e.g. from QR-code during the setup procedure) and current time interval, e.g. HMAC(shared-secret, time-interval) mod 10^6. This does not embed the domain. However, U2F is a completely different protocol that does: you'd typically insert a YubiKey in a USB port and tap a button on it when the browser sends "plz sign a request from login.bank.com" (+ other associated data) https://developers.yubico.com/U2F/Protocol_details/Overview....

(Note that most YubiKeys also support non-U2F modes, most commonly HOTP (HMAC(shared-secret, counter); counter +=1))

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#30

Post by loloquwowndueo »

Scaevolus wrote: post #3
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

It’s probably worth faking having lost your 2FA and asking for it to be reset. If you find out they are this careless with 2FA-protected accounts, you should probably not rely on it too much.

I manage an authentication and identity provider and if someone gets locked out of 2FA and can’t prove their identity via a previously-uploaded gpg key, they get locked out for good. I never honor requests to reset the device sent by email, no matter how much they beg or offer to prove identity by sending copies of official IDs - I don’t care who they are now, I care about them being the same person that set up the account and 2FA, which can only be proven via a valid 2FA device or a GPG signature.

Post reply on HN