Facebook users be careful!

You sure you didn't just get phised(sp). On myspace they just replace a link such as photos to a fake login page so you think you have to log in again. It can be quite effective when your just browsing along as your not thinking.

Applications don't have access to passwords via the applications api on facebook.
 
I'm quite sure although it's entirely possible though the only times I log into FB are when I'm using my PC or laptop and via the bookmark link, cannot recall ever using another link to get there!
 
DNS hijacking/poisoning springs to mind as a possibility. I'm fairly sure facebook are not silly enough to store unencrypted/hashed passwords, so even if the applications did have access to your password info (again I'm almost totally sure they dont) the cracker at the other end would need to decipher your password.

At any rate, [email protected] had access to your facebook account through some as of yet unidentified means. I'm assuming from your facebook account solina gleamed your messenger/email details and used them to add you to their messenger.

I doubt you'll see them again as they probably created a throw away account. Change your password, check for rootkits and such. If nothing comes up and no one else adds you to their messenger and relays your "new" password, then I think you're fairly safe for now.
 
Aye I did consider rootkits so decided to just be triple safe and run the Kaspersky online scanner which can detect rootkits - it's going to take a long time to scan though :p
 
I would suggest using several tools to check for rootkits. AV programs tend to miss a fair amount these days.

Rootkit Revealer (sysinternals) or if you're feeling a bit more adventurous IceSword (hello kernel level operations, yes the author is chinese so look for english instructions)
 
I've attempted to try Rootkit Revealer and IceSword but have failed, they throw up error messages about failing to initialise and I notice they have not been updated since 2006 so most likely won't work with Vista64 !
 
why would add anybody on messenger that you don't know?
it will clearly be something dodgy. just ignore them :confused:
 
Have you emailed FB with the details?

ould it not just be one of your mates having you on after guessing/seeing your pw?
 
Yeah if I ignored it then bye bye FB account!

It's certainly not any of my mates I'm certain of that at least!

Rootkit scan still running, 158k files scanned only 26% done - nothing found so far! (complete scans already done with AVAST and BitDefender btw)

Also scanning LAN machines just incase they got to me through a compromised machine on the lan - again, nothing found yet...

Until I hear back form Facebook it will be impossible to know what happened, I now reckon it was a one off, someone found the exploit and decided to chance it but didn't bet on me changing the password and locking down my account so quick!
 
Last edited:
If you forget your password you enter your email and it mails you a confirmation link so nope, this was not the method used!

No rootkits found on any machine btw too!

It's all down to Facebook admins to solve this now!
 
mrk said:
If you forget your password you enter your email and it mails you a confirmation link so nope, this was not the method used!

No rootkits found on any machine btw too!

It's all down to Facebook admins to solve this now!
Click to expand...

What about this page though...Not sure where it takes you after submitting the details.

http://en-gb.facebook.com/help/login.php
 
Hm no idea on that page - seems you'd need to know a bit of info to gain access - even still FB is set to email you confirmation mails on such actions.

Bizarre.
 
I suppose if someone had access to your account via a Cookie Grabber they still wouldn't be able to get your password unless they changed your email, then 'forgot there password'?
I am not sure FB use cookies either... lemme check.


Edit: seems they do.

Shot in the dark.


I don't know if FB will email your OLD password back, or create a random one and email you that.
 
Last edited:
My account is back :) I locked it down and change PW before he could do anything - perhaps some kind of cookie grabber was used - it would make sense as they attempted to set the default email to the hotmail one but was unsuccessful.
 
If a facebook application that was big and popular had an exploit in it, it would be well known by now. You've been phished. Don't blame it on facebook.
 
Even though they said they used a backdoor in facebook apps?

As I said, phishing is only possible if you log into a site via an alternative URL which I don't - I always use the bookmark which is http://www.facebook.com/
 
You must log in or register to reply here.
Back
Top Bottom