Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

31–40 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#31

Post by nine_k »

theshadowknows wrote: post #13
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

For work things I often have to enter a code from one or another app that expires every few seconds. I've always wondered how exactly that works. Where might I go to find out about that? Is it as straight forward as googling "how two factor authentication works" or is there some other terminology?

You mean TOTP?

Imagine a hash function that generates a number from the number of minutes since epoch hashed additionally with some seed. You have it on the server, you have it on your, say, phone. When you enroll you share a seed for the generator. Since your time is synchronized, the server knows what value(s) to expect, and the phone knows which value to generate.

The real scheme is a bit more involved: https://en.m.wikipedia.org/wiki/Time-based_One-Time_Password...

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#32

Post by ceejayoz »

loloquwowndueo wrote: post #30
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

It’s probably worth faking having lost your 2FA and asking for it to be reset. If you find out they are this careless with 2FA-protected accounts, you should probably not rely on it too much. I manage an authentication and identity provider and if someone gets locked out of 2FA and can’t prove their identity via a previously-uploaded gpg key, they get locked out for good. I never honor requests to reset the device se…

> It’s probably worth faking having lost your 2FA and asking for it to be reset.

I'm not sure I trust that I'd be as good an attacker as a professional, and there's not a great way to replicate "hang up, call again" approaches likely to work with a big org.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#33

Post by recursive »

jeffbee wrote: post #19
recursive wrote: post #15

Earlier quoted context omitted.

How is that possible? Codes from authenticator apps I've seen are 6-digit decimal codes. I don't know much about how it works. But I can't see how this is immune from mitm. I pretend to $SERVICE and ask you for your authenticator code. If you fall for it, you'd give me the code, which I can use to impersonate you for the next 30 seconds.

That's why they said you should use U2F, not TOTP.

I'm not aware of the acronyms, but I was responding to this:

"a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable"

That certainly seems like it's wrong, and doesn't include an acronym other than SMS.

But apparently there's more depth to this space than I was aware of.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#34

Post by Destitute »

mushishi wrote: post #17
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

How is it possible that some kind of imaginative script can be enough to get SMS sim swapped? Why aren't the operators requiring a strong identification via a passport or something like that? Maybe I'm really dumb but that just boggles my mind, whether or not there exist other types of alternatives to 2FA.

There's not much you can confirm over the phone, except the account PIN and sometimes security hint. But an attacker can pretend to have forgotten it and press that the matter is urgent. If the attacker knows enough about the person, they might be able to convince an agent to make the swap so the agent can:

1) Get on with their day to maybe hit a support request quota 2) Make sure this person doesn't give them a bad customer satisfaction score

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#36

Post by cs2733 »

unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

Companies like Facebook are as big as Nation States.

Any positives that come out of this for the author are just a Facebook PR move. If they did care about users, their support system wouldn't be so anti-user.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#37

Post by cinntaile »

Destitute wrote: post #34
mushishi wrote: post #17

Earlier quoted context omitted.

How is it possible that some kind of imaginative script can be enough to get SMS sim swapped? Why aren't the operators requiring a strong identification via a passport or something like that? Maybe I'm really dumb but that just boggles my mind, whether or not there exist other types of alternatives to 2FA.

There's not much you can confirm over the phone, except the account PIN and sometimes security hint. But an attacker can pretend to have forgotten it and press that the matter is urgent. If the attacker knows enough about the person, they might be able to convince an agent to make the swap so the agent can: 1) Get on with their day to maybe hit a support request quota 2) Make sure this person doesn't give them a bad…

You could require verifying your identity using your electronic ID if you want to simswap by calling the helpdesk.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#38

Post by jokethrowaway »

loloquwowndueo wrote: post #30
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

It’s probably worth faking having lost your 2FA and asking for it to be reset. If you find out they are this careless with 2FA-protected accounts, you should probably not rely on it too much. I manage an authentication and identity provider and if someone gets locked out of 2FA and can’t prove their identity via a previously-uploaded gpg key, they get locked out for good. I never honor requests to reset the device se…

It could be worth it to spend the 1.50$ on stripe to do identity verification with id documents for accounts of a certain size, so that they can present those documents again to regain access to their account.

Re-enabling the account after a certain period of time without activity would also be a good measure (on top of the id verification).

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#39

Post by FabHK »

madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

In this case it seems the author was asleep, so it was probably not a phishing site passing on the legitimate TOTP.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#40

Post by shortstuffsushi »

unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

This is largely my thought too. This exact story we've seen repeated how many times now? What is the outcome? It seems the users are left in the lurch, having lost access to their accounts and any associated resources without any recourse, and that's that. The end. What will it take to have them create some mechanism for recovery?
Post reply on HN