Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

51–60 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#51

Post by gonehome »

baxtr wrote: post #48
hn_throwaway_99 wrote: post #11

Earlier quoted context omitted.

> Beating 2FA is almost always SMS hijacking That's most definitely not true, as someone who works in this space. Plain old phishing is much more common, where the hacker tricks a user into entering their code into a malicious website. To echo OP, this is why it's important to support non-phishable types of 2FA.

Could you describe the types that are non-phishable?

Yubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#52

Post by dmoy »

baxtr wrote: post #48
hn_throwaway_99 wrote: post #11

Earlier quoted context omitted.

> Beating 2FA is almost always SMS hijacking That's most definitely not true, as someone who works in this space. Plain old phishing is much more common, where the hacker tricks a user into entering their code into a malicious website. To echo OP, this is why it's important to support non-phishable types of 2FA.

Could you describe the types that are non-phishable?

So, popping up three comments, this explains which types of 2FA are not phisable:

> I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.com.totallylegit.ru and then have them enter it on real accounts.google.com. This is so because the U2F/WebAuthn security key signs a request, sent by your browser, which embeds the requesting page's domain, so a signature on attacker.com will not pass victim.com's verification checks, whereas a code from your authentication app is trivially copied.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#53

Post by potatolicious »

unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

> And Facebook refuses so much as to pick up the phone to discuss it.

It's part of the business model - each FB user generates so little revenue for the company that you can't afford to offer anything resembling "real" support channels. The company is massively profitable by sheer scale - by making a small amount of money per year off of a vast number of users.

This applies to Google as well - or really any ad-based engagement-centric business. Your individual users aren't worth enough to have human-intensive labor assigned to them, hence heavily automated support channels and little to no ability to ever have something processed by a human.

One of many reasons I pay Google to host my email rather than use a free Gmail - when you are generating a non-negligible revenue stream suddenly companies' willingness to answer emails and pick up phones increases.

When it comes to FB there's often the pithy "when you're not paying for a service you're not the customer, you're the product" - which is a simplistic take. In this case though at the very least this is true: "when you're not paying for a service your support needs are dead weight".

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#54

Post by anamexis »

baxtr wrote: post #48
hn_throwaway_99 wrote: post #11

Earlier quoted context omitted.

> Beating 2FA is almost always SMS hijacking That's most definitely not true, as someone who works in this space. Plain old phishing is much more common, where the hacker tricks a user into entering their code into a malicious website. To echo OP, this is why it's important to support non-phishable types of 2FA.

Could you describe the types that are non-phishable?

The first comment in this thread describes why U2F is unphishable.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#55

Post by InitialLastName »

Scaevolus wrote: post #3
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

Wouldn't that be obvious to the victim the moment their phone didn't work? Or will the carrier leave the old SIM activated?

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#56

Post by wunderwuzzi23 »

Scaevolus wrote: post #3
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

Old school phishing is the most common MFA bypass.

Here is a description how it works:

https://github.com/wunderwuzzi23/KoiPhish

Unless you use Yubikeys (webauthn) etc these phishing attacks just continue to work. I do consultancy in this space at times and about 95+% of folks who enter their password will also enter their MFA token.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#57

Post by lotsofpulp »

josephcsible wrote: post #45
cinntaile wrote: post #9

Earlier quoted context omitted.

Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/

> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued…

>If you need to reset 2FA, go somewhere in person with a government-issued photo ID (which we already have procedures to replace) that all of the details of match.

Very few people are going to want to pay for this labor if the perception of risk of using a free account is as low as it is now.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#58

Post by [deleted] »

cinntaile wrote: post #9
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/

[deleted]

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#59

Post by pjc50 »

unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

Leaving aside the fact that they are profitable because of the zero cost service, like Ryanair, we should consider how many businesses only have the standard they do because of consumer action through the media.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#60

Post by ignoramous »

Scaevolus wrote: post #3
madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

> ...has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...")

Isn't this vishing? https://youtu.be/BEHl2lAuWCk

Post reply on HN