I’m specifically referring to things like the ads for cheap sunglasses that I’ve been seeing for what seems like over a decade now and the more recent “look who died in an accident” video links that three of my elderly aunts have had on their accounts in the last year. Who is “hacking” these accounts and what are they gaining from it?
In: 380
I’m going to say something that is against the grain of what almost everyone else here is saying. For background, I’ve been in tech for 20+ years and take my online security very seriously.
Recently, my Facebook was indeed hacked. I use a different password for everything as well as two factor authentication. I got an email notification that an email address had been added to my account, and another one saying my password had changed. Despite having a link in those emails to tell them that it was not me that made the change, Facebook has an annoying UX problem where they won’t simply roll this back, they want to email a confirmation code, even though they will only send it to the new email.
After a couple of days of following obscure Facebook support links, I was able to regain control of my account. I locked it down, two factor authentication, maxed out a new password that was well beyond their minimum requirements, etc.
Two days later, the exact same thing happened.
It’s impossible that they knew my password or that they got past two factor authentication. What I learned, is that there is a known cookie exploit, and somehow they were utilizing an authenticated session via this exploit. I went in and removed every logged in instance, and then logged in again with only the application on my phone. So far, this has worked.
What I learned through this process is that they’re just trying to turn these accounts into accounts and batch processing at a time.
Latest Answers