17

One of my friends, she has a lot of friends on Facebook, and uses it for marketing.

Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many times.

So basically, what happens is this one user/virus/trojan whatever somehow manages to request a password reset. Then it adds its own email address to the account.

As far as I can tell, that user has not posted anything on Facebook nor have they messaged anyone. So their purpose is unknown.

What we've done to recover from this hasn't helped. We tried:

  • Changing the email address to something completely new and unguessable. We also removed all the current email addresses so they can't use those addresses to run through recovery again.
  • Removing the phone number.
  • Changing security questions.
  • Enabling HTTPS only.
  • Changing password to something generated using a random password generator.
  • Reseting the password on the email address she uses (it's a Gmail account).
  • Completely wiping her laptop which had Windows Vista and installing Windows 7.
  • Asking her not to use any of the PC's at work to log into Facebook.
  • Removing any Facebook apps that I don't recognize, or aren't needed.

I'm completely stumped at how this keeps happening.

I don't think its a "person"; it's probably a virus of some kind. Which is why I wiped the computer she uses. Now, though, I'm not so sure.

Any ideas?

EDIT: Removed all FB apps part added to list

Improve this question
11
  • 7
    Does she have any facebook apps - they can potentially send any of her information to an attacker.
    – Rory Alsop ♦
    Commented Aug 4, 2011 at 10:58
  • Is she using Wi-Fi? I would think HTTPS would help with that though.
    – CodeNaked
    Commented Aug 4, 2011 at 11:51
  • 1
    according to the last 3 points, it doesn't seems to be specifically facebook-related. Her computer seems to be compromised. from this assumption, any keylogger/trojan(or even maybe a person who can access her computer) should be able to cause all above points.
    – BiAiB
    Commented Aug 4, 2011 at 12:42
  • 2
    @BiAiB - not necessarily. A facebook app could cause problems as described.
    – Rory Alsop ♦
    Commented Aug 4, 2011 at 12:56
  • 7
    And here I thought it was Facebook that was the trojan... :)
    – John C
    Commented Aug 4, 2011 at 13:44

7 Answers 7

Reset to default
16

It's very likely that the person who owns the account uses a Facebook App that has malicious code in it, as all these issues here can be cause by said malicious Facebook app. (Note: this was stated in comments several times, so I posted this as an answer).

To fix this, the user should remove all access for apps to his/her Facebook account. Then subsequently either not use apps, or very selectively use apps. Then, the user should run malware checks on their system (MalwareBytes would be one such system). Then, the user, after ensuring his/her system is clean, should change the email address and the password on their Facebook account. But that should only be done once they've removed apps access to their account and made certain their system has no malware on it (is "clean").

Improve this answer
4
  • This seems like the most popular answer. I'm going to remove everything. And then reinstall the needed apps (like fb for mobile).
    – Mooktakim Ahmed
    Commented Aug 4, 2011 at 14:14
  • There is only 2 apps installed. One is a fb app used by us to login to our website. And another is blackberry phone app.
    – Mooktakim Ahmed
    Commented Aug 4, 2011 at 14:26
  • on this clean system, did you check and make sure the passcodes were changed to something that hasnt been used yet? and perhaps changed emails as well?
    – Thomas Ward
    Commented Aug 4, 2011 at 14:27
  • I have changed the password and email. Both did not work.
    – Mooktakim Ahmed
    Commented Aug 4, 2011 at 14:33
7

If she accepts anyone as a friend then she is open to getting her password reset and losing control of the account.

Heres how it works.

  1. Send the person 3 friend requests from 3 different accounts. They should be set to have completely different ways of knowing the person. Perhaps 1 you put to go to the same high school, 1 from college and then the other has no school relation.

  2. Then say you forgot your password

  3. search for the persons account
  4. Say you no longer have control of your emails or phone.
  5. Type in the wrong answer to the security question 3 times (if they have 1)
  6. Now it will ask you to send a code to 3 of your friends and call them to get the code. It will try and make it so the friends are from different groups (which is why our fake accounts are from different schools/jobs/etc).
  7. Without any action of the true owner of the account in 24 hours, you are free to do anything to the account. Do note that facebook will try and send a notice to the email accounts and phones of the user. But if you wait till the person is going to be away from their email/phone for 24 hours (camping, vacation) then its easily done. Even easier without the phone attached to an account.

Edit: This worked for me 2 weeks ago, but facebook updates a lot.

Improve this answer
2
  • 1
    Hhmm, this seems very plausible. But my friend would have received weird emails from facebook about new email addresses being added.
    – Mooktakim Ahmed
    Commented Aug 9, 2011 at 12:35
  • 1
    Yes they would have received an email saying that they tried to reset the password.
    – corymathews
    Commented Aug 9, 2011 at 13:10
5

My guess also would be the facebook apps. Perhaps clicked on the wrong app ?

Check the app settings on the facebook profile and delete any unneeded applications. Then after doing that, try to change the password / mail address again.

Improve this answer
8
  • 2
    A malicious FB app would be my first guess too, as changing authentication details won't affect app permissions.
    – Piskvor left the building
    Commented Aug 4, 2011 at 13:17
  • indeed, therefore I suggested removing unneeded app permissions and afterwards changing password
    – Goez
    Commented Aug 4, 2011 at 13:25
  • even then... you need to make sure those apps didnt put malicious code on the computer... if there's malicious code on the computer, you still run the risk. Hence why in my answer, I recommended removing apps access and scanning their system with a malware scanner, to make sure their system isnt horridly infected (likelihood is low, but i have seen it happen before).
    – Thomas Ward
    Commented Aug 4, 2011 at 13:35
  • well, the computer was wiped. Ofcourse the risk is still there that the malware is re-installed but still...
    – Goez
    Commented Aug 4, 2011 at 13:42
  • Considering that Facebook is the likely source, and that all apps do have a client-end interface, that could theoretically have reloaded the malware onto the system. Hence why the scan should be one anyways.
    – Thomas Ward
    Commented Aug 4, 2011 at 13:43
3

Perhaps it is the links that she uses. There are facebookviruses that are able to extract information simply via the facebook api. Perhaps she keeps visiting such a website that does it without knowing it. Perhaps you can try to set up a new facebook account for her that she logs into and keeps open for a few days. See how this works on the new account.

Improve this answer
2
  • Even then, how does it work? In facebook you need to type in your existing password whenever you want to add new email and change your existing password.
    – Mooktakim Ahmed
    Commented Aug 5, 2011 at 11:50
  • if you are logged in all the time, basically there is stuff possible. pcworld.com/article/155017/…
    – tarrasch
    Commented Aug 5, 2011 at 11:54
1
  • delete all applications that really aren't necessary
  • restart password on email and/or on FB account
  • don't login nor save/enter passwords for PC that could be infected
    • see what happens after few days.
      • if there are no hackers, you know which PC did it
      • if there are more hackers, try to restart your password and generate new one from your head!

I don't think it has something to do with applications (excluding e-mail access and such information)

Improve this answer
1
  • I have done this. And it still got hacked in recently.
    – Mooktakim Ahmed
    Commented Aug 8, 2011 at 9:46
0

Has she said up a URL attached to her profile such as: facebook.com/IAmAwesome if so the above could be occuring because she has someone who really "likes" her and just keeps abusing the way in which you can reset people's passwords on facebook by forcing in your email address to their system. Have her create a new profile completely and have her be very selective over whom she invites into her new group of friends.

Improve this answer
1
  • She's using this for business and has already established networks. Creating a new profile would undermine that.
    – Ivan
    Commented Jun 27, 2016 at 13:33
0

Perhaps you are being hack via man in the middle? Scan for mac adresses on your network. With cain and abel you can see who is on it, and then if they are on it, you can report it to the feds.

Improve this answer
3
  • Also, if they have this on, Facebook is surely not the only thing they hacked. Man in the middle attacks mimic your router so any passwords you enter go through their computer to be collected.
    – NsPad
    Commented Oct 4, 2014 at 3:11
  • First thing i did was turn on SSL for FB (and other websites). So i don't think its that.
    – Mooktakim Ahmed
    Commented Oct 6, 2014 at 11:06
  • 1
    I couldn't figure it out at the end. Either the virus got killed somehow or the hacker got bored and moved on.
    – Mooktakim Ahmed
    Commented Oct 6, 2014 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .