21 replies to this topic

[web_designer]

well i am not quiet sure but mostly i think that my facebook account got hacked. because i have two facebook accounts. so when i was in my other account, i saw a link posted on my wall from my other account!!!

for the first few seconds i was like this because i can't be in two places at once, right?? and later i noticed that this link is posted on my friends wall too.

so certainly it wasn't me, and my account got hacked and till now i didn't do anything but changing my password.

so any suggestions or anything else i could do??
thanks in advance.

[SeanKelly]

Hey web_designer!
Sorry to hear about this.

Have you been using any applications on Facebook recently that are new and you haven't used before? If so, revoke access to the applications here: http://www.facebook....gs/?tab=privacy and then click "Edit your settings" down on the bottom left then click remove and select the applications you do not trust to remove them.

Good move changing your password, if you have not already, may I recommend also turning on login notifications by visiting here: https://register.fac...f=mb&drop&__a=5

Click the "change" beside account security and select "yes" and submit.
This means you will get an email telling you the times when you login in the future to prevent unauthorized access.

Good luck!
Sean

[Maggot]

On facebook it self there is a forgot your password link just under sign in... Click it...

Forgot your password? Enter your login email or mobile phone number below and fill the security check. If you use your email, we will send you an email with a link to reset your password. If you use your phone number, we will send you an SMS with a link to reset your password. If you have not confirmed your mobile phone number with us, you cannot use it to reset your password.

If who ever hacked your account did manage to change your email and phone no then try the have a different problem link....

If you have a different problem accessing your account, please see our Login Problems Help Page.

My email address or my Facebook account has been hacked.
See our Security Help Center page here.

There just choose the above and try again....

If its just the problem from the post you got on the other account then its just a application you installed and theres a timer to go off every day and post loads of adds on your friends wall... Just disable that application....

Edited by Maggot, 16 August 2010 - 11:40 AM.

[vhortex]

It is also nice to let the facebook admins know about this problem. I once have this 'hacked' account and it was not due to signing my account on a bogus site unless Disqus system is a bogus one which is unlikely or an application that was recently installed instead part of facebook's API/code was compromised by a rebel application that one of my friends have. Due to the way facebook stores login and credentials and other stuff, the viral approach of this rebel application was able to hijacked my account and changing password never worked.

They put my account for checking for 2 weeks and the problem suddenly disappears. Pinpointing who of my 650+ friends have subscribe to the rebel application was hard. As a rule of thumb, when a sudden 'hacking' attempt was done, remove the last friend you have added. He/she may be one of the link used to compromise your account. I also develop some apps on facebook and sad to say that facebook lack a solid security system and was starting to become myspace/friendster where security is just a joke.

[web_designer]

thank you guys for your reply.

@seankelly, thank you for the links you gave me i did what you said, i forgot about the applications. thanks god you reminded me. and checked that check box in account security.

@maggot, and vhtortex thank you guys for your help. i changed my password already and now i can enter my account and nothing weird happened since then. i will keep what you said in my mind in case this will happen again.

[The Simpleton]

Wow it's lucky that you didn't lose your facebook account or anything like that but it looks like in this case it wasn't exactly hacked, and since you didn't mention what that link was, I can only guess that some application sent it. I have two facebook accounts too and I use one for games and other applications while the other one which I use for friends is completely clear of any sort of applications. I think it's a good idea to remove all applications from your main account and use it only for networking, while you can try out all sorts of crazy apps with your other account It's up to you in the end, but in this way you can relieve yourself of this sort of worries.

[vhortex]

Quote

I think it's a good idea to remove all applications from your main account and use it only for networking, while you can try out all sorts of crazy apps with your other account It's up to you in the end, but in this way you can relieve yourself of this sort of worries.

totally agree

and as a program creator with facebook apps.. i can see the whole profile of anyone who visits my application and this application in question is not hosted on facebook but on http://vhortex.com which is my site.

here are the things that i can see which surely is also available to spamming/viral programs on Facebook.
1. full name
2. birthday
3. marital status
4. join date
5. school
6. address
7. friends (sometimes they don't work and you can't write on their walls unless they also visit your application page)
8. email (sometimes it work and sometimes it does not, no idea if this is standard or just a bug)
and last, userid which identify you on facebook and was also used to get items 1-8 and have this format 100000025xxxxxx. basically it was your database ID and signifies how many registered before you do which is on my example says at least 25million registered before me.

and I can write on your wall using this info without you knowing it. which of course on viral/spamming softwares on Facebook will contain links and text or even images that will trick your friends to visit the same application page. this is possible since facebook uses a combination of cookie and session to maintain cross site login.

Edited by vhortex, 23 August 2010 - 10:24 PM.

[The Simpleton]

vhortex, on 20 August 2010 - 10:12 PM, said:

I think it's a good idea to remove all applications from your main account and use it only for networking, while you can try out all sorts of crazy apps with your other account It's up to you in the end, but in this way you can relieve yourself of this sort of worries.

totally agree

and as a program creator with facebook apps.. i can see the whole profile of anyone who visits my application and this application in question is not hosted on facebook but on http://vhortex.com which is my site.

here are the things that i can see which surely is also available to spamming/viral programs on Facebook.
1. full name
2. birthday
3. marital status
4. join date
5. school
6. address
7. friends (sometimes they don't work and you can't write on their walls unless they also visit your application page)
8. email (sometimes it work and sometimes it does not, no idea if this is standard or just a bug)
and last, userid which identify you on facebook and was also used to get items 1-8 and have this format 100000025xxxxxx. basically it was your database ID and signifies how many registered before you do which is on my example says at least 25million registered before me.

and I can write on your wall using this info without you knowing it. which of course on viral/spamming softwares on Facebook will contain links and text or even images that will trick your friends to visit the same application page. this is possible since facebook uses a combination of cookie and session to maintain cross site login.

Wow thanks for letting us know about that vhortex - I always wondered what sort of info the app developer had access to. What you said has only strengthened my resolve not to let any app come near my main networking account, while I can use as many apps I like on my gaming account!

Oh, and I see that you quoted my words from the previous words but didn't use the quote tags. If you can still edit this post please do so before a mod notices

[web_designer]

yeah thank you vhortex for those information. it is really useful, from now on i won't use any new application. i already deleted a lot and kept only few who i use them long time ago. also i deleted my personal photos and set more privacy setting. hope that will work and not seeing another links posted on my wall's friend again.

[mahesh2k]

As said earlier, uninstall applications. Plus stop using facebook connect as way to connect or login to some sites. There is flaw with that as well these days. If applications are removed and still you're facing issues with the facebook then i suggest you to avoid visiting some group pages or profiles where there is apps running with weird JS.

[The Simpleton]

mahesh2k, on 21 August 2010 - 09:11 AM, said:

As said earlier, uninstall applications. Plus stop using facebook connect as way to connect or login to some sites. There is flaw with that as well these days. If applications are removed and still you're facing issues with the facebook then i suggest you to avoid visiting some group pages or profiles where there is apps running with weird JS.

I agree - using Facebook to link with other sites can be really risky if the site is not trustable. I would suggest logging out of facebook after every use so that even if we visit another site with facebook apps, they won't link to us automatically.

[web_designer]

mahesh2k, on 21 August 2010 - 09:11 AM, said:

As said earlier, uninstall applications. Plus stop using facebook connect as way to connect or login to some sites. There is flaw with that as well these days. If applications are removed and still you're facing issues with the facebook then i suggest you to avoid visiting some group pages or profiles where there is apps running with weird JS.

hmm, i never thought of that before, or in fact i never do it in the account i am talking about now, but it is a very reasonable idea. thanks for mentioning that to me. i will keep it in my mind to avoid the risks and to keep my account secure.

[deadmad7]

The Simpleton, on 21 August 2010 - 10:21 AM, said:

I agree - using Facebook to link with other sites can be really risky if the site is not trustable. I would suggest logging out of facebook after every use so that even if we visit another site with facebook apps, they won't link to us automatically.

That's not really true... There isn't really a way that the people can access your Username/Password just because you use Facebook to login to their site. You could even do that in my site and there is NO way that I could access the info that is passed between Facebook, my API code and my site.

The thing I think that you should REALLY be worried about is the APPS inside FACEBOOK it self, many of them are plain EVIL and they do steal your private info and sell them to companies... That's why I rarely do those quizzes and those games... thats probably why Facebook's privacy policies are in shatters

[vhortex]

The Simpleton, on 21 August 2010 - 02:09 AM, said:

Oh, and I see that you quoted my words from the previous words but didn't use the quote tags. If you can still edit this post please do so before a mod notices

I was trying to edit it but I can't, strange that I can edit it now.

@deadmad7
yup correct, there is no way to steal the username and password since it is still Facebook who grants the login and not the third party website unless of course the login screen is fake.

***********
About the apps on Facebook, it looks like most of them are just being served inside a frame. Everything was being passed via API calls and dropping cookies on your computer which can then be picked up by third party websites aimed to steal the cookies. I am not viewing the cookies as evil, it is Facebook's poor security on it's API libraries.

I just discovered the flaw when I accidentally posted on all the walls of 3 of my friend's friend list. It's odd since Facebook should block them but I was able to do it. Too bad that gives me bad publicity for my website and it was labeled as spam which is of course not since the posted content was about a movie and a game review summaries with links to my blog which is being served on irregular intervals to 500+ casual gamers and movie goers.

My working apps only do this things, feed RSS data via Facebook for those who wants them and post a summary of a blog post on my website. Lastly is to allow Facebook users to post directly on my blog with no login which is later on replaced by disqus system. My Facebook apps page only shows a dot to discourage people to subscribe to it since it was not the intended purpose. I only write to the general wall. The extra info was noticed when i do a dump of what I got from the API. Somehow, some people love to stare at the dot and tried to wait what will happen despite the notice that I will only show a dot.

Facebook will only pop out the 'allow this program to.....' box when you are trying to visit the page and grant it access though this process is really optional for evil developers.

[fermin25]

I am sorry to hear that your facebook account got hacked but I am sure that is totally hacked and someone in the net have your password because it´s evident with this type of strange use of your account. You can do a lot of things and I recommend you first to try to seek who or where you possible got hacked your account and maybe you are the victim of a Social Engineering truck or something because I don´t believe that your account got hacked by a trojan horse or a virus, the most possible is that you were using your account in a public place, like a cybernet internet service and the people who work there have installed some programs like Cain & Abel that is a program who record all the password used in the computer and the directions of mail of your accounts and I personally have installed this program in some place where I worked and I stole a lot of twitter, facebook and hotmail accounts. I stole like 200 accounts but I got bored using them to read emails that weren´t mine. So I never damaged to anyone but I could to steal a lot of accounts with this method. I think that you are a victim of this method maybe or some type of social engineering because it´s very typical to hear this here in my country where a lot of people use the public internet in a lot of places and be exposed to some simple but powerful programs like Cain & Abel and some others. Once you have determine the possible way of the hack you have to take the preventive actions and change inmediately your password of your facebook account and of your e-mail directions, because there is the posibility of being hacked from your e-mail direction and this could be the way to hack your facebook account. So like you see this world of hack is very complex and we can be victim in a lot of ways of this world problem. We have to be preventive and avoid to be exposed to the hackers because believe when I say that the hackers are closer than you think. Bye.

[Idiomus]

FaceBook Rights and stuff..

Quote

# Registration and Account Security

Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account:

1. You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.
2. You will not create more than one personal profile.
3. If we disable your account, you will not create another one without our permission.
4. You will not use your personal profile for your own commercial gain (such as selling your status update to an advertiser).
5. You will not use Facebook if you are under 13.
6. You will not use Facebook if you are a convicted sex offender.
7. You will keep your contact information accurate and up-to-date.
8. You will not share your password, (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account.
9. You will not transfer your account (including any page or application you administer) to anyone without first getting our written permission.
10. If you select a username for your account we reserve the right to remove or reclaim it if we believe appropriate (such as when a trademark owner complains about a username that does not closely relate to a user's actual name).

[inea]

The rights and stuff are probably easy to find on the site of the Facebook. But a link to the webpage where the rules were found would make it more easy to check the quotes.

[web_designer]

Idiomus, on 28 September 2010 - 05:00 PM, said:

FaceBook Rights and stuff..

interesting information, i admit i am from those who click on accept without reading the rules. especially in registration in sites. thanks for telling me that.but between i must say that half of those rules are not implemented accurately. since i have two account and two profiles but with different email address of course.

[soniat]

Also Check any suspecting apps ,groups or freinds are connected with your facebook account....

[sheepdog]

I guess I'm one of the few hold outs that have not sighned up for face book. A few days ago I was visiting with a friend of mine, in person too, not on the computer, and she was telling me about another friend of theirs that works on computers. She said that at least half of his business comes from fixing up computers that got viruses from face book accounts. So until they make it safe to use, I'm not going anywhere near that site. I have enough computer problems as it is without going looking for them.

[darko100]

How the heck a web designer to allow hacking of his own Facebook account ?

I think there is some bad spyware on your computer which steals all the data. Also maybe a hacker tried to vnc/remote desktop your computer and succeed.

So there are 5 possible cases:
-connecting to a Wi-fi which stole your fb pass
-spyware
-hacking
-phishing
-remote engeneering

The most popular ones i think are the first one and the second one. I would suggest to remove all your emails from FB , alternate emails , reset passwords everywhere , reinstall your PC....

[CalebFTW]

sheepdog, on 02 September 2011 - 07:09 PM, said:

I guess I'm one of the few hold outs that have not sighned up for face book. A few days ago I was visiting with a friend of mine, in person too, not on the computer, and she was telling me about another friend of theirs that works on computers. She said that at least half of his business comes from fixing up computers that got viruses from face book accounts. So until they make it safe to use, I'm not going anywhere near that site. I have enough computer problems as it is without going looking for them.

I haven't joined facebook either I feel a bit left behind but as long as you keep your software(java, flash, webbrowser, etc) you should be safe to use facebook if your using firefox try no script.
@OP I don't believe anyone has access to your credentials this sounds like a classic case of clickjacking
Regards, ~CalebFTW

Edited by CalebFTW, 21 October 2011 - 04:19 AM.