Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card • Hacker News Board

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#301

Post by franga2000 » Sat, Aug 21, 2021, 7:28 AM UTC

tialaramex wrote: post #294

munchbunny wrote: post #194

Earlier quoted context omitted.

> Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.) For the client side of things WebAuthn contains a standard option to block/allow "platform" authenticators, which I empirically know includes Windows Hello, and I'm not sure about Apple's or other equivalents. Of course you'd still want to verify the attestation on t…

> Of course you'd still want to verify the attestation on the server side. You almost certainly do not want to do this for a public web site. If you insist on attestation right thinking people will hit "No" and block the site. Think about it, what is attestation doing for you in this scenario? You're saying that you don't trust your users/ customers to pick the authentication methods that work for them, and instead y…

Yes! Any developer that forces the user to use a specific type of device needs to be smacked around a bit (or more accurately, the manager that told them to do it that way). Banks are notorious for this, since their stupid 2FA apps will do insane things like scan your app list for common root-only apps and non-vendor ROMs (even with no root). Some even have a vendor whitelist that obscure brands (like OnePlus used to be) aren't on and in both cases, their only response is "well just factory reset your phone" or "just buy a different device". I've switched banks twice because of this insanity.

And there's no reason to do this! It's not like they're liable if I get my money stolen. If they prove 2FA was used and the security issue was on my device, not their app/server, it's my fault! As you said, if you're a custodian of something sensitive (an account, documents, money..), not the owner of it, it makes sense that the owner shouldd be able to dictate how you should protect it (like if you're accessing confidential company documents using 2FA). But in any other case, the service provider should never be allowed to force you to use a certain type of authentication device.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#302

Post by Thorrez » Sat, Aug 21, 2021, 7:35 AM UTC

ricardo81 wrote: post #120

jsnell wrote: post #22

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might). Why was the account was banned with such finality, with no chance of appeal? Probably for somethi…

>cookie theft I think that's quite likely. I have a (somewhat throwaway) FB account, not much of a profile and mainly used for a local cause. Co-admining a page I'd clicked on a clickbaity headline posted to the page and several days later my account was disabled. The account recovery process was completely broken/circular but somehow the account revived itself after a week. The fact that my 'friend suggestions' were…

There's no way clicking on a headline would lead to your account being hijacked... Unless there's a browser 0-day which are extremely valuable and no one would waste that on your FB account. Or if clicking the link downloaded malware and you ran the malware.

Did you ever use the password of the FB account anywhere else? You getting phished is also much more likely than a browser 0-day. Did you have a security key on the FB account?

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#303

Post by captainmuon » Sat, Aug 21, 2021, 7:39 AM UTC

tqi wrote: post #216

captainmuon wrote: post #97

Earlier quoted context omitted.

There are many motels, but Facebook has a monopoly on facebook accounts. If you could make a facebook account somewhere else, you could "take your business elsewhere". Last I checked, FB actively banned using their APIs to build a competing product. I wish the government would make it mandatory to offer federation if you had, say, more than a million customers. But alas, governments rarely do what's convenient for cu…

How would you prevent a Cambridge analytica style data "breach"?

You make explicit that all data that people enter, they enter for purposes of sharing. At the same time, you ban creating profiles with data that has not been explicitly shared. IMO:

- Make a telefone-book style listing, or searching for "all metalheads OK

- Tracking users on your site -> OK

- Tracking users on third party sites, and then aggregating this data, so you can see "people who searched for baby carrages" or "people who bought diapers with their credit card" -> not OK

- Having some kind of database where people could concievably look up what user tqi purchased, searched, what their political affiliation is (when not made public) -> not OK (unless you have extreme auditibility, four-eye principle, and so on)

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#304

Post by NiekvdMaas » Sat, Aug 21, 2021, 7:39 AM UTC

jsnell wrote: post #22

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might). Why was the account was banned with such finality, with no chance of appeal? Probably for somethi…

This 100%. I had the same thing happen to me (even though I have 2FA everywhere):

https://github.com/Niek/Niek/blob/master/facebook-scam/READM...

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#305

Post by riedel » Sat, Aug 21, 2021, 7:43 AM UTC

jeffbee wrote: post #19

recursive wrote: post #15

Earlier quoted context omitted.

How is that possible? Codes from authenticator apps I've seen are 6-digit decimal codes. I don't know much about how it works. But I can't see how this is immune from mitm. I pretend to $SERVICE and ask you for your authenticator code. If you fall for it, you'd give me the code, which I can use to impersonate you for the next 30 seconds.

That's why they said you should use U2F, not TOTP.

I really wonder why typically the default policy is to convert a totp token to a longer lived token (keep browser authorized) defying the whole idea of totp. Used like this it seems like just two passwords or am I missing anything? Phishing seems really easy.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#306

Post by tinus_hn » Sat, Aug 21, 2021, 7:47 AM UTC

mattkrause wrote: post #204

josephcsible wrote: post #45

Earlier quoted context omitted.

> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued…

I've always thought the Post Office should offer something like Option #1.

That way you end up with the same issues as we have now with SIM swapping: Post Office employees are not more reliable and not necessarily more careful with their credentials than people who can give you a new SIM card.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#307

Post by captainmuon » Sat, Aug 21, 2021, 7:55 AM UTC

kapp_in_life wrote: post #159

captainmuon wrote: post #97

Earlier quoted context omitted.

There are many motels, but Facebook has a monopoly on facebook accounts. If you could make a facebook account somewhere else, you could "take your business elsewhere". Last I checked, FB actively banned using their APIs to build a competing product. I wish the government would make it mandatory to offer federation if you had, say, more than a million customers. But alas, governments rarely do what's convenient for cu…

That's pretty silly. Should I be able to use Amazon APIs to host reviews for my competing ecommerce site? Or be able to proxy user search requests to google and then intersperse my own advertisements in the results for my web search service?

Amazon is infrastructure at this point. Everybody should have access to it. Jeff Bezos won capitalism, give him a medal and let him explore space.

Why do we treat government services and certain large private services separately? Why are government publications public domain, private publications not? Why does free speach apply to the government, but not to corporations? Why can't we treat amazon like a utility?

I believe the difference is because in the past people fought for these concessions from the state. They decided for example it would be sensible that the government should not restrict free speach. And before, they decided not to take feudalism as a given but to democratically elect their government. I know I'm being a bit dramatic, but there's no reason people couldn't get together and demand these kind of concessions from powerful corporations, too. Access to Amazon's product API is really the least example of what would change.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#308

Post by skinkestek » Sat, Aug 21, 2021, 7:55 AM UTC

voakbasda wrote: post #298

tomhallett wrote: post #95

I had someone contact me on Facebook marketplace, we agreed upon a time/price and then they asked for my phone number (which I sadly gave them). Then they said "I'm going to text you a code, so I can verify you are legit". The text I got was from Google Voice's 2FA.....

I get these texts periodically. I feed them fake codes and waste as much of their time as possible. When they figure it out, I receive threats ranging from reporting me to the authorities all the way up to killing me and raping my family. I then point out exactly how their scam works, and that they are either criminals directly or working for them as patsies. At this point, they usually stop responding. If they don’t…

I used to get some tech support scams but I think either that scam is dwindling or I've got blacklisted somehow.

Those "3rd line specialists" can get really angry when they realize the unsecure but rich old man they are talking to is far beyond them in tech and have been having fun and recording them ;-)

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#309

Post by hulitu » Sat, Aug 21, 2021, 8:04 AM UTC

Scaevolus wrote: post #3

madars wrote: post #2

> I want to start by pointing out I use two-factor authentication just about everywhere and Facebook is not an exception. I wish he'd mention what kind of 2FA. The reason you _really_ should use U2F/WebAuthn is because it does origin binding which, unlike entering a TOTP, a code from your hardware token/authenticator app on your phone/SMS/etc is not phishable, i.e. you can't enter it by accident on accounts.google.co…

Beating 2FA is almost always SMS hijacking, but sometimes it's social engineering where the attacker has figured out just the right script to tell support ("oh, I dropped my phone and it won't turn on...") to get it disabled. edit: correction, beating 2FA without phishing -- like in the post where he lost his account while asleep.

There is also the ad which runs on the same webpage and reads what you type or your clipboard.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#310

Post by jhugo » Sat, Aug 21, 2021, 8:05 AM UTC

sascha_sl wrote: post #295

drivebycomment wrote: post #222

Earlier quoted context omitted.

Advanced Protection does have the account recovery. https://landing.google.com/advancedprotection/faq/ It is just very slow as it's a human process. There's very little reason you shouldn't use Advanced Protection, if your account is important enough.

Big caveat being you can no longer use the account to develop things with the Google API or use some third party clients (e.g. rclone).

Which Google API do you mean? I use advanced protection and have developed various things with various Google APIs, I just use a service account with minimal privileges for each thing I'm developing, which is probably best practice anyway. Not sure about rclone but probably it would work fine with a service account too?