Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
3

One of my mate, she has a lot of friends on Facebook, uses it for marketing.

Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many times.

So basically, what happens is this one user/virus/trojan whatever somehow manages to request a password reset. And then they add their own email address to the account.

As far as I can tell, that user has not posted anything on Facebook nor have they messaged anyone. So their purpose is unknown.

What we've done to recover from this hasn't help:

  • Changed email address to something completely new and unguessable. Removed all the current email addresses. So they can't use those email addresses to run through recovery again.
  • Removed the phone number.
  • Changed security questions.
  • Enabled HTTPS only.
  • Changed password to something generated using a random password generator.
  • Reset password on the email address she uses (its a gmail account).
  • Completely wiped her laptop which had Windows Vista and installed Windows 7.
  • Asked her not to use any of the PC's at work to log into Facebook.
  • Removed any facebook apps that I don't recognise, or is not needed.

I'm completely stumped at how this keeps happening.

I don't think its a "person", probably a virus of some kind. Which is why I wiped the computer she uses. But, now I'm not so sure.

Any ideas?

EDIT: Removed all fb apps part added to list

share|improve this question
5  
Does she have any facebook apps - they can potentially send any of her information to an attacker. – Rory Alsop♦ Aug 4 '11 at 10:58
Is she using Wi-Fi? I would think HTTPS would help with that though. – CodeNaked Aug 4 '11 at 11:51
1  
according to the last 3 points, it doesn't seems to be specifically facebook-related. Her computer seems to be compromised. from this assumption, any keylogger/trojan(or even maybe a person who can access her computer) should be able to cause all above points. – BiAiB Aug 4 '11 at 12:42
2  
@BiAiB - not necessarily. A facebook app could cause problems as described. – Rory Alsop♦ Aug 4 '11 at 12:56
2  
And here I thought it was Facebook that was the trojan... :) – John C Aug 4 '11 at 13:44
show 4 more comments

6 Answers

up vote 5 down vote

It's very likely that the person who owns the account uses a Facebook App that has malicious code in it, as all these issues here can be cause by said malicious facebook app. (note: this was stated in comments several times, so i posted this as an answer).

To fix this, the user should remove all access for apps to his/her facebook account. Then subsequently either not use apps, or very selectively use apps. Then, the user should run malware checks on their system (malwarebytes would be one such system). Then, the user, after ensuring his/her system is clean, should change the email address and the passcode on their facebook account. But that should only be done once they've removed apps access to their account and made certain their system has no malware on it (is "clean").

share|improve this answer
This seems like the most popular answer. I'm going to remove everything. And then reinstall the needed apps (like fb for mobile). – Mooktakim Ahmed Aug 4 '11 at 14:14
There is only 2 apps installed. One is a fb app used by us to login to our website. And another is blackberry phone app. – Mooktakim Ahmed Aug 4 '11 at 14:26
on this clean system, did you check and make sure the passcodes were changed to something that hasnt been used yet? and perhaps changed emails as well? – The Lord of Time Aug 4 '11 at 14:27
I have changed the password and email. Both did not work. – Mooktakim Ahmed Aug 4 '11 at 14:33
up vote 5 down vote

My guess also would be the facebook apps. Perhaps clicked on the wrong app ?

Check the app settings on the facebook profile and delete any unneeded applications. Then after doing that, try to change the password / mail address again.

share|improve this answer
2  
A malicious FB app would be my first guess too, as changing authentication details won't affect app permissions. – Piskvor Aug 4 '11 at 13:17
indeed, therefore I suggested removing unneeded app permissions and afterwards changing password – Goez Aug 4 '11 at 13:25
even then... you need to make sure those apps didnt put malicious code on the computer... if there's malicious code on the computer, you still run the risk. Hence why in my answer, I recommended removing apps access and scanning their system with a malware scanner, to make sure their system isnt horridly infected (likelihood is low, but i have seen it happen before). – The Lord of Time Aug 4 '11 at 13:35
well, the computer was wiped. Ofcourse the risk is still there that the malware is re-installed but still... – Goez Aug 4 '11 at 13:42
Considering that Facebook is the likely source, and that all apps do have a client-end interface, that could theoretically have reloaded the malware onto the system. Hence why the scan should be one anyways. – The Lord of Time Aug 4 '11 at 13:43
show 3 more comments
up vote 3 down vote

Perhaps it is the links that she uses. There are facebookviruses that are able to extract information simply via the facebook api. Perhaps she keeps visiting such a website that does it without knowing it. Perhaps you can try to set up a new facebook account for her that she logs into and keeps open for a few days. See how this works on the new account.

share|improve this answer
Even then, how does it work? In facebook you need to type in your existing password whenever you want to add new email and change your existing password. – Mooktakim Ahmed Aug 5 '11 at 11:50
if you are logged in all the time, basically there is stuff possible. pcworld.com/article/155017/… – tarrasch Aug 5 '11 at 11:54
up vote 2 down vote

If she accepts anyone as a friend then she is open to getting her password reset and losing control of the account.

Heres how it works.

  1. Send the person 3 friend requests from 3 different accounts. They should be set to have completely different ways of knowing the person. Perhaps 1 you put to go to the same high school, 1 from college and then the other has no school relation.

  2. Then say you forgot your password

  3. search for the persons account
  4. Say you no longer have control of your emails or phone.
  5. Type in the wrong answer to the security question 3 times (if they have 1)
  6. Now it will ask you to send a code to 3 of your friends and call them to get the code. It will try and make it so the friends are from different groups (which is why our fake accounts are from different schools/jobs/etc).
  7. Without any action of the true owner of the account in 24 hours, you are free to do anything to the account. Do note that facebook will try and send a notice to the email accounts and phones of the user. But if you wait till the person is going to be away from their email/phone for 24 hours (camping, vacation) then its easily done. Even easier without the phone attached to an account.

Edit: This worked for me 2 weeks ago, but facebook updates a lot.

share|improve this answer
1  
Hhmm, this seems very plausible. But my friend would have received weird emails from facebook about new email addresses being added. – Mooktakim Ahmed Aug 9 '11 at 12:35
1  
Yes they would have received an email saying that they tried to reset the password. – corymathews Aug 9 '11 at 13:10
up vote 1 down vote

Has she said up a URL attached to her profile such as: facebook.com/IAmAwesome if so the above could be occuring because she has someone who really "likes" her and just keeps abusing the way in which you can reset people's passwords on facebook by forcing in your email address to their system. Have her create a new profile completely and have her be very selective over whom she invites into her new group of friends.

share|improve this answer
up vote 1 down vote
  • delete all applications that really aren't necessary
  • restart password on email and/or on FB account
  • don't login nor save/enter passwords for PC that could be infected
    • see what happens after few days.
      • if there are no hackers, you know which PC did it
      • if there are more hackers, try to restart your password and generate new one from your head!

I don't think it has something to do with applications (excluding e-mail access and such information)

share|improve this answer
I have done this. And it still got hacked in recently. – Mooktakim Ahmed Aug 8 '11 at 9:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.