6 ms·

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious

by jsnell 5y ago

Here's my guess at what happened: How was the account hijacked? Via cookie theft. The author installed malware, maybe some dodgy windows binaries or malicious browser extensions. No amount or type of 2FA on sign-in will protect you against the session cookie being stolen. (Now, additional 2FA on sensitive actions might). Why was the account was banned with such finality, with no chance of appeal? Probably for something outright illegal, like the hijacker uploading CSAM to the account. It's totally plausible that in an obvious enough case, the policy is e.g. to refer the case to law enforcement and keep the account disabled. Why did the attacker want to get the account permanently disabled? Maybe an account disable doesn't stop ad campaigns on FB. So the attacker sets up an ad campaign, and then gets the account banned so that the owner can't reverse it.

drummer 5y ago
That is correct; ads keep running while account is blocked.
- codewithcheese 5y ago
  clearly shows where their priorities lie. they will shut down your social (media) life without recourse, but heaven forbid that has a negative impact on the ad spends
- firecall 5y ago
  Yep! Happened to me! Account restricted from modifying ads. But yet the account kept going, spending money, and I couldn't stop them! Thankfully I had a second admin on the account and was able to get back in. Now I make multiple accounts to run Ads. If you search, it's a common problem! Whats infuriating is that FB want you to use your own FB account to run business accounts, and it's against T&Cs to make fake accounts. But yet you can be attached to a clients account and get Ad banned for something they do! Gah! The attitude of FB and Google is infuriating!
jokethrowaway 5y ago
The attacker should have replicated the browser fingerprint and IP on top of stealing the cookie - or just flat out used his computer remotely while he was sleeping. I haven't used FB in a while but I remember login from other places were detected.
- jsnell 5y ago
  If the session cookie was stolen, there's no new login to detect and send a security notification about.
  - EMM_386 5y ago
    Can't they detect that the session cookie is coming from a different IP than the one it was originally issued to?
    - tobyjsullivan 5y ago
      Technically that's possible but there would be too many false-positives. People would be signed out every time they took their laptop home from a coffeeshop or connected over a mobile hotspot.
      - wolpoli 5y ago
        Yes. Facebook has implemented features to try to keep their users signed in, even if the user indicates that they want to sign out. Therefore, Facebook wouldn't want to sign people out if they go to a coffee shop.
      - laumars 5y ago
        They could use your local MAC or maybe detect the local radius of your IP (eg if you suddenly appear from a different continent then send a confirmation email). Sure, people using Tor might get burnt but those use cases are likely less common than those who are getting their session cookies hacked.
    - deleted 5y ago
ricardo81 5y ago
>cookie theft I think that's quite likely. I have a (somewhat throwaway) FB account, not much of a profile and mainly used for a local cause. Co-admining a page I'd clicked on a clickbaity headline posted to the page and several days later my account was disabled. The account recovery process was completely broken/circular but somehow the account revived itself after a week. The fact that my 'friend suggestions' were untainted by a friends list seemed to confirm the hack as all my suggestions were from people in an entirely new continent. Nd ads/CC attached to the account.
- Thorrez 5y ago
  There's no way clicking on a headline would lead to your account being hijacked... Unless there's a browser 0-day which are extremely valuable and no one would waste that on your FB account. Or if clicking the link downloaded malware and you ran the malware. Did you ever use the password of the FB account anywhere else? You getting phished is also much more likely than a browser 0-day. Did you have a security key on the FB account?
  - ricardo81 5y ago
    It was a secure account as far as the password goes, no 2FA. Like I said it was a bit of a throwaway account. Password 15 chars long, random chars. No phishing. I concluded that there's perhaps a cross-origin issue on Facebook's side that allowed cookie hijacking. The clickbaity link was almost tailor made for our group "[something ominous happened] in [your part of town]". Looks like it was auto-shared by someone whose account had been compromised as they were local. Reasonably confident it was a session hijack, my password remained the same while account locked. The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was.
    - Thorrez 5y ago
      >The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was. That sounds much more likely to me. When facebook has a website vulnerability that is exploited, they log everyone out, post a blog post, and makes big news: https://www.wired.co.uk/article/facebook-hack-beach-single-sign-on-social-login https://www.wired.co.uk/article/facebook-hack-beach-single-s... https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/ https://krebsonsecurity.com/2018/09/facebook-security-bug-af... https://about.fb.com/news/2018/09/security-update/ https://about.fb.com/news/2018/09/security-update/ >"[something ominous happened] in [your part of town]" Those ads are all over. They determine [your part of town] through geoip or FB tells the advertiser your city. It's like the "singles in [your city]" ads.
dillondoyle 5y ago
Unless it used the same IP / UA it seems unlikely? Every time I switch IPs I have to re auth to FB ads. Even on the exact same browser session.
NiekvdMaas 5y ago
This 100%. I had the same thing happen to me (even though I have 2FA everywhere): https://github.com/Niek/Niek/blob/master/facebook-scam/README.md https://github.com/Niek/Niek/blob/master/facebook-scam/READM...
StreamBright 5y ago
I thought session cookies are tied to a specific browser/is/ip/etc. combo

by jsnell 5y ago

drummer 5y ago

That is correct; ads keep running while account is blocked.

codewithcheese 5y ago
clearly shows where their priorities lie. they will shut down your social (media) life without recourse, but heaven forbid that has a negative impact on the ad spends
firecall 5y ago
Yep! Happened to me! Account restricted from modifying ads. But yet the account kept going, spending money, and I couldn't stop them! Thankfully I had a second admin on the account and was able to get back in. Now I make multiple accounts to run Ads. If you search, it's a common problem! Whats infuriating is that FB want you to use your own FB account to run business accounts, and it's against T&Cs to make fake accounts. But yet you can be attached to a clients account and get Ad banned for something they do! Gah! The attitude of FB and Google is infuriating!

jokethrowaway 5y ago

The attacker should have replicated the browser fingerprint and IP on top of stealing the cookie - or just flat out used his computer remotely while he was sleeping. I haven't used FB in a while but I remember login from other places were detected.

jsnell 5y ago
If the session cookie was stolen, there's no new login to detect and send a security notification about.
- EMM_386 5y ago
  Can't they detect that the session cookie is coming from a different IP than the one it was originally issued to?
  - tobyjsullivan 5y ago
    Technically that's possible but there would be too many false-positives. People would be signed out every time they took their laptop home from a coffeeshop or connected over a mobile hotspot.
    - wolpoli 5y ago
      Yes. Facebook has implemented features to try to keep their users signed in, even if the user indicates that they want to sign out. Therefore, Facebook wouldn't want to sign people out if they go to a coffee shop.
    - laumars 5y ago
      They could use your local MAC or maybe detect the local radius of your IP (eg if you suddenly appear from a different continent then send a confirmation email). Sure, people using Tor might get burnt but those use cases are likely less common than those who are getting their session cookies hacked.
  - deleted 5y ago

ricardo81 5y ago

>cookie theft I think that's quite likely. I have a (somewhat throwaway) FB account, not much of a profile and mainly used for a local cause. Co-admining a page I'd clicked on a clickbaity headline posted to the page and several days later my account was disabled. The account recovery process was completely broken/circular but somehow the account revived itself after a week. The fact that my 'friend suggestions' were untainted by a friends list seemed to confirm the hack as all my suggestions were from people in an entirely new continent. Nd ads/CC attached to the account.

Thorrez 5y ago
There's no way clicking on a headline would lead to your account being hijacked... Unless there's a browser 0-day which are extremely valuable and no one would waste that on your FB account. Or if clicking the link downloaded malware and you ran the malware. Did you ever use the password of the FB account anywhere else? You getting phished is also much more likely than a browser 0-day. Did you have a security key on the FB account?
- ricardo81 5y ago
  It was a secure account as far as the password goes, no 2FA. Like I said it was a bit of a throwaway account. Password 15 chars long, random chars. No phishing. I concluded that there's perhaps a cross-origin issue on Facebook's side that allowed cookie hijacking. The clickbaity link was almost tailor made for our group "[something ominous happened] in [your part of town]". Looks like it was auto-shared by someone whose account had been compromised as they were local. Reasonably confident it was a session hijack, my password remained the same while account locked. The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was.
  - Thorrez 5y ago
    >The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was. That sounds much more likely to me. When facebook has a website vulnerability that is exploited, they log everyone out, post a blog post, and makes big news: https://www.wired.co.uk/article/facebook-hack-beach-single-sign-on-social-login https://www.wired.co.uk/article/facebook-hack-beach-single-s... https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/ https://krebsonsecurity.com/2018/09/facebook-security-bug-af... https://about.fb.com/news/2018/09/security-update/ https://about.fb.com/news/2018/09/security-update/ >"[something ominous happened] in [your part of town]" Those ads are all over. They determine [your part of town] through geoip or FB tells the advertiser your city. It's like the "singles in [your city]" ads.

dillondoyle 5y ago

Unless it used the same IP / UA it seems unlikely? Every time I switch IPs I have to re auth to FB ads. Even on the exact same browser session.

NiekvdMaas 5y ago

This 100%. I had the same thing happen to me (even though I have 2FA everywhere): https://github.com/Niek/Niek/blob/master/facebook-scam/README.md https://github.com/Niek/Niek/blob/master/facebook-scam/READM...

StreamBright 5y ago

I thought session cookies are tied to a specific browser/is/ip/etc. combo