Facebook uses two-step authentication or "login approval", which means that all unrecognized devices will have to enter a code received through SMS. Suppose my Samsung device is the only device that has been logged in to my Facebook account. What must the attacker do so that:

  • I won't receive any SMS (or at least won't see any)
  • I don't receive any e-mail about that
  • The attacker gains access to my account and can view messages/be active (liking, commenting)

What is the most realistic and possible scenario?


There are different possibilities from the top of my head:

  • the identifier of a legitimate device has been compromised (by a MITM with a downgrade attack, for example) and used to identify as such device,
  • the mobile phone has been compromised as a whole (forwarding and hiding/deleting SMS and emails),
  • SS7-based attack on your mobile number in combination with a compromised email account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.