Timeline for Is there a list of phone numbers Facebook uses to send auth tokens?
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 10, 2014 at 12:01 | answer | added | Xander | timeline score: 1 | |
| Oct 25, 2013 at 13:01 | comment | added | o0'. | @JeffFerland both today and on 7th Oct I've received normal messages. Has this been actively fixed, or it "just works" and we don't know why? | |
| Jul 28, 2013 at 14:42 | history | tweeted | twitter.com/#!/StackSecurity/status/361496928317476865 | ||
| Jul 9, 2013 at 22:21 | comment | added | o0'. | @Ramhound as I said, I'm clueless about this. That's why I'm asking here. | |
| Jul 9, 2013 at 19:19 | comment | added | Ramhound | @Lohoris - Whats the point of forwarding the actual code, if its a man-in-the-middle attack, just send a fake one. At that point you already have control of the account. | |
| Jul 9, 2013 at 15:18 | comment | added | o0'. | @Ramhound in theory it might be a man-in-the-middle attack, though it doesn't really make sense because they wouldn't alter the message that way of course. | |
| Jul 9, 2013 at 15:13 | comment | added | Ramhound | One should point out if the code is correct, and Facebook accepts it, then its not really possible for it to not be from Facebook. | |
| Jul 8, 2013 at 23:18 | history | edited | o0'. | CC BY-SA 3.0 |
new weird messages
|
| Jul 8, 2013 at 23:08 | comment | added | o0'. | @JeffFerland great! I've received a couple of new odd SMS just today, I'll edit the post to add them | |
| Jul 8, 2013 at 19:07 | comment | added | Jeff Ferland♦ | Just checking in to let you know this is still winding its way through, but at least I've got the right person on it now. | |
| Jun 29, 2013 at 0:35 | comment | added | Jeff Ferland♦ | I'm working on finding an answer to this. Given it's the end of this week and a major American holiday is next week, it may take a while to discover. | |
| Jun 28, 2013 at 15:42 | comment | added | o0'. | @Moustache while it's somehow related, it's not that, since the connected phone numbers and the approved devices are the correct ones, apparently... | |
| Jun 28, 2013 at 15:28 | comment | added | Moustache | Facebook recently had an account hijacking vulnerability reported to them, exploiting their SMS service. Worth having a look if it is related with your issue. grahamcluley.com/2013/06/hack-facebook-sms | |
| Jun 28, 2013 at 9:20 | comment | added | TildalWave |
I can't find any official list of phone numbers FB is using for their 2FA, but that might be beyond the point, as spoofing Sender ID with arbitrary alphanumeric text isn't all that difficult. I can't prove it either way with the information you provide and access I have (which probably goes the same for anyone here except @JeffFerland), but you say it yourself everything else seems legit besides the strange formatting, so I doubt it's an attack. And it wouldn't be the first time FB has problems with 2FA either (check comments).
|
|
| Jun 28, 2013 at 8:32 | review | First posts | |||
| Jun 28, 2013 at 8:34 | |||||
| Jun 28, 2013 at 8:14 | history | asked | o0'. | CC BY-SA 3.0 |