14

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to click on a confirmation link to use an email address. Maybe the attacker got access to the mailbox somehow.

The interesting question for me is, why would someone do this? It is easy to create a free email address within minutes. Why does the attacker use the email address of someone else? It is no impersonation scenario, because the Facebook account has a totally different name than my friend. I cannot think of a reasonable scenario that makes stealing an email address for creating a Facebook account worth the effort. Am I missing something?

Update: First of all, no one from Facebook responded to our abuse message. Nevertheless the fake account was gone after several days - we have no idea if Facebook took active measures against this account or not.

I didn't think about the obvious counter measure against this fake account when the incident happened but this idea might be interesting to others facing a similar problem. If someone registers an account with your email address, there's nothing easier than resetting the password of this account and access/delete it - you are the owner of the email address bound to the account and the "lost password" function plays into your hands. I am not sure if this would be 100% legal though - depends on the question if the account is actually yours, if your email address is bound to it.

Improve this question
8
  • Please add the email headers to let people check whether the email is really from the Facebook servers.
    – Hendrik Brummermann
    Feb 25, 2012 at 21:24
  • Thanks for the tip, I checked the headers myself already. The emails are really from Facebook and the account is really registered with the email address in question. You can search people by email on Facebook and the new "fake" account pops up when looking for the address.
    – Demento
    Feb 25, 2012 at 21:42
  • 1
    This has happened to me twice. The first time, they deleted the account when I filed an abuse claim. I just put in the second request, so we'll see what happens. It is one of the few choices on this abuse page so they must be aware of the problem. My email address is (common last name) at gmail.com, so it could have just been a mistake, but I too am curious as to how they managed to activate the account without clicking on the link.
    – user18443
    Jan 7, 2013 at 18:53
  • @Ben - Its very likely they have acccess to your email account.
    – Ramhound
    Jan 8, 2013 at 14:04
  • I just noticed this happened to me as well. I was just going to sign up for a throw away facebook account for contest entry purposes and tried to sign up using an old dormant throw away email address I had from Hotmail, I found out it was in use. Rather strange since if they had access to my email they should have changed the email password to block my reclaiming it, but nothings changed. The facebook account changed its account password along with my emails for good measure. Strangely it was a Turkish account. The account was effectively unused, no friends no posts, no timeline.
    – user35047
    Dec 4, 2013 at 15:32

3 Answers 3

Reset to default
9

Two possible scenarios that pop into my mind:

  1. Since we can assume the attacker probably had access to his email, he probably had access to his address-book as well and he could have requested friendship (search for friends by email address) from all the people that had a facebook account registered to one of the email addresses from that address-book (some of those requests would succeed). Despite having a different name (lots of people don't use their real names on facebook), lots of people would accept the invite either blindly or since they would see they had friends in common (the ones that accepted blindly). After that, he would have access to additional data about all that other people, etc..

  2. He could just let the facebook account lay there and wait for someone else to find him by searching friends by email after which, he would again have access to additional data.

Improve this answer
4
  • +1: Both interesting options. We will monitor how this develop. I am also interested how Facebook will handle the abuse-message from us.
    – Demento
    Feb 25, 2012 at 21:44
  • Another point is in the preservation of the account. Your friend does all the work keeping the account alive and unsuspecting by logging in regularly and sending an average amount of mail. The attacker would otherwise need to create new accounts and ensure they were logged in and used regularly enough they weren't pruned by the mail provider.
    – deed02392
    Feb 29, 2012 at 12:35
  • 2
    I can't remember where, but someone posted a story about one of their facebook friends contacting them via chat, and asking for help (they got stuck somewhere and needed money urgently kind of story). The person could obviously recognize it didn't 'sound' like their friend so didn't fall for it, but these kind of scams are also a possibility. By creating a fb account with your friends email they might hope to scam your friend's friends (which might be you!)
    – Yoav Aner
    Mar 28, 2012 at 9:00
  • here's one example, and another - not the one I had in mind, but similar principle.
    – Yoav Aner
    Mar 28, 2012 at 9:08
3

He could have tried to spoof a login to another service that uses OpenID/Facebook Connect/Oauth. This assumes the service uses just the email address to identify the user.

Improve this answer
1

I would do that if I wanted to stay completely anonymous. Fake data or stolen data isn't yours, since you can't register without providing some data about yourself, try to use a fake or stolen email address.

Why would one want an anonymous facebook account?

  • Get RSS feeds
  • Express ideas and stay anonymous (free speech)
  • Cannot get punished by any government or company for what you say

It's just like anyone but you don't need/want to relate to your friends. Being judged by what you say and not by who you are, your race, nationality, etc.

If your friend doesn't need this address<->facebook account and that the thief doesn't impersonate him in any harmful way, I suggest you both let it be.

Improve this answer
5
  • 2
    why would you need to steal someones email to stay anonymous? :O just go and create a fresh free email account.
    – tkit
    Feb 26, 2012 at 12:26
  • 1
    A new email address would be a lot easier to trace back than an email address with established contacts and is used regularly by a user.
    – cutrightjm
    Feb 27, 2012 at 13:12
  • 1
    Yes. Besides, how would you create an email address? You are asked to provide some information and you should stay careful to what data you expose (your browser leaks data, your IP, etc) without knowing. It's kind of an issue, it's stealthier to use someone else's mail account.
    – Aki
    Feb 27, 2012 at 14:05
  • 1
    you can always use a plain, simple vanilla browser, a proxy and not provide any real information...
    – tkit
    Feb 27, 2012 at 19:41
  • We could debate this for hours, there are obviously a great number of possibilities. My answer just tried to explain why would one possibly want to use another's email to register a facebook account. Let's not get off topic here.
    – Aki
    Feb 27, 2012 at 19:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.