Facebook Account hack rant and questions

N

NoServersInTheCloud

Well-Known Member
Joined
Sep 28, 2022
Messages
129
Reaction score
55
Hey everyone,
So around 4pm yesterday my facebook account was hacked, now I work in IT and I usually giggle when people make mistakes such as submitting Facebook login forms on fake websites, etc. but this isnt what happened here so Im genuinely quite concerned and also wondering how I can go about getting this info from Meta on what happened? Because I highly doubt they actually care.

The events happened like this (side note I checked my emails dating back months and there were no unusual login attempts and my email is secure).
  • At 3:59 I get an email notifying me of a secondary email being added to my account (note there were no previous login attempts and I have email 2 factor on my account)
  • 4:00 the account is added and they remove my cellphone number from the account
  • 4:01 I get a password change notification (Still havent received any OTPs)
  • 4:02 they add their own cell phone and remove my current email from the account
  • 4:04 I get blasted with 7 OTP emails, but its too little too late my account is completely gone
  • 4:12 I notice all this and immediately try all the "This wasnt me" links in the emails but to no avail, most want me to login and change my password which makes 0 sense?
  • 4:18ish I try the method where you regain access by giving your old password and old email, it says "Enter old or new password" and when I enter my old password it says "Youve entered an old password, try your new one" nice one meta...

I have since emails several Meta/Facebook support and emergency emails, none have replied, I have also submitted my ID as a last form of verification to get my account back, but it will take approx 48 hours they say.

Im genuinely confused how they managed to pull all this off without ever gaining access to my emails for the OTP pins that never even came through?

One other MAJOR issue is I was a main admin on 2x Facebook Business Manager accounts, and somehow they managed to remove all my colleagues, including the one who added me and the person who created the business on Facebook, this seems extremely stupid considering Facebook has no way to contact them, and their system seems to think ALL my account details changing doesnt warrant suspicion to temporarily lock my account? Facebook also has no immediate way for businesses to contact them so all our Facebook Ad accounts we are connected to started getting messed with, luckily the clients revoked our access at our request.

I have so many questions, but my mains ones are kind of how is this acceptable, surely this level of complacency on Facebooks side isnt lawful?

Side note: Im not at all tech illiterate, I work in IT and know what Im doing when it comes to keeping secure passwords, 2FA, looking at login locations, etc. I feel like the only way tey couldve gained access is either via an exploit in Facebooks system or when I was using a Cafe Wifi?
 
any chance you left your laptop or smartphone unattended, even for mere moments, while either of those were logged in to FB? ... pure guess, but that would be more likely than FB itself being compromised or an exploited wifi connection, perhaps the exploited wifi is next most likely

worth noting your credentials may have been compromised ages ago with the exploiter waiting before making use of it, a classic tactic for cloned credit cards for example

last point: OTP via sms or email is NOT true 2FA
 
I'm a Techno cripple.
Why would anyone hack my FB account.
What do they get out of it?
 
NarrowBandFtw said:
any chance you left your laptop or smartphone unattended, even for mere moments, while either of those were logged in to FB? ... pure guess, but that would be more likely than FB itself being compromised or an exploited wifi connection, perhaps the exploited wifi is next most likely

worth noting your credentials may have been compromised ages ago with the exploiter waiting before making use of it, a classic tactic for cloned credit cards for example

last point: OTP via sms or email is NOT true 2FA
Click to expand...
I dont leave my laptop unattended when Im out and the only other place Im logged in is my phone which also never leaves my side because I may be slightly addicted haha.

Im even a little curious about how it could be a exploited wifi connection, because I dont use WiFis that arent password secured and then the waiter or someone gives you the password, plus I never even use facebook so there would be no reason for my credentials to be sent over a request over the wifi, havent visited the facebook website/app in a few months.

Its possible my credentials were stolen a while ago, though Im still wondering how they got around the 2Factor approval since my email was and still is secured.
 
Sinbad said:
I trust you used a VPN at the cafe wifi?

If not, then learn from this experiece... Never trust a public network.
Click to expand...
I dont always if Im being honest, but the fact that it was Facebook confuses me since I havent used the website or app in months.
 
NoServersInTheCloud said:
Im even a little curious about how it could be a exploited wifi connection
Click to expand...
malware running on the cafe's routers, for example, wouldn't care about the wifi network itself being password protected, not to mention an attacker can get that password as easily as you can: just buy a coffee and ask for it

it wouldn't be getting your actual login details that way, that's encrypted (you are using httpS right?), it might intercept a session cookie or some such and pretend to be you who are already logged in

could also be malware (like a key logger) running on your own laptop?

or seeing as you mention you don't often use FB ... do you use the same password for any other accounts that may have been compromised and then reused on FB?
 
Smells like a session cookie hijack. 2FA/OTP won't do jack if they have your session cookie.

My bets are on dodgy cafe wifi.
1st lesson - always use a VPN when using public wifi. It might not even have been the real cafe wifi you were connecting to. It's easy enough for a bad actor to setup a mitmproxy and sit there and capture details.

Also check your laptop for any malware.
 
gregmcc said:
Smells like a session cookie hijack. 2FA/OTP won't do jack if they have your session cookie.

My bets are on dodgy cafe wifi.
1st lesson - always use a VPN when using public wifi. It might not even have been the real cafe wifi you were connecting to. It's easy enough for a bad actor to setup a mitmproxy and sit there and capture details.

Also check your laptop for any malware.
Click to expand...
I think it might be a session hijack as well, maybe when access some other service/website there was a Facebook embed or even when I accessed instagram there may be shared cookies there. Super unfortunate. It also makes sense because my existing session wouldnt be detected as a fresh login.
 
NoServersInTheCloud said:
Im even a little curious about how it could be a exploited wifi connection, because I dont use WiFis that arent password secured and then the waiter or someone gives you the password, plus I never even use facebook so there would be no reason for my credentials to be sent over a request over the wifi, havent visited the facebook website/app in a few months.
Click to expand...
Wifi password or not, using pubic wifi to log in to accounts is always a risk you take.
 
Do you have any ad accounts linked to your business manager? If so I would cancel any credit cards linked to them immediately.

Normally accounts get hacked to get into Business Manager and Ad accounts to they can run ads for their own products and websites.

I had this happen to me a while back with 2FA enabled not sure how it was bypassed.
 
Session hijacking would require you to get the session cookie off the machine - which even on public Wi-Fi would be almost possible since Facebook uses HSTS, so the MITM would fail as the browser wouldn't post back a session to an HTTP connection nor to a certificate that didn't match the initial one the session got created on so how was the cookie obtained?

However, a compromised host could allow them to get your session info/cookie and use it.

At 3:59 I get an email notifying me of a secondary email being added to my account (note there were no previous login attempts and I have email 2 factor on my account)
Click to expand...

This tells me you had a valid session somewhere. Prior to that time where had you logged-in? where? Also you mention you were an admin on some FB Business pages, are you sure you had not given any other account the ability to manage your profile?

Other things to look out for;
1. Had you recently been asked to sign in to facebook somewhere - an email link, a popup etc?
2. Have you checked your email address used for 2/M/FA that there are no new forwarding rules setup to forward mail and skip the inbox? Check your mailbox deleted items and/or read items etc for valid OTPs that are marked as read but you never read them as well.
3. Was your facebook password your email password? And/or did your facebook password share a password with any other sites?

I would then focus on the laptop. Make SURE nothing dodgy is running on it, get Defender and/or whatever AV you have to do a full scan while its disconnected from the Internet (and your Defender/AV is updated).
 
Did you click on anything during the day that may be dodgy because it is easy to steal cookies.

Literally as easy as document.cookie
 
neoprema said:
Session hijacking would require you to get the session cookie off the machine - which even on public Wi-Fi would be almost possible since Facebook uses HSTS, so the MITM would fail as the browser wouldn't post back a session to an HTTP connection nor to a certificate that didn't match the initial one the session got created on so how was the cookie obtained?

However, a compromised host could allow them to get your session info/cookie and use it.



This tells me you had a valid session somewhere. Prior to that time where had you logged-in? where? Also you mention you were an admin on some FB Business pages, are you sure you had not given any other account the ability to manage your profile?

Other things to look out for;
1. Had you recently been asked to sign in to facebook somewhere - an email link, a popup etc?
2. Have you checked your email address used for 2/M/FA that there are no new forwarding rules setup to forward mail and skip the inbox? Check your mailbox deleted items and/or read items etc for valid OTPs that are marked as read but you never read them as well.
3. Was your facebook password your email password? And/or did your facebook password share a password with any other sites?

I would then focus on the laptop. Make SURE nothing dodgy is running on it, get Defender and/or whatever AV you have to do a full scan while its disconnected from the Internet (and your Defender/AV is updated).
Click to expand...
Ive only ever signed into Facebook itself on my Mac and iphone, I also use my Mac for work so I dont really have any non work related apps running, pretty much just things like Slack, VS Code, Postman, Filezilla, Termius, Netflix, etc. So I doubt my device is compromised, maybe a compromised plugin on Chrome, though I dont have too many plugins installed and most are trusted developers. Its just incredibly weird that they managed to get around my email/sms 2Fac OTPs
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter