588

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their database. For example, if your password is "myRealPassword!" but you submit "...


200

Let's hope and assume that Facebook stores only hashes of current password (and potentially previous passwords). Here is what they can do: user sets first password to "first" and fb stores hash("first"). later on, users resets password and is asked to provide new password "First2" Facebook can generate bunch of passwords (similar to the new one): ["First2",...


178

As you said, you saw this on facebook - so I tried these steps: Login with lukas@gmail.com and real password -> works Login with lukas@gmail.cmo and real password -> works, too (!) Login with luksa@gmail.com and real password -> also works Login with luksa@mail.com and real password -> also works Login with lukas@gmail.cmo and wrong password -> Wrong ...


166

I interpret your question as: What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips? It's not that strange if you think about it this way: As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the ...


145

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million users to log out early Friday, a common safety measure taken when accounts have been compromised." Additional article from The Hacker News - "unknown hacker or a ...


109

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


105

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


90

That article is wrong and that website in general seems like a very unreliable source for anything. With the netstat tool, among other stuff, you can see established TCP connections. When you use Facebook messenger (or any other chat), at least one server is between you and the person on the other side, it's not a peer-to-peer connection. Hence the IP you ...


72

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. Are you seeing that more differences are allowed? Apparently, they also have some similar usability features for the email address. Automatically "correcting" ...


64

To me it seems as if someone is doing fraud from your account. They load your FB with money (from a stolen credit card). Lose at poker so the money goes to another FB account. Withdraw that with an anonymous prepaid credit card. There are lots of different ways of doing carding (fraud). I'd contact FB and maybe the police as you might get a loud knock on ...


57

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or whose devices automatically capitalize the first letter of the password. I don't think there are any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords ...


46

I went on that website and this is what I saw: They are using the Customer Chat Plugin from Facebook. They don't know your name, they're just embedding an iframe to allow you to speak with their Facebook page's administrator(s). Only Facebook knows who you are.


37

This is a proxy authentication pop up! And it's most likely a proxy related attack. When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication. For example: Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server ...


36

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about. Details: What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself. My guess is that facebook.com is filtered by your "...


33

OP has clarified that this is Zynga Poker, in which no real money changes hands. That being the case, the most likely reasons for a fraudster to put money into your mother's account is that this scamp has acquired/purchased a block of PayPal account details and is systematically testing them to see if they work by hacking into Facebook accounts and using ...


33

The other answers look pretty reasonable, but I wanted to add a few possibilities. If an attacker recovers one or more of your passwords from other breaches, it seems like plugging them into Facebook's UI could leak at least a few types of information: Whether you used the password on multiple services or not. With known disclosure dates for the breach, ...


32

Very Simple, Facebook IS spyware. It is also "Consensual" spyware...yeah, it's spying on you, but you agreed to it (even if you didn't read the agreement before checking the "I Agree" box), and it is probably safe to say, you 'enjoyed' the benefits of it, so most people (still) aren't really complaining about it. As the public's understanding of just how ...


31

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your users....


29

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


25

If you consider the login process as a whole, this measure can actually increase security. Instead of granting users several login attempts to manually fix common misspellings, the site tries to fix those misspellings automatically. As a result, the average number of login attempts a user needs goes down, which means a more strict rate limiting to an ...


24

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook (not so freaky, just regular FB creepy). It would be an interesting exercise to try the same, but with your work number and see what kind of ...


22

I wouldn't know if they do (don't even use Facebook), but it's also possible that they use Hardware Security Modules (HSM) for their cryptoprocessing that don't store hashed passwords but merely reversibly encrypt them. With the volume of authorization requests they have to deal with, this would make perfect sense, as it's orders of magnitude faster than ...


17

There isn't much you can do about it besides deleting your Facebook profile (different from deactivating it - though I'm sure in both cases nothing is really deleted). As for how Facebook got your number - they have a feature in their mobile apps which allows people to upload their contacts to Facebook - if many of your friends had this enabled (and the app ...


17

In addition to @skooog's answer which states that the IP address that you are detecting is not that of the user: IP address geolocation is, at least for IPv4, doomed to fail except in specific edge-cases. Many ISPs dynamically allocate IPv4 addresses, meaning that increased precision gained from a user who enables GPS location on their browser or posts geo-...


16

You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code. Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...


15

Allowing username or email iteration may be a security problem for most sites, but not for Facebook. For sites as large as Facebook, finding emails that have accounts is easy because the sites have so many users. This holds for other huge user databases like Google and Microsoft. These companies just have to be secure in the face of their username/email ...


15

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


14

The sum of what the client stores and what your server stores must be sufficient to recover the user-specific secret data (e.g. Facebook access token). What the client stores is, mostly, the user's password (the only permanent storage area on the client side is the user's brain, if we want to allow the user to use several distinct machines at will). If I ...


14

Here is what using Tor to access an ordinary, non-onion facebook URL looks like: You -> Tor... -> facebook.com Now both of those links (from you to Tor and from Tor to facebook.com) happen on the open internet, so an attacker might watch packets flowing across those links like this: You -> (attacker) -> Tor... -> (attacker) -> facebook....


Only top voted, non community-wiki answers of a minimum length are eligible