Hot answers tagged

162

I interpret your question as: What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips? It's not that strange if you think about it this way: As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the ...


158

As you said, you saw this on facebook - so I tried these steps: Login with lukas@gmail.com and real password -> works Login with lukas@gmail.cmo and real password -> works, too (!) Login with luksa@gmail.com and real password -> also works Login with luksa@mail.com and real password -> also works Login with lukas@gmail.cmo and wrong password -> Wrong ...


95

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


63

To me it seems as if someone is doing fraud from your account. They load your FB with money (from a stolen credit card). Lose at poker so the money goes to another FB account. Withdraw that with an anonymous prepaid credit card. There are lots of different ways of doing carding (fraud). I'd contact FB and maybe the police as you might get a loud knock on ...


35

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication. For example: Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server ...


35

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself. My guess is that facebook.com is filtered by your "...


33

OP has clarified that this is Zynga Poker, in which no real money changes hands. That being the case, the most likely reasons for a fraudster to put money into your mother's account is that this scamp has acquired/purchased a block of PayPal account details and is systematically testing them to see if they work by hacking into Facebook accounts and using ...


31

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


16

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


12

Allowing username or email iteration may be a security problem for most sites, but not for Facebook. For sites as large as Facebook, finding emails that have accounts is easy because the sites have so many users. This holds for other huge user databases like Google and Microsoft. These companies just have to be secure in the face of their username/email ...


11

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


9

The message means that Facebook has received some unusual requests from your computer, like for example a large number of attempts to guess passwords for different accounts or attempts to post spam. So Facebook assumes that you have some kind of malware on your computer and recommends you to install a malware scanner to get rid of it. For more information ...


8

It's also entirely possible that the entire thing is a confidence scam. In this type of scam, someone gives you some money to let people engage in high-risk behavior (e.g. gambling), and the victim plays increasingly high-risk bets until, at some point, the other players at the victim's table (in reality, an assistant or bot ('shills'?) of the con artist) ...


7

From the first paragraph of the link you've provided: As a result, apps that don't support SHA-2 certificate signatures will no longer be able to connect to Facebook starting on October 1, 2015. I would read this differently to your interpretation. This is not a requirement to the apps to have certificates signed with SHA-2 but it is a requirement to ...


6

This is a useless question but still interesting one :) and that is not audio jack He is a security freak like me, not real freak but there are some people who really care for their device security and of course a CEO will have some serious data inside his laptop, I am sure you understand that covering mic and cam is so that even an un-authorised access ...


5

We don't know what security measures Facebook exactly provides but spoofing the source IP of a TCP connection (which is used when accessing a web site) and still doing something useful with the connection is impossible in practice. This means that it is more likely that the site was really accessed from the shown IP address (no spoofing), that the database ...


5

It is almost certain that whatever you do, your data will not be irrevocably destroyed. Even if the organisation you trusted with your personal data had the best of intentions it would be an enormous effort to really physically delete all of your data from all the places it will have been duplicated to, including backups and SSD spare sectors. No ...


5

Go through the apps you gave some permission on facebook. Especially the "post on my behalf" permission. Remove any you don't trust (or don't remember giving them permissions). Anyway, it might be a one time thing, and there is nothing to get rid of. Read through this blog post for more information. In the extreme case, you might be indeed infected by ...


4

As far as I'm aware, Facebook don't actually block the new attempts from different IPs. Instead, they send an email to the registered email address with a notification that you logged into a new device, with a button to mark this as legitimate or malicious. The tracking appears to work not only via your IP, but also a long-term identification cookie and ...


4

If as you mention the "hacker" chatted with you via the Facebook website, then all you will get is the IP of a Facebook server somewhere in the cloud, which won't help you much. Only Facebook could get you the sender IP, and I don't believe they would disclose such information. Moreover, the attacker probably used at least one proxy, which would make ...


4

There are several possibilities here: A tab in Firefox has a website that keeps connecting and refreshing an internal IP address. That might be a home NAS appliance that by coincidence has the same IP with your computer A Javascript script from a legitimate website attempts to scan the internal network using Cross Origin Requests or WebSockets. This ...


4

Normally, facebook will not email you directly even in the event of a hack. What has most likely occurred, is someone obtained your facebook account primary email, which is easy for a determined attacker, then created a fake email (they could use hyperlink forging websites to make a link such as "security.facebook@facebook.com" or something similar) then ...


3

does it mean all previews are sent from FB server? Or the link is embedded from the source? When you share a page on social media, the platform (in this case Facebook) pulls in certain information from the embedded webpage, including the title, author information, page summary, and often an image. More information can be specified in the html header in ...


3

It's entirely possible that this has no bearing on your own devices or settings. Let's talk about the way one could go about designing that feature: Consider all connections one or two steps away. From those who have enabled syncing their contacts, consider those with a fuzzily matched name. Factored with some other heuristic scoring, you start seeing ...


3

Attackers are not interested in her, but rather those associated with her. It could be YOU that is the target, and she is solely being used to get to you. This is how impersonation works on the social engineering level. When I perform social engineering during penetration testing, I impersonate someone with the most solid connections to my target. For ...


2

It looks like the IPv6 address of the machine that connected. It is made up of eight groups of four hexadecimal digits. You can search for the owner of the network and inform the ISP of that network. There are many but http://ip-lookup.net will search for info about IPv6 addresses. Update: I ran a lookup on my own address and got better results with https:/...


2

The only reason I can think of for which this procedure can make sense is to prevent someone who has physical access to your computer/smartphone from logging in the site. Given that the Facebook session is usually opened for most users, anyone with access to the computer/smartphone of these users could get access to the site, impersonating them. If you ...


2

Without an official statement from Facebook how these posts were made, we can only speculate. Many organizations which use Facebook professionally for social media campaigns, like election campaign offices of politicians, do not use Facebook directly but use software tools to post content. Such tools can be configured to schedule a time and date when a ...


2

We do not know how Facebook implements security internally, so we can only guess. But common best-practices regarding admin authentication is to use the IP address as an additional authentication factor, but not the only one. For example, it would not be uncommon to only allow admins to connect from specific IP addresses which were authorized for this, but ...


2

If it is your personal WiFi (Verizon jetpack) and you are running WPA2 from your tablet to your Jetpack ... while it is possible for them to run a WiFi sniffer and/or a MitM proxy ... it is very unlikely. Like coffeethulhu said SSL/TLS can be can be intercepted and decrypted IF your company controls the network access you are using for your chat (its ...



Only top voted, non community-wiki answers of a minimum length are eligible