Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

61–70 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#61

Post by encryptluks2 »

madars wrote: post #14
encryptluks2 wrote: post #4

Earlier quoted context omitted.

What you're describing here isn't exclusive to hardware tokens and nothing preventing software from checking the domain using TOTP.

How? TOTP does not embed the domain, as it is generated on a separate device which does not communicate with your browser, and does not know the target domain. TOTP is literally HMAC(shared-secret, time-interval) mapped to a short range (e.g. mod 10^6).

> it is generated on a separate device which does not communicate with your browser, and does not know the target domain.

No, not always and many password manager solutions do integrate with your browser and know the domain for the password.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#62

Post by lotsofpulp »

shortstuffsushi wrote: post #40
unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

This is largely my thought too. This exact story we've seen repeated how many times now? What is the outcome? It seems the users are left in the lurch, having lost access to their accounts and any associated resources without any recourse, and that's that. The end. What will it take to have them create some mechanism for recovery?

>What will it take to have them create some mechanism for recovery?

People valuing it sufficiently to choose an alternative (and most likely paying for an alternative) over the benefits of free access to an established network.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#63

Post by klodolph »

gonehome wrote: post #51
baxtr wrote: post #48

Earlier quoted context omitted.

Could you describe the types that are non-phishable?

Yubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.

YubiKey uses U2F and FIDO2/WebAuthn. The YubiKey also does a lot of other things, depending on which YubiKey you have... but if you want 2FA on random websites, those are the most likely protocols (used for GitHub and the like).

The basic U2F + FIDO2/WebAuthn is the least expensive model, around US$25. These days it works seamlessly on Chrome, Firefox, and Safari.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#64

Post by josephcsible »

lotsofpulp wrote: post #57
josephcsible wrote: post #45

Earlier quoted context omitted.

> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued…

>If you need to reset 2FA, go somewhere in person with a government-issued photo ID (which we already have procedures to replace) that all of the details of match. Very few people are going to want to pay for this labor if the perception of risk of using a free account is as low as it is now.

What about giving people a choice like this to pay for the labor? Either pay $1 per month for your account, and then this service is free for you whenever you need it, or have a free account, but then this service costs you $1000 if you ever need it.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#65

Post by milkytron »

potatolicious wrote: post #53
unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

> And Facebook refuses so much as to pick up the phone to discuss it. It's part of the business model - each FB user generates so little revenue for the company that you can't afford to offer anything resembling "real" support channels. The company is massively profitable by sheer scale - by making a small amount of money per year off of a vast number of users. This applies to Google as well - or really any ad-based…

In this case though, the customer did buy a product, the Oculus Quest.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#66

Post by rsync »

In other news, I built and deployed a "2FA Mule" last weekend.

It's a stock android phone with no google account and no apps installed except for "SMS Forwarder"[1].

It is configured to forward all SMS to an email address via encrypted SMTP. This means that I can receive these 2FA codes anywhere I have Internet access - such as an airplane or newly arrived in a foreign country where my SIM card does not work.

The "2FA Mule" itself is plugged in at my office in a corner.

I'm not employing this for anything sensitive but it's interesting to consider that I can use SMS based 2FA while divorcing it from my day to day SIM identity ...

[1] https://play.google.com/store/apps/details?id=com.frzinapps....

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#67

Post by krastanov »

recursive wrote: post #33
jeffbee wrote: post #19

Earlier quoted context omitted.

That's why they said you should use U2F, not TOTP.

I'm not aware of the acronyms, but I was responding to this: "a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable" That certainly seems like it's wrong, and doesn't include an acronym other than SMS. But apparently there's more depth to this space than I was aware of.

You misread that statement and the excerpt you copied completely changes its meaning if you remove the surrounding. Read it as:

"U2F/WebAuthn is secure because it does origin binding which is not phishable, unlike entering a TOTP or a code from your hardware token or authenticator app or SMS"

Putting the original parenthetical in between the start and end of the main clause definitely makes it easy to misread. I just moved the parenthetical to the end of the sentence.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#68

Post by mavhc »

potatolicious wrote: post #53
unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

> And Facebook refuses so much as to pick up the phone to discuss it. It's part of the business model - each FB user generates so little revenue for the company that you can't afford to offer anything resembling "real" support channels. The company is massively profitable by sheer scale - by making a small amount of money per year off of a vast number of users. This applies to Google as well - or really any ad-based…

Facebook revenue per US/Canada user per year ~$160

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#69

Post by tialaramex »

baxtr wrote: post #48
hn_throwaway_99 wrote: post #11

Earlier quoted context omitted.

> Beating 2FA is almost always SMS hijacking That's most definitely not true, as someone who works in this space. Plain old phishing is much more common, where the hacker tricks a user into entering their code into a malicious website. To echo OP, this is why it's important to support non-phishable types of 2FA.

Could you describe the types that are non-phishable?

WebAuthn (or its predecessor U2F but that's obsolete, so in green field deployments do WebAuthn) is the only practical non-phishable second factor for ordinary users on the web.

You can do this two ways, one of which will make more sense for your web site:

1. PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico, the word to Google or type into your preferred hardware source is "FIDO" although if you have spare cash and like cool toys FIDO2 is a more capable second generation of the technology.

In this situation the FIDO authenticator is your second factor. Your web browser takes responsibility for telling this authenticator which web site you're looking at, and it's just a dumb machine, so from its point of view obviously refunds-my-bank.example isn't mybank.example because those strings are different. The FIDO authenticator just does whatever the browser tells it.

This could be attacked by specialist malware, but it's tricky because the FIDO authenticator wants you to take physical action to trigger authentication, so the malware needs to not only tell the authenticator "Yeah, I'm totally er, Internet Explorer, and I need you to authenticate for mybank.example" but also persuade you to press the button or whatever to make it happen.

Or I guess bad guys can be like "please FedEx your FIDO dongle to us" if people really are that dumb, but then no need for phishing, just call people "Hey, I'm the IRS, send me $5000 in unmarked bills, in a FedEx box marked er cat food for some reason that totally makes sense, to a residential address in a different state, yeah".

2. High end smartphones, the sort with a fingerprint reader, can do the same exact trick using that fingerprint reader (I think some iPhones do facial recognition instead?) to do WebAuthn instead for their onboard browser.

In this case the smartphone is in charge of everything, it knows which web site this really is, it knows if that's really your fingerprint or not (the fingerprint never leaves your device) and it decides whether to send credentials.

For machines it's much easier to do a secure transaction, but machines don't fall for a lot of phishing scams.

Post reply on HN