Facebook users pwnd by phone with account recovery vulnerability Facebook account recovery using pre-registered mobile numbers is poorly implemented and open to abuse, according to critic James Martindale. Martindale wrote an article on Medium, titled I kinda hacked a few Facebook accounts using a vulnerability they won't fix, highlighting his concerns in a bid to push the social network …
Just incredible that the security of one of the most used systems in the world is so lax.
Also interesting to note that people regularly change their mobile numbers when they change phone / carrier. I've had the same number in the UK for about 17 years, but it's on the 5th new phone and 4th carrier in that time. Does no other country port numbers easily? (or is it an outside Europe thing?)
I kept mine in Holland as much as possible (I only changed once in 17 years as the company took over my contract and then went bankrupt - the phone company would only let me keep my number - with them, converting it to a private account again - if I paid my employers debt to them), and in the UK always kept the same number.
But out of the people I know in both countries, I am in the minority. It seems (note: personal anecdotal evidence only :) ) many people think that it costs money or is somehow unsafe to keep the same number...
Why do you find that incredible? They aren't protecting health or banking info, they're protecting a bunch of vacation pictures and 10 year old posts from three girlfriends ago. It is more important to have it be easy to use than to be secure. They offer multiple methods of 2FA for those who are concerned about security.
"Cold caller spam?"
And you can be sure that the previous owner of your new number didn't spaff that number all over the place?
My company mobile number of 10 years was used by a previous employee who also used it for his own business. It was quite literally *years* before calls for him from his clients finally stopped.
So hows this work? ... A determind scammer with a good scam up his sleave , just needs to access someones (anyones) facebook account to kick it off. Does he buy a load of phones hoping that one of the numbers he gets will have been used on facebook?
How does he know which account he has the phone for? Oh , im guessing facebook told the guy in their "come back!" text ?
Or can you just go on the site and click on "I forgot my Username but my phone number is..."
I can see theres some holes there but a ner-do-well would heve to get lucky... (which , yes i know , is not a valid security policy)
If a scammer were to run this as an actual operation, they'd probably use some phone API like Twilio, which will dramatically reduce their costs. Then they would just request a new number, attempt to log into Facebook, and if the login is successful, take it over, rinse and repeat.
While the "come back! text" tipped me off that this was possible, it's not necessary to know if an account exists that that given phone number.
You are correct that there is an element of luck involved. But I stumbled across enough accounts in a row that I'm wondering if I'm either incredibly lucky, or there's a lot of accounts up for grabs.
Looks like you can't use "just" an authenticator app for 2FA on Facebook - either a cellphone (which will receive a code via SMS allowing login *without* the authenticator code) or a physical key is required. And even if you still have that phone number, SMS messages aren't remotely secure. https://www.theregister.co.uk/2017/05/03/hackers_fire_up_ss7_flaw/
I wouldn't be surprised in the LEAST if FaceBitch's reaction to the exploit discover is to HAVE THE GREY-HAT HACKER ARRESTED!
After all, he ALTERED account parameters [by removing the phone number] !!!
I'm sure some DRM or obscure law could be used to PUNISH! THAT! GUY! with the full force of THE! LAW!!!
[it's the kind of "logic" Face-Bitch WOULD have. yeah]
Yep. This is lousy security, but it is on the users as well as Facebook. Even if FB forced a PW change, that won't stop crackers from getting in. It might warn the user that something is going on or it might not. Either way, it reminds be about a saying about horses and barn doors. Users should also be held responsible for not keeping contract info up to date.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
