Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

161–170 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#161

Post by jdavis703 »

mushishi wrote: post #17
Scaevolus wrote: post #3

Earlier quoted context omitted.

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

How is it possible that some kind of imaginative script can be enough to get SMS sim swapped? Why aren't the operators requiring a strong identification via a passport or something like that? Maybe I'm really dumb but that just boggles my mind, whether or not there exist other types of alternatives to 2FA.

They could require this. Most of the big operators have physical stores where they could do an ID check. There should be an advanced protection mode where SIM swaps and other sensitive operations require physical authentication.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#162

Post by rsync »

qntty wrote: post #115
rsync wrote: post #66

In other news, I built and deployed a "2FA Mule" last weekend. It's a stock android phone with no google account and no apps installed except for "SMS Forwarder"[1]. It is configured to forward all SMS to an email address via encrypted SMTP. This means that I can receive these 2FA codes anywhere I have Internet access - such as an airplane or newly arrived in a foreign country where my SIM card does not work. The "2F…

Do you pay for a separate phone line for the mule?

Yes. I have a dedicated account with a verizon MVNO and this account has no other SIMs or accounts associated with it.

However, depending on how I choose to use it I can point 2FA for numerous different services to this one SIM. I just don't want to point multiple accounts at the same service to this SIM since that's a clear, common identifier and correlates those two accounts better than probably anything else could ...

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#163

Post by kleer001 »

captainmuon wrote: post #97
unyttigfjelltol wrote: post #18

So in this story Facebook was responsible for $50 of charges, a business disruption and a huge and ongoing hassle. And Facebook refuses so much as to pick up the phone to discuss it. In the old days the equivalent would have been one of those roach motel businesses rated 'F' on the Better Business Bureau, buckets arrayed on the floor to catch rain leaking through the roof. And yet in this day it's one of the most pro…

There are many motels, but Facebook has a monopoly on facebook accounts. If you could make a facebook account somewhere else, you could "take your business elsewhere". Last I checked, FB actively banned using their APIs to build a competing product. I wish the government would make it mandatory to offer federation if you had, say, more than a million customers. But alas, governments rarely do what's convenient for cu…

> governments rarely do what's convenient for customers

or what's in the long term best interest of their citizens let alone the rest of the world. Silly humans.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#164

Post by a1369209993 »

rsync wrote: post #114
dheera wrote: post #84

Earlier quoted context omitted.

Nice. I do something similar but forward it to Slack. I also have it auto-answer 2FA calls and automatically hit the # key. Yeah, call it not real 2FA, but it's really companies that choose to not use U2F are at fault.

"I also have it auto-answer 2FA calls and automatically hit the # key." One year at defcon - maybe 20 years ago - the speaker told an anecdote about a user who had set up a webcam and put their RSA token under it. And we all laughed ... "haha what a dummy ... I can't believe users are so stupid" ... But secretly I thought it was genius.

> set up a webcam and put their RSA token under it.

That's only stupid if anyone other than you has access to your webcam.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#165

Post by zmmmmm »

loeg wrote: post #145
zmmmmm wrote: post #135

I really think for the Oculus side of this, they should be on the hook for refunding a significant portion of the cost of the user's Oculus library when they ban the account. This would put the cost of a ban to Facebook for real users in the order of hundreds of dollars which is more than enough to have a support person do a realistic evaluation of the situation. It also reflects the non-recoverable portion of the co…

> refunding a significant portion of the cost of the user's Oculus library when they ban the account This incentivizes abusive behavior by users who want refunds, and cheapens the cost of abusive behavior. This mechanism was discussed in relation to OnlyFans somewhat recently -- creators that wanted to ban abusive "fans" had to refund them. (Unfortunately, I don't have a link handy.) The problem here is that Facebook…

Ok, so the scenario is I buy a headset, create a fake account, load up on games, then abuse the account to get all of it refunded so as to effectively have free use of the games for the period of time.

But I still had to buy a headset, put in a real credit card, pass Facebooks initial "real identity" checks etc. With real human review and some basic policies to prevent repeat abuse this doesn't seem like something that would really open a wide level of abuse. Perhaps sporadic situations where the headset breaks the user decides its the easiest way to get all their purchases refunded.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#166

Post by PostThisTooFast »

Yes, Facebook is a bunch of assholes. This is obviously a grossly incompetent scenario at best, and a deliberate rip-off at worst.

But the guy totally glosses over how they could have "beat his 2FA." That is a huge unanswered question.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#167

Post by zmmmmm »

RIMR wrote: post #160
zmmmmm wrote: post #135

I really think for the Oculus side of this, they should be on the hook for refunding a significant portion of the cost of the user's Oculus library when they ban the account. This would put the cost of a ban to Facebook for real users in the order of hundreds of dollars which is more than enough to have a support person do a realistic evaluation of the situation. It also reflects the non-recoverable portion of the co…

Or have ban groups. Ban someone from having a Facebook profile, buying ads, sending Messages, or having an Instagram profile based on their behavior on those respective sections of the site. Maybe disable a person's multiplayer capabilities if they have a reputation for harassment. But let them keep their hardware running, and access their game library. Seems good for business, tbh. You might not want neo-nazis posti…

Yes, Facebook really doesn't have a convincing argument why they will not just disable the social interaction features when the ban is made on that basis. They will say that they want to build social features into all their software as integral and therefore it is not possible but it doesn't pass muster to me .... it simply isn't that hard to make it conditionally available within apps and if it is that hard then it is Facebook's fault for engineering it that way.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#168

Post by cinntaile »

someguydave wrote: post #144
cinntaile wrote: post #50

Earlier quoted context omitted.

I was under the impression you were screwed in that case, thanks for pointing out that I was wrong. It's lot less secure than I thought.

Still sounds like a significant barrier to most phishing attacks.

A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#169

Post by cinntaile »

greggyb wrote: post #103
josephcsible wrote: post #93

Earlier quoted context omitted.

My concern with that is that if something happened to the off-site token (e.g., ESD damage, or even just random failure over time), I may not realize until I needed it.

If you would like to take advantage of such an option, you are also opting in to taking on an operational burden. That burden is exactly maintaining a set of backup keys and testing them on a regular basis.

I agree with this, it was my original expectation.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#170

Post by ElijahLynn »

beezischillin wrote: post #138

This is what I'm worried about, to be honest. Not necessarily getting hacked but just getting flagged, banned and burned with no recourse. This is why I commented on an article here some weeks ago that if they ever offered any paid user experience they'd be in trouble because they'd actually have to help their users with their issues. These tech companies should offer actual support the moment you spend money with th…

I guess this is the model when the user is the product and not the customer. Flipping this, if this were a paying advertiser (customer) that got locked out, there probably is a valid path to contact someone.

Looks like it is time to remove all my Single Sign On from Google, Facebook, GitHub etc. And have individual user/pass for all of them. I have the same fear as you and way more so after reading this article, just way too much risk now.

Post reply on HN