2

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular Facebook account, everything is OK. It becomes interesting when I try to create another one using a Proxy running on a virtual machine with different MAC address (even though it is not broadcast) and everything. With that configuration Facebook is able to recognize me and prompts identity check(as I'm creating "Fake" account). They are so good at identifying me that my real profile is shown as recommended friends.
How is this even possible since the only thing they get is a HTTP/S request originating from unknown IP, that the "real" profile never used? What information about my machine is sent to their server?

PS: This is for informational purpose only, I am making my research and conclusions. No funny business!

  • 1
    How did you hide your IP? A VM won't do that. – Neil Smithline Aug 3 '15 at 22:54
  • SOCKS5, I then manually checked the IP to ensure myself everything is ok. – Danny Babbev Aug 3 '15 at 23:10
  • is proxy under VM or is it the browser? – valentin Aug 3 '15 at 23:16
  • 1
    Does the VM was totally clean? If you used that VM to browse websites (no FB login required), there could have been a previous record of that IP address (stored in some cookie, as Sandeep suggested) before you hide your IP. – lepe Aug 4 '15 at 0:45
  • 1
    You need to include in your question all the methods you used to hide yourself (including the SOCKS5 proxy). There are a lot of details missing from the scenario for us to help. – schroeder Aug 4 '15 at 4:05
1

Actually I started to comment until I guessed my comment is too long ... anyway:

Whatever the settings methods you used to deploy SOCKS5 that you mentioned in your comments to hide your IP, surely Facebook does not rely on IP addresses to identify its users because IP addresses could be the same if the users are, for instance, behind a corporate firewall, as are the users' reported locations, and users can modify their IP address at will.

There are many elements to consider. For example, in the case your VM operating system is the same as your host's one then this could be used in junction with your typing fingerprint -as for Google, banks ...etc-(there are algorithms designed to capture and analyze the keystroke dynamics), plus, when you install a virtual machine you are, by design, sharing lot of information, (including your host IP address and hostname), between it and the host machine leading not only to detect they are the same machines but even to viral infection (which can work in both sides). Those shared information could be used to detect your device and your some other data using browser (interesting to read) and Etag fingerprinting that can be used to check if two resources (host/VM in our case) if they are identical (in case of bridge-mode networking ?)

What I want to say that Facebook does not rely on IP addresses to identifiy uniquely its users, so whether you hide it or not, that is not that important.

Your experience with Facebook remembers me of my own experience with few StackExchange websites. When I started to use this website in the first days, and after reading an answer on this website where it is stated that:

Assuming that you can use TOR or a VPN or an openshell anywhere to tunnel away your IP address, the "safest" practice in my opinion would be to fire up a virtual machine, install a stock Windows Seven on it, and use that for any privacy-sensitive operation. Do not install anything unusual on the machine, and it will truthfully report to be a stock Windows Seven machine, one between a horde of similar machines.

So I created around 20 VMs with different OS versions where the host machine uses a private IP address. I have been detected and suspended; I was not even able to create a new profile on new VMs even after changing the host machines (I even used one server to by pass the suspension).

Why do I mention finally my own experience on here ? To tell you that maybe the moderators of this website are the ones who could answer you but don't hope because they won't. But why ?

The why is the final answer: as on here, Facebook and other similar systems use security through obscurity (among other things) so you can not know how exactly they are doing.

Further (interesting) reading.

  • 1
    First, let me thank you for this amazing answer! Reading what you wrote, I realized you are completely right. Facebook and other big institutions can't rely on IP address. What I found interesting was that host VM shares host information, I will definitely research this. As you said, there is no information on how this unique users are identified, I think that this is not the way it must be. Our community should take this on further investigation! – Danny Babbev Aug 4 '15 at 11:39
  • You are welcome. If you have time to read whenever you can the last article I mentioned by the end of the question, it will be great for you. – user45139 Aug 4 '15 at 11:42
  • 1
    In my opinion, this "no cookie tracking" method threatens our security and identity... – Danny Babbev Aug 4 '15 at 11:47
  • I disagree that different IPs are not that important. Facebook can not rely solely on IP addresses to uniquely identifiy its users, but if I see 20 sign ups from the same ip in the same hour, well, I would probably consider that you are a single person trying to fool the system. – Ángel Aug 10 '15 at 14:15
  • @Ángel IPs are not that important = can not rely solely on IP addresses. Same idea, different expressions :) – user45139 Aug 10 '15 at 14:18
0

Part I - How could Facebook find out your fake account?

I tried to create an account through two different ways:

  • My laptop by using Tor Browser - Result: No identity check nor references to my real Facebook account.

Option 1

  • VM using NAT, Firefox and VPN - Result: No identity check nor references to my real Facebook account.

enter image description here

By reading your description and comments, I am sure you know what you do, but I am afraid you might had missed a small step in your lab tests and that is why you got caught.

Part II - How does Facebook track you?

Facebook bought in 2013 a Microsoft company called Atlas Solutions. Atlas is an online advertisement company which gathers people related information as follows:

Third Party Websites:

Facebook's user tracking hasn't been limited to your time on the site: any third-party web site or service that's connected to Facebook or that uses a Like button is sending over your information, without your explicit permission.

Cookies:

...Logging out of Facebook ... may deauthorize your browser from Facebook and its web applications, but it doesn't stop Facebook's cookies from sending information to Facebook about where you are and what you're doing there. ...Facebook's tracking cookies-which never expire, are only altered instead of deleted when a user logs out. This means that the tracking cookies still have your account number embedded in them and still know which user you are after you've logged out.

Single Sign On:

Several websites make use of the Facebook as SSO (IaaS). That being said, those application can create their on cookies or ways to track you re-feeding this into Facebook whenever you interact with them.

  • Thanks for your answer and testing this! On my first tries Facebook did't really prompted identity check. My experiment was done in 4-5 moths period, creating different accounts on 1 PC with virtual machines. All accounts were created via different IP address. This check was prompted on my last 3-4 tries. – Danny Babbev Aug 4 '15 at 11:52
-1

A couple of vectors that come to mind:

  • You have not hidden your public IP (unless you are using Tor)
  • Facebook probably has a cookie on your device, linking previous logins.

    In fact, the latter information is good enough to identify you pretty well.

  • Cookie would not apply in this case. – schroeder Aug 4 '15 at 4:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.