Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card • Hacker News Board

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#321

Post by tialaramex » Sat, Aug 21, 2021, 9:34 AM UTC

Thorrez wrote: post #300

notanzaiiswear wrote: post #297

Earlier quoted context omitted.

I can't make sense of your explanation. In 1) I don't think my YubiKey knows anything about the sites I use it for? It just creates keys, so a phishing site could presumably still steal the key created by YubiKey and pass it on to the real site. 2) My fingerprints definitely don't know anything about web sites. So WebAuthn being unphishable has nothing to do with fingerprints. It is only incidental that some devices…

1) The browser tells the Yubikey: "sign this: 'logging in to site.com at 12:34PM'". The yubikey signs it and gives the signature to the browser. The browser gets the signature and passes it on to the site. attacker.com will get a signature over 'logging in to attacker.com at 12:34PM'. That signature will not allow the attacker to log in to facebook.com . 2) Correct. In fact you don't even need a hardware token. You c…

> The browser tells the Yubikey: "sign this: 'logging in to site.com at 12:34PM'"

It's even a little bit cleverer than that. During enrollment (to say, Facebook.com) your Yubikey provides a random looking "identifier" to Facebook.com, and it promises that it can sign future logins if Facebook.com shows it the same identifier. The identifier is bound to the DNS name!

So a phishing site has a few choices, none of which help the bad guys even a tiny bit:

* It claims to be Facebook.com, but it isn't, so the web browser just doesn't even show the UI for Security Keys. There's a behind the scenes Javascript error basically, "What? You aren't Facebook.com fool".

* It admits its real DNS name, and makes up a random identifier. The browser gives the random identifier and the real DNS name to your Yubikey. But, it has never heard of this combination, so, it blanks the entire authentication figuring this must be for a different Security Key plugged in on another port or something.

* It gets that identifier code for your login from Facebook, and then admits its real name to your browser and provides the identifier taken from Facebook. This still doesn't match, and the Yubikey again assumes it must be for some other Security Key on your system.

Behind the scenes this is actually done with AEAD cryptography, maybe with AES keys baked inside your Yubikey. The "identifier" is actually something like a private key (likely elliptic curve parameters) that has been encrypted using an onboard secret AES key in an AEAD mode, with the DNS name (well, a hash derived from it) as a factor.

As a result, your Yubikey can't even decrypt the "identifier" correctly in order to log you in without the matching DNS name. This means goofs in the implementation fail safe - e.g. one brand of cheap Security Keys can fail to sign in once every 256 tries on average due to a logic bug. But they'd never sign in where they shouldn't because of mathematics, to do that they'd need to "accidentally" completely break the mathematical foundations of the cryptography!

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#322

Post by firecall » Sat, Aug 21, 2021, 9:39 AM UTC

drummer wrote: post #27

jsnell wrote: post #22

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might). Why was the account was banned with such finality, with no chance of appeal? Probably for somethi…

That is correct; ads keep running while account is blocked.

Yep!

Happened to me!

Account restricted from modifying ads. But yet the account kept going, spending money, and I couldn't stop them!

Thankfully I had a second admin on the account and was able to get back in.

Now I make multiple accounts to run Ads.

If you search, it's a common problem!

Whats infuriating is that FB want you to use your own FB account to run business accounts, and it's against T&Cs to make fake accounts.

But yet you can be attached to a clients account and get Ad banned for something they do!

Gah! The attitude of FB and Google is infuriating!

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#323

Post by darkwater » Sat, Aug 21, 2021, 9:41 AM UTC

Marsymars wrote: post #221

cinntaile wrote: post #168

Earlier quoted context omitted.

A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real s…

> It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. I can think of options less extreme than keys gone = account gone that are still very secure.…

> DNA sample

and who's gonna pay for that? Seems pricey and doesn't scale exactly well.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#324

Post by cinntaile » Sat, Aug 21, 2021, 9:47 AM UTC

Marsymars wrote: post #221

cinntaile wrote: post #168

Earlier quoted context omitted.

A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real s…

> It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. I can think of options less extreme than keys gone = account gone that are still very secure.…

Definitely also a good, but still very extreme option. This might actually be more secure, depending on the threats you have to take into account. It would be possible to retrieve the account after a (physical) hack.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#325

Post by gingerlime » Sat, Aug 21, 2021, 10:04 AM UTC

stavros wrote: post #314

Thorrez wrote: post #300

Earlier quoted context omitted.

1) The browser tells the Yubikey: "sign this: 'logging in to site.com at 12:34PM'". The yubikey signs it and gives the signature to the browser. The browser gets the signature and passes it on to the site. attacker.com will get a signature over 'logging in to attacker.com at 12:34PM'. That signature will not allow the attacker to log in to facebook.com . 2) Correct. In fact you don't even need a hardware token. You c…

I'm still waiting for password managers to add soft-WebAuthn support, so I can log in using my password manager (and no physical keys or passwords). That would make password managers ten times better. Then again, it doesn't have to be the password manager that does this, but it'd be nice if it were integrated.

yes exactly! Bitwarden supports TOTP nicely already. And I think you can authenticate to it with FIDO2 apparently. It would be awesome if it could do software-based WebAuthN but I don’t think it does…

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#326

Post by stavros » Sat, Aug 21, 2021, 10:08 AM UTC

gingerlime wrote: post #325

stavros wrote: post #314

Earlier quoted context omitted.

I'm still waiting for password managers to add soft-WebAuthn support, so I can log in using my password manager (and no physical keys or passwords). That would make password managers ten times better. Then again, it doesn't have to be the password manager that does this, but it'd be nice if it were integrated.

yes exactly! Bitwarden supports TOTP nicely already. And I think you can authenticate to it with FIDO2 apparently. It would be awesome if it could do software-based WebAuthN but I don’t think it does…

It doesn't, unfortunately. I've opened an issue on their forum but nothing yet. Not many websites support WebAuthn (let alone passwordless), so I guess password manager vendors aren't in a hurry to implement it.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#327

Post by laumars » Sat, Aug 21, 2021, 10:14 AM UTC

tobyjsullivan wrote: post #80

EMM_386 wrote: post #74

Earlier quoted context omitted.

Can't they detect that the session cookie is coming from a different IP than the one it was originally issued to?

Technically that's possible but there would be too many false-positives. People would be signed out every time they took their laptop home from a coffeeshop or connected over a mobile hotspot.

They could use your local MAC or maybe detect the local radius of your IP (eg if you suddenly appear from a different continent then send a confirmation email). Sure, people using Tor might get burnt but those use cases are likely less common than those who are getting their session cookies hacked.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#328

Post by tialaramex » Sat, Aug 21, 2021, 10:18 AM UTC

AlexCoventry wrote: post #237

tialaramex wrote: post #69

Earlier quoted context omitted.

WebAuthn (or its predecessor U2F but that's obsolete, so in green field deployments do WebAuthn) is the only practical non-phishable second factor for ordinary users on the web. You can do this two ways, one of which will make more sense for your web site: 1. PCs/ laptops/ etc. can use little USB hardware devices, from outfits like Yubico, the word to Google or type into your preferred hardware source is "FIDO" altho…

> if you have spare cash and like cool toys FIDO2 is a more capable second generation of the technology. Why would you want passwordless authentication? Isn't the whole point of 2FA that you have to have something and you have to know something?

The cheapest available FIDO2 option is PIN-based so your PIN (actually any password, it doesn't need to be like a bank PIN) is the something you know, and the FIDO2 authenticator is something you have, two factors. You don't need to pick a PIN to have conventional "second factor" working but if you want a usernameless authentication you can have that by choosing a PIN.

What's different compared to having a web site password? The web site knows the password, but they don't know your PIN. This means suddenly relatively weak human memorable passwords are good enough, because bad guys can't break in and steal 40 million of them in seconds or leverage them across multiple sites, the PIN is useless without the authenticator.

But other FIDO2 authenticators can do fingerprints, making it something you are (a person with that fingerprint) and something you have (the authenticator) so two factors again.

Usernameless (rather than passwordless) is the differentiator. You can literally have the sign-in flow be a "Sign In" button and the user does the thing (finger on reader, types in PIN, or maybe looks at camera) and they're authenticated. No step where you type in an email address or a username. This has a privacy cost because it means the authenticator knows in some sense who you are, but it is super convenient if that's what you're all about - while being much more secure than today's username + password dance.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#329

Post by xwolfi » Sat, Aug 21, 2021, 10:37 AM UTC

jokethrowaway wrote: post #38

loloquwowndueo wrote: post #30

Earlier quoted context omitted.

It’s probably worth faking having lost your 2FA and asking for it to be reset. If you find out they are this careless with 2FA-protected accounts, you should probably not rely on it too much. I manage an authentication and identity provider and if someone gets locked out of 2FA and can’t prove their identity via a previously-uploaded gpg key, they get locked out for good. I never honor requests to reset the device se…

It could be worth it to spend the 1.50$ on stripe to do identity verification with id documents for accounts of a certain size, so that they can present those documents again to regain access to their account. Re-enabling the account after a certain period of time without activity would also be a good measure (on top of the id verification).

And then lose the documents in a big hack so that everyone with a forum access can use your passport copy. yes.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#330

Post by tialaramex » Sat, Aug 21, 2021, 10:45 AM UTC

hackettma wrote: post #86

wunderwuzzi23 wrote: post #56

Earlier quoted context omitted.

Old school phishing is the most common MFA bypass. Here is a description how it works: https://github.com/wunderwuzzi23/KoiPhish Unless you use Yubikeys (webauthn) etc these phishing attacks just continue to work. I do consultancy in this space at times and about 95+% of folks who enter their password will also enter their MFA token.

Followed the link and the read me is bit spare on details. For the less technical this still would require the phishee to manually enter credentials which then can be relayed to the attacker. Correct? The article mentions this happened while the author was asleep — any thoughts on how that would work?

One thing that can happen is you get enduring credentials from the OTP sign-in, and they last despite other credentials simultaneously existing elsewhere.

I only use Facebook trapped inside Facebook Container in one Firefox on one computer. But my understanding is that it's possible to sign in to Facebook from say a phone and a laptop at the same time, so the bad guys could get you to give them working credentials one day and persist those until you're asleep before using them. If you went to Facebook's security settings "Where you're logged in" and it lists two logins, one in "Paris" while you are in New York, you might realise there's a problem and force them out. But most people likely never look at that, why would they?