Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

codewriteplay.com

Post reply on HN
Print view View original

331–340 of 388 posts

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#331

Post by tialaramex »

andybak wrote: post #320
FabHK wrote: post #94

Earlier quoted context omitted.

I might be tempted to enter the TOTP, but my browser is unlikely to enter the password, and I definitely won't.

I think the fact that password managers can spot incorrect urls better than users is useful. However I've become numbed to this warning flag by those services that seem to have endless different urls that are all legitimate. (Microsoft being a particular offender here). I can imaging some variant of outlook.microsoft.developer.really.yes.com catching me unawares one day.

Microsoft does seem to know how to do this correctly when they have to, as they offer WebAuthn and there is deliberately no way to tell WebAuthn "I know this is outlook.com but I need live.com credentials". So they will bounce you through the right name to make it work. But you're correct that for phishing this habit of making up new DNS names is a problem, ie it convinces the lay person they have no idea and should just fill in their password wherever it's requested.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#332

Post by petee »

cmattoon wrote: post #41

I can't tell you how many obviously-fake profiles and scammers I report, and see other people commenting about reporting, only for them to still be around days, weeks, sometimes even months later. All of these were obvious scammers directing traffic to a single profile - some forex guru or whatever. Shilling get-rich-quick schemes doesn't meet Facebook's definition of "spam", apparently. https://imgur.com/a/xihRPwE W…

Ironically you have to be careful doing this, as their systems can ban you for too many reports, if they aren't all flagged as 'legitimate' scammers. The last time I filed a report I had this new warning show up at the bottom prior to submission

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#333

Post by StreamBright »

jsnell wrote: post #22

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might). Why was the account was banned with such finality, with no chance of appeal? Probably for somethi…

I thought session cookies are tied to a specific browser/is/ip/etc. combo

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#334

Post by iggldiggl »

staticassertion wrote: post #319
Macha wrote: post #226

Earlier quoted context omitted.

And that's why "everyone should just use yubikeys" is never going to happen.

Everyone already pays the same operational burden with their house keys, which are far more difficult to manage for the average person (as they leave the house constantly). It's worked fine for hundreds of years.

House keys don't just randomly break the way electronics sometimes do, though.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#335

Post by u801e »

tialaramex wrote: post #296
u801e wrote: post #275

Earlier quoted context omitted.

It certainly would make sense to improve the UX as opposed to coming up with different implementations. webauthn basically forces use of HTTP as the application level protocol, whereas a client side TLS certificate will work regardless of which application protocol is in use.

Client certificates, as the name might hint, certify your identity. But a big thrust of technologies like U2F and WebAuthn was not to do that, for privacy reasons. My FIDO authenticator has no idea who I am, no opinion who I am, so you can't use it to do identity correlation. It's only useful for the very specific problem we wanted to solve "Are you still you?" "Yes". In contrast a client certificate for u801e is end…

> In contrast a client certificate for u801e is enduring proof you're u801e and signatures the client cert makes during login will be durable proof that u801e logged in. PornHub can show Facebook and GitHub that the same user is using their site. So that's a privacy hole you can drive a truck through.

Client certificates can certainly be separated based on different domains. So, there would be no way to really determine my identity across multiple websites if I sent each one a different CSR and they each gave me different client certificates. The browser should only send the client side TLS certificate that's relevant to the server it's trying to connect to via TLS.

The main purpose of the client side TLS certificate is to verify the identity of the client on the server side, just as a server side TLS certificate signed by a trusted CA allows the client to verify the identity of the server. In the case of the client side TLS certificate, it doesn't have to be signed by an outside entity. There could be an internal CA the server uses to sign those CSRs and when the client connects, the server need only to verify that the client cert presented has a valid internal CA signature.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#336

Post by joshuaissac »

ImuMotive wrote: post #26
only_as_i_fall wrote: post #6

Earlier quoted context omitted.

How does an sms hijacking attack typically work? I know sms isn't secure, but how does one go from having a password to bypassing the sms confirmation? Is it as easy as having the number and carrier?

It happened to me. Cellular carriers, in my case T-Mobile, didn't require any confirmation to port a number to a new phone/sim. Eventually some required the last 4 of your social security number to port a number, which we all know at this point are pretty much public anyway. T-Mobile now lets you set an arbitrary pin, which my parents promptly set to their DOB :facepalm: I haven't looked more into it, but as far as I…

Maybe what is needed is regulation that makes the service provider liable (with no option to disclaim it) for all damages suffered by the victim if the provider gives away their phone number to an attacker.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#337

Post by Macha »

staticassertion wrote: post #319
Macha wrote: post #226

Earlier quoted context omitted.

And that's why "everyone should just use yubikeys" is never going to happen.

Everyone already pays the same operational burden with their house keys, which are far more difficult to manage for the average person (as they leave the house constantly). It's worked fine for hundreds of years.

If you lose your house keys, you get a lock smith to break into your house for you - your house doesn't become unusable forever more.

If you ever need to have this done, you'll realise how much house keys and door locks for many cases really only stop the opportunistic "pull the handle and see if it opens" attack. If your door has above average security they'll need to drill the lock, but the time I had to call one they could just push a tool through the letter box and break/move the bolt by applying leverage from the "indoor" side.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#338

Post by scrollaway »

xwolfi wrote: post #329
jokethrowaway wrote: post #38

Earlier quoted context omitted.

It could be worth it to spend the 1.50$ on stripe to do identity verification with id documents for accounts of a certain size, so that they can present those documents again to regain access to their account. Re-enabling the account after a certain period of time without activity would also be a good measure (on top of the id verification).

And then lose the documents in a big hack so that everyone with a forum access can use your passport copy. yes.

The whole point of using Stripe for it would be not to have the documents in question. Kind of like you don't hear about companies using stripe losing their customers' card numbers.

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#339

Post by syshum »

hnick wrote: post #235
zmmmmm wrote: post #165

Earlier quoted context omitted.

Ok, so the scenario is I buy a headset, create a fake account, load up on games, then abuse the account to get all of it refunded so as to effectively have free use of the games for the period of time. But I still had to buy a headset, put in a real credit card, pass Facebooks initial "real identity" checks etc. With real human review and some basic policies to prevent repeat abuse this doesn't seem like something th…

It doesn't have to be planned abuse. Another possibility is "I don't use this much anymore and there's no second hand market for my game purchases so I think I'll just get my library refunded." You were going to lose value anyway on not using it, now you get something back.

Then they need to stop claiming to "sell" you something when clearly they are renting it

Of course no one in their right mind would pay the retail prices for a "rental" so screws the business model, but honestly, they need to pick one, either they are selling products or renting them

This mixed model where they try to have the best of both has got to stop, if you ban my account you need to refund me, done want to refund on ban well do not sell me things, rent them to me under a service

Re: Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

#340

Post by shawnz »

rob-olmos wrote: post #123
1024core wrote: post #100

Earlier quoted context omitted.

What happens if the Yubikey goes bad? I use one for work, and the last 2 keys I had developed some hardware issues, and stopped responding, so I had to get a new one.

The recommendation is to have at least one backup key. There's also a WebAuthn extension in the works to at least make it easier to maintain a backup key by not having to pull it out of the safe every time you register MFA with a new service: https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...

I really wish I could find a password manager which supports WebAuthn, and can also be unlocked with WebAuthn, so that only one secret needs to be replaced in such a situation.
Post reply on HN