Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

121–130 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#121

Post by Jolter »

optymizer wrote: post #110
tomhallett wrote: post #95

I had someone contact me on Facebook marketplace, we agreed upon a time/price and then they asked for my phone number (which I sadly gave them). Then they said "I'm going to text you a code, so I can verify you are legit". The text I got was from Google Voice's 2FA.....

How would someone use that code to hack into my GV account? Wouldn't they also need to know my password or have access to my e-mail account to login or to reset your password?

I don’t use GV, but presumably if they can make Google send you an auth SMS then they have already input your password. I’m guessing it was leaked in some big password leak, and not phished at an earlier time.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#122

Post by SrslyJosh »

> I’ve gone from a position of caution about Oculus + Facebook to a position of “Run, don’t look back.”

As if this wasn't an obvious problem.

Relying on any of Facebook, Twitter, Instagram, TikTok, etc. for anything is a risk. Doubly so if it involves your business or a product that won't work without permission from $PLATFORM.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#123

Post by rob-olmos »

1024core wrote: post #100
gonehome wrote: post #51

Earlier quoted context omitted.

Yubikey is one - it requires the user touch a hardware device which signs something locally that I think is never sent? I don’t know enough of the implementation specifics, but it’s supposed to guard against this kind of thing.

What happens if the Yubikey goes bad? I use one for work, and the last 2 keys I had developed some hardware issues, and stopped responding, so I had to get a new one.

The recommendation is to have at least one backup key.

There's also a WebAuthn extension in the works to at least make it easier to maintain a backup key by not having to pull it out of the safe every time you register MFA with a new service:

https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#124

Post by xondono »

potatolicious wrote: post #53
unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

> And Facebook refuses so much as to pick up the phone to discuss it. It's part of the business model - each FB user generates so little revenue for the company that you can't afford to offer anything resembling "real" support channels. The company is massively profitable by sheer scale - by making a small amount of money per year off of a vast number of users. This applies to Google as well - or really any ad-based…

> One of many reasons I pay Google to host my email rather than use a free Gmail - when you are generating a non-negligible revenue stream suddenly companies' willingness to answer emails and pick up phones increases.

If you think that does any difference, I hope you good luck. Google is unreachable for support, even if you are a paying user.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#125

Post by laurent92 »

jrockway wrote: post #106
tialaramex wrote: post #69

Earlier quoted context omitted.

WebAuthn (or its predecessor U2F but that's obsolete, so in green field deployments do WebAuthn) is the only practical non-phishable second factor for ordinary users on the web. You can do this two ways, one of which will make more sense for your web site: 1. PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico, the word to Google or type into your preferred hardware source is "FIDO" altho…

> PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico This is actually built into most computers now -- Windows Hello, and Apple has something similar. Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.) > I think some iPhones do facial recognition instead? Yup, they use whatever you use to…

Can you hold your NFC Yubikey to the back of an iPhone? I thought Apple didn’t do NFC, appart from ApplePay?

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#126

Post by hn_throwaway_99 »

cinntaile wrote: post #9
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/

Oddly enough, Google's Advanced Protection is the gold standard in my opinion, yet Firebase Auth, an Auth-as-a-Service product from Google, only supports SMS as a second factor, which is baffling to me.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#127

Post by Y_Y »

fitzroy wrote: post #118

What is the point of setting up a hardware or Google Authenticator-type 2FA solution when most companies will fallback to SMS? Is there a way to prevent the SMS fallback (last I checked it was 'No' for most sites except maybe Google if I remember, and then you still had to go in and manually delete it)? Does a master list exist of companies that don't use SMS, or allow the user to exclude it? Otherwise it seems like…

2FA (is supposed to) mean you have both factors, not one or the other. It's strictly more secure that either alone, even if SMS sucks.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#129

Post by shkkmo »

kbenson wrote: post #81
cs2733 wrote: post #36

Earlier quoted context omitted.

Companies like Facebook are as big as Nation States. Any positives that come out of this for the author are just a Facebook PR move. If they did care about users, their support system wouldn't be so anti-user.

It's trite at this point that someone will respond that the users aren't the customers, they're the product, but it's trite because it's often correct, and deserves to be said, so I guess I'll be the one to say it this time. The sad thing is that this person actually is a customer because they bought a product and pay for things on it, but Facebook still doesn't realize that, or more likely these customers are such a…

The problem is that "if you aren't a customer you are the product" is that frequently you are still a product even if you are a customer.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#130

Post by nimih »

laurent92 wrote: post #125
jrockway wrote: post #106

Earlier quoted context omitted.

> PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico This is actually built into most computers now -- Windows Hello, and Apple has something similar. Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.) > I think some iPhones do facial recognition instead? Yup, they use whatever you use to…

Can you hold your NFC Yubikey to the back of an iPhone? I thought Apple didn’t do NFC, appart from ApplePay?

My NFC Yubikey works fine with my iPhone 8.
Post reply on HN