Facebook, 1 Hacker , way. Hah hah ha
Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
91–100 of 388 posts
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#92> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…
For work things I often have to enter a code from one or another app that expires every few seconds. I've always wondered how exactly that works. Where might I go to find out about that? Is it as straight forward as googling "how two factor authentication works" or is there some other terminology?
A simplified and inaccurate version:
- You and I share a secret at my first login. Let's say our shared secret is "wibble".
- For any subsequent successful login with my username and password, for the second factor I send you the last six digits of the SHA1-hash of ("wibble" XOR current timestamp)
- You calculate the second factor yourself as well by doing the same operation (you have stored "wibble" for my username, and know the current timestamp), and verify those last six digits. If they are wrong, I am an attacker!
An accurate version: https://datatracker.ietf.org/doc/html/rfc6238
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#93Earlier quoted context omitted.
> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued…
If you choose to opt-in to Advanced Protection, you can keep a backup hardware token somewhere outside of your house.
My concern with that is that if something happened to the off-site token (e.g., ESD damage, or even just random failure over time), I may not realize until I needed it.
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#94Earlier quoted context omitted.
Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.
Old school phishing is the most common MFA bypass. Here is a description how it works: https://github.com/wunderwuzzi23/KoiPhish Unless you use Yubikeys (webauthn) etc these phishing attacks just continue to work. I do consultancy in this space at times and about 95+% of folks who enter their password will also enter their MFA token.
I might be tempted to enter the TOTP, but my browser is unlikely to enter the password, and I definitely won't.
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#95I had someone contact me on Facebook marketplace, we agreed upon a time/price and then they asked for my phone number (which I sadly gave them). Then they said "I'm going to text you a code, so I can verify you are legit". The text I got was from Google Voice's 2FA.....
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#96Earlier quoted context omitted.
If the session cookie was stolen, there's no new login to detect and send a security notification about.
Can't they detect that the session cookie is coming from a different IP than the one it was originally issued to?
A carrier-grade NAT could make you change IP address. TOR will do it. You would cause yourself more problems if you would start to bind a session to an IP address.
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#97So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…
There are many motels, but Facebook has a monopoly on facebook accounts. If you could make a facebook account somewhere else, you could "take your business elsewhere".
Last I checked, FB actively banned using their APIs to build a competing product. I wish the government would make it mandatory to offer federation if you had, say, more than a million customers. But alas, governments rarely do what's convenient for customers.
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#98Earlier quoted context omitted.
Can't they detect that the session cookie is coming from a different IP than the one it was originally issued to?
Technically that's possible but there would be too many false-positives. People would be signed out every time they took their laptop home from a coffeeshop or connected over a mobile hotspot.
Yes. Facebook has implemented features to try to keep their users signed in, even if the user indicates that they want to sign out. Therefore, Facebook wouldn't want to sign people out if they go to a coffee shop.
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#99Earlier quoted context omitted.
Yubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.
Yubikey is actually pretty "phishable", at least in the OTP mode. It will happily put the token into a phishing website (or literally anywhere else) as soon as you touch it. It's also good to know that Yubikey's OTP tokens don't expire based on time, but based on a hidden counter that gets incremented with every issued token. So if you've accidentally touched your Yubikey and leaked the token publicly, you just have…
Yubikeys (or at least some models) can be configured with multiple different OTP implementations. Yubico's own OTP implementation behaves as you have described. It is not a guarantee that generating an OTP from a Yubikey means you have generated a Yubico OTP.
Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card
#100Earlier quoted context omitted.
Could you describe the types that are non-phishable?
Yubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.
What happens if the Yubikey goes bad? I use one for work, and the last 2 keys I had developed some hardware issues, and stopped responding, so I had to get a new one.