{"id":543189,"date":"2024-07-04T18:06:11","date_gmt":"2024-07-04T16:06:11","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=543189"},"modified":"2024-07-04T19:09:32","modified_gmt":"2024-07-04T17:09:32","slug":"south-africas-facebook-hackdemic","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/543189-south-africas-facebook-hackdemic.html","title":{"rendered":"South Africa\u2019s Facebook Hackdemic"},"content":{"rendered":"

During the past 24 months, many South Africans have found their Facebook, Instagram, and WhatsApp accounts taken over by cybercriminals.<\/p>\n

While these attacks have targeted some prominent individuals like radio personalities, many people who are not in the public eye have also been victims of account hijacks.<\/p>\n

The hijacking begins with a fairly sophisticated phishing attack that tricks people into giving out their usernames and passwords.<\/p>\n

First, the criminals sent a flood of messages to potential targets.<\/p>\n

These exploited a layout quirk in Facebook Messenger, allowing them to hide a link to an attack site resembling a real \u201cShow profile\u201d button.<\/p>\n

Clicking on the button opens a Facebook login page, complete with the correct \u201cm.facebook.com\u201d URL in the browser bar.<\/p>\n

However, this is faked using a fullscreen image or some other kind of trick to make the attack page look legitimate on a smartphone screen.<\/p>\n

Once the attackers have your username and password and they successfully take over your account, they weaponise Facebook\u2019s safety and security policies to keep rightful users locked out.<\/p>\n

The first thing they do is change the compromised account\u2019s password and any recovery options they can gain control over to make it harder for the legitimate user to regain control.<\/p>\n

In one instance where a personal Facebook account was the administrator of a business page, they added one of the attackers as an admin before posting heinous content from the personal account.<\/p>\n

This resulted in the personal account being banned, while the attackers now controlled the business page.<\/p>\n

The user\u2019s Instagram profile had also been hijacked, as their personal Facebook account was also their Instagram login.<\/p>\n

This is the brilliance of the attack \u2014 the cybercriminals turn Facebook\u2019s community safety policies and systems against legitimate users to ensure they can\u2019t get their accounts back without a lengthy investigation.<\/p>\n

With their Facebook account banned, users don\u2019t even have a way to log an issue with Meta Platforms to try and recover their social media profiles.<\/p>\n

For users to prove that they did not actually post the objectionable content in question is impossible \u2014 their only hope is for Facebook\u2019s customer support to conduct more than a superficial investigation.<\/p>\n

\"\"<\/a>

Screenshots of the Facebook messages baiting users to click on \u201cView Profile\u201d (left), which will navigate to an attack site (right)<\/p><\/div>\n

MyBroadband contacted Facebook when an internationally renowned artist reached out to us at his wit\u2019s end.<\/p>\n

It should be noted that this person is more than tech-savvy. However, the phishing attack caught him while distracted at precisely the wrong time.<\/p>\n

He had received an influx of suspicious new followers on his business page, along with a flood of one-word greeting messages.<\/p>\n

To try and figure out what was happening, the target responded to one of the messages and clicked on the \u201cView Profile\u201d button.<\/p>\n

Had he not been distracted, he would\u2019ve noticed the red flag at this point \u2014 he was asked to log in to see the profile.<\/p>\n

At the time, he chalked it up to browsing from his personal account when the messages had been sent to his business account.<\/p>\n

Of course, in hindsight, he would not have been asked to log in again to view someone\u2019s profile.<\/p>\n

By the time he realised his mistake, it was too late. The attackers had hijacked his profile completely and locked him out.<\/p>\n

Facebook took more than two weeks to restore the banned account and return control of it to the victim.<\/p>\n

Three days later, Facebook had relinked his account to his business page.<\/p>\n

\"\"<\/a>

One of Nguyen Vu\u2019s conquests that they were brazen enough to brag about on Facebook<\/p><\/div>\n

Gallingly, the attacker who had hijacked his account was bragging about their exploits online. On Facebook, no less.<\/p>\n

A Vietnamese hacker, \u201cNguyen Vu\u201d, posted screenshots and videos on Facebook of all the accounts they had compromised, several of which were South African.<\/p>\n

The goal behind the hacks seemed to be to sell Facebook advertising to unscrupulous operators.<\/p>\n

By compromising legitimate users\u2019 accounts, attackers gain access to a reputable profile and often some Facebook advertising credit, too.<\/p>\n

Vu\u2019s Facebook profile was eventually banned \u2014 but only sometime after the victim\u2019s accounts were reinstated.<\/p>\n

However, even though our artist\u2019s accounts had been restored, he remained banned from doing any Facebook marketing.<\/p>\n

He found himself stuck in a bureaucratic quagmire.<\/p>\n

Attempting to unblock advertising functionality would get his main Facebook profile suspended for suspicious activity.<\/p>\n

After getting his account reinstated once more, contacting Facebook support only yielded the same troubleshooting steps that previously got his account suspended.<\/p>\n

The victim was still stuck in a Kafkaesque loop eight months later, unable to give Facebook their money and locked out from a substantial portion of their following.<\/p>\n

While some core Facebook marketing functionality was eventually restored, many features were still broken or unavailable for his page 22 months later.<\/p>\n","protected":false},"excerpt":{"rendered":"

Many South Africans have found themselves locked out of their WhatsApp, Facebook, and Instagram accounts for weeks or even months.<\/p>\n","protected":false},"author":15,"featured_media":543193,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[161,35],"class_list":["post-543189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-facebook","tag-headline"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/543189"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=543189"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/543189\/revisions"}],"predecessor-version":[{"id":543203,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/543189\/revisions\/543203"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/543193"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=543189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=543189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=543189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}