5 ms·

>cookie theft I think that's quite likely. I have a (somewhat throwaway) FB account, not much of a profile and mainly used for a local cause. Co-admining a pag

>cookie theft I think that's quite likely. I have a (somewhat throwaway) FB account, not much of a profile and mainly used for a local cause. Co-admining a page I'd clicked on a clickbaity headline posted to the page and several days later my account was disabled. The account recovery process was completely broken/circular but somehow the account revived itself after a week. The fact that my 'friend suggestions' were untainted by a friends list seemed to confirm the hack as all my suggestions were from people in an entirely new continent. Nd ads/CC attached to the account.

Thorrez 5y ago
There's no way clicking on a headline would lead to your account being hijacked... Unless there's a browser 0-day which are extremely valuable and no one would waste that on your FB account. Or if clicking the link downloaded malware and you ran the malware. Did you ever use the password of the FB account anywhere else? You getting phished is also much more likely than a browser 0-day. Did you have a security key on the FB account?
- ricardo81 5y ago
  It was a secure account as far as the password goes, no 2FA. Like I said it was a bit of a throwaway account. Password 15 chars long, random chars. No phishing. I concluded that there's perhaps a cross-origin issue on Facebook's side that allowed cookie hijacking. The clickbaity link was almost tailor made for our group "[something ominous happened] in [your part of town]". Looks like it was auto-shared by someone whose account had been compromised as they were local. Reasonably confident it was a session hijack, my password remained the same while account locked. The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was.
  - Thorrez 5y ago
    >The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was. That sounds much more likely to me. When facebook has a website vulnerability that is exploited, they log everyone out, post a blog post, and makes big news: https://www.wired.co.uk/article/facebook-hack-beach-single-sign-on-social-login https://www.wired.co.uk/article/facebook-hack-beach-single-s... https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/ https://krebsonsecurity.com/2018/09/facebook-security-bug-af... https://about.fb.com/news/2018/09/security-update/ https://about.fb.com/news/2018/09/security-update/ >"[something ominous happened] in [your part of town]" Those ads are all over. They determine [your part of town] through geoip or FB tells the advertiser your city. It's like the "singles in [your city]" ads.
    - ricardo81 5y ago
      The thing is it wasn't an ad, it was a post a regular user posted into a group. And that being the plausible answer doens't explain why me as a Northern European post-ban-resurrection ended up getting all my friends suggestions from Africans. It was never the case before that and all my activity simply involved campaigning against losing a local park and looking at local news.
      - Thorrez 5y ago
        Was the user a spam bot? Maybe the bot saw a city mentioned in the group and generated a spam comment using that city. It's possible some people (or bots) from Africa viewed your page and no one else did in the recent past, and thus Facebook thought there was some connection between you and Africa.
- 0xy 5y ago
  This isn't correct, it's not the only way. A Facebook vulnerability is less valuable than a browser 0-day and could similarly leak credentials. In fact, Facebook has had numerous authentication blunders in the past. [1] One of them was a zero-click mechanism very recently. [2] Facebook's security team is a joke, or worse -- they're muzzled by product teams and forced to do their bidding. [3] [1] https://threatpost.com/facebook-patches-oauth-authentication-vulnerability-022613/77563/ https://threatpost.com/facebook-patches-oauth-authentication... [2] https://about.fb.com/news/2018/09/security-update/ https://about.fb.com/news/2018/09/security-update/ [3] https://appleinsider.com/articles/21/04/22/facebook-dangerous-vulnerability-exposes-millions-of-email-addresses https://appleinsider.com/articles/21/04/22/facebook-dangerou...
  - Thorrez 5y ago
    You're right. But when there's an exploited vulnerability Facebook logs everyone out and then posts a blog post about it, as show by the 2018 hack you linked to. That hasn't happened here. I don't really consider 3 years ago to be very recent. I think that 3rd link is arguably not a vulnerability. If you intentionally want people to be able to look up future friends by email address, then that's basically the desired behavior. Now arguably allowing people to look up future friends by email is a privacy problem. Some users probably want that feature though. Yes a lack of rate limiting is a problem, but rate limiting won't stop attackers from doing it, it just slows them down.
    - 0xy 5y ago
      Leaking PII in the name of "features" is a security disaster. Ask yourself why Facebook doesn't just make available a spreadsheet of all names associated with which emails on the platform. It's because it's private information. Why doesn't Facebook's security team do anything? Either they're incompetent, or they're being muzzled by product. Additionally, Facebook's privacy policy explicitly says that they don't share your private information that you have chosen to set private. That's an egregious lie.
      - Thorrez 5y ago

Thorrez 5y ago

There's no way clicking on a headline would lead to your account being hijacked... Unless there's a browser 0-day which are extremely valuable and no one would waste that on your FB account. Or if clicking the link downloaded malware and you ran the malware. Did you ever use the password of the FB account anywhere else? You getting phished is also much more likely than a browser 0-day. Did you have a security key on the FB account?

ricardo81 5y ago
It was a secure account as far as the password goes, no 2FA. Like I said it was a bit of a throwaway account. Password 15 chars long, random chars. No phishing. I concluded that there's perhaps a cross-origin issue on Facebook's side that allowed cookie hijacking. The clickbaity link was almost tailor made for our group "[something ominous happened] in [your part of town]". Looks like it was auto-shared by someone whose account had been compromised as they were local. Reasonably confident it was a session hijack, my password remained the same while account locked. The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was.
- Thorrez 5y ago
  >The only other plausible thing wrt my account's case was that it was almost empty (i.e. no photo, no friends, not much to go by) and was somehow flagged but was given a misleading reason why it was. That sounds much more likely to me. When facebook has a website vulnerability that is exploited, they log everyone out, post a blog post, and makes big news: https://www.wired.co.uk/article/facebook-hack-beach-single-sign-on-social-login https://www.wired.co.uk/article/facebook-hack-beach-single-s... https://krebsonsecurity.com/2018/09/facebook-security-bug-affects-90m-users/ https://krebsonsecurity.com/2018/09/facebook-security-bug-af... https://about.fb.com/news/2018/09/security-update/ https://about.fb.com/news/2018/09/security-update/ >"[something ominous happened] in [your part of town]" Those ads are all over. They determine [your part of town] through geoip or FB tells the advertiser your city. It's like the "singles in [your city]" ads.
  - ricardo81 5y ago
    The thing is it wasn't an ad, it was a post a regular user posted into a group. And that being the plausible answer doens't explain why me as a Northern European post-ban-resurrection ended up getting all my friends suggestions from Africans. It was never the case before that and all my activity simply involved campaigning against losing a local park and looking at local news.
    - Thorrez 5y ago
      Was the user a spam bot? Maybe the bot saw a city mentioned in the group and generated a spam comment using that city. It's possible some people (or bots) from Africa viewed your page and no one else did in the recent past, and thus Facebook thought there was some connection between you and Africa.
0xy 5y ago
This isn't correct, it's not the only way. A Facebook vulnerability is less valuable than a browser 0-day and could similarly leak credentials. In fact, Facebook has had numerous authentication blunders in the past. [1] One of them was a zero-click mechanism very recently. [2] Facebook's security team is a joke, or worse -- they're muzzled by product teams and forced to do their bidding. [3] [1] https://threatpost.com/facebook-patches-oauth-authentication-vulnerability-022613/77563/ https://threatpost.com/facebook-patches-oauth-authentication... [2] https://about.fb.com/news/2018/09/security-update/ https://about.fb.com/news/2018/09/security-update/ [3] https://appleinsider.com/articles/21/04/22/facebook-dangerous-vulnerability-exposes-millions-of-email-addresses https://appleinsider.com/articles/21/04/22/facebook-dangerou...
- Thorrez 5y ago
  You're right. But when there's an exploited vulnerability Facebook logs everyone out and then posts a blog post about it, as show by the 2018 hack you linked to. That hasn't happened here. I don't really consider 3 years ago to be very recent. I think that 3rd link is arguably not a vulnerability. If you intentionally want people to be able to look up future friends by email address, then that's basically the desired behavior. Now arguably allowing people to look up future friends by email is a privacy problem. Some users probably want that feature though. Yes a lack of rate limiting is a problem, but rate limiting won't stop attackers from doing it, it just slows them down.
  - 0xy 5y ago
    Leaking PII in the name of "features" is a security disaster. Ask yourself why Facebook doesn't just make available a spreadsheet of all names associated with which emails on the platform. It's because it's private information. Why doesn't Facebook's security team do anything? Either they're incompetent, or they're being muzzled by product. Additionally, Facebook's privacy policy explicitly says that they don't share your private information that you have chosen to set private. That's an egregious lie.
    - Thorrez 5y ago