Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy Security

Facebook Admits SMS Notifications Sent Using Two-Factor Number Was Caused by Bug (theverge.com) 50

Posted by msmash from the oops dept.
Facebook has clarified the situation around SMS notifications sent using the company's two-factor authentication (2FA) system, admitting that the messages were indeed caused by a bug. From a report: In a blog post penned by Facebook Chief Security Officer Alex Stamos, the company says the error led it to "send non-security-related SMS notifications to these phone numbers." Facebook uses the automated number 362-65, or "FBOOK," as its two-factor authentication number, which is a secure way of confirming a user's identity by sending a numeric code to a secondary device like a mobile phone. That same number ended up sending users Facebook notifications without their consent. When users would attempt to get the SMS notifications to stop, the replies were posted to their own Facebook profiles as status updates.
This discussion has been archived. No new comments can be posted.

Facebook Admits SMS Notifications Sent Using Two-Factor Number Was Caused by Bug More

Facebook Admits SMS Notifications Sent Using Two-Factor Number Was Caused by Bug

Comments Filter:

  • common sense (Score:1)

    by Anonymous Coward

    Without even checking, it seems obvious that 362-65 isn't FBOOK... there's no doubles.

  • No. No it is not. (Score:5, Interesting)

    by Anonymous Coward on Saturday February 17, 2018 @07:24PM (#56144816)

    ... which is a secure way of confirming a user's identity by sending a numeric code to a secondary device like a mobile phone.

    No. No it is not.

    Some may be stupid enough to believe that, but not I.

    • Re:No. No it is not. (Score:5, Insightful)

      by ToTheStars ( 4807725 ) on Saturday February 17, 2018 @08:10PM (#56145014)
      Shame on whoever modded this down -- "2FA" over SMS is empirically proven insecure, by e.g. social engineering attack on the cell phone company to redirect text messages to an attacker's phone.

      • Re: (Score:1)

        by Anonymous Coward

        Whoever did it can see the IP address and has drunk the kool aid, and is working to suppress free discussion.

        It is about harvesting your phone numbers, not about your account security. That is why it is insecure. It has nothing to do with security.

        With your phone number your location is known and your movements tracked.

        Me, I have no cellphone, never will.

      • Yes, and door locks are useless and inherently insecure because it has been proven that keys can be stolen! Yes, you are a fucking idiot.

        • Re: (Score:2)

          by Khyber ( 864651 )

          "Yes, and door locks are useless and inherently insecure because it has been proven that keys can be stolen! Yes, you are a fucking idiot."

          No, you're the idiot in this case, boss. Your analogy is flawed, the OP is more correct. 2FA can be 'picked' by 'tricking' the phone company into thinking a legit user "the key" is requesting a transfer.

          Thus doors and locks are inherently secure because they can be picked, keys be damned.

          I say that as I hold 9 different acrylic-body locks, made specifically for the purpo

        • Re: No. No it is not. (Score:1)

          by Anonymous Coward

          Picking a lock requires geographic proximity: a thief has to go to your door.

          Hacking SMS to steal 2FA creds can be done from anywhere with internet access.

      • Re: (Score:1)

        by Anonymous Coward

        We're trying to stop script kiddies and password list leaks, not targeted attacks. There is no such thing as secure, just a sliding scale, and SMS based 2FA is none the less better than password logins alone.

  • Dear Facebook users (Score:5, Insightful)

    by 93 Escort Wagon ( 326346 ) on Saturday February 17, 2018 @07:32PM (#56144846)

    We are very sorry we prematurely started sending you Facebook advertisements using the phone number you provided for 2-step verification. Our intention was to not do so until we had finished our latest marketing plan and updated the wording of our terms of service.

    Please accept our apologies. We hope you continue to enjoy Facebook and provide us with what little of your valuable personal information we have not already collected.

    - Your Facebook Team

    • This! And this again. If you're complaining and didn't read the 21 pages of legalese that we call a Terms of Service, then you need a better lawyer.

    • Re:Dear Facebook users (Score:5, Insightful)

      by ffkom ( 3519199 ) on Saturday February 17, 2018 @08:06PM (#56144994)
      I am sure this was as much a "bug" as it was just "bugs" in Googles street view car software to collect WLAN SSIDs, like the "bugs" in car manufacturers motor control software deafeating environmental emission tests.

      • Except Occam's Razor is on the side of Facebook with this one. There is no reason the same system used for 2FA should be tied to a system that automatically posts messages on a wall.

        Google on the other hand was building a WiFi database long before they decided to collect the data on people. There was not only intent in their actions but it also made perfect sense from a business point of view.

        Comparing the two is silly.

        • "There is no reason the same system used for 2FA should be tied to a system that automatically posts messages on a wall."

          Other than posting wall updates from an old 'stupid' fliphone, an SMS capable landline , ....

          • From a single phone number that is also used for 2FA.

            Again: all this points to bug, architectural oversight, or plain stupidity from someone who wasn't thinking clearly. Quite different from the Google case.

  • Not a bug (Score:2, Insightful)

    by Anonymous Coward

    I am at a loss as to how this could be a bug. We almost all here write code, making a computer do anything requires effort, concentration and time.

    This was done on purpose. To what end I do not know but the idea that through some mystery code all this happened is just not logical, it makes much more sense that it was crafted to perform the actions it performed.

    At some point in the code during the authentication process it had to capture the response, that response then had to be applied to a users 'wall'

  • *hugs* (Score:1)

    by Anonymous Coward

    Just here passing out the *hugs*!

    • Re: (Score:3, Funny)

      by Anonymous Coward

      You have just violated the FreeBSD Code of Conduct [freebsd.org] for harassment. Specifically:

      Physical contact and simulated physical contact (e.g., textual descriptions like "*hug*" or "*backrub*") without consent or after a request to stop.

    • Is that you Pinkie Pie? Is this me?

  • Comment removed based on user account deletion
    • ... and yet you would need to know the phone number associated with the account and jump through numerous hoops, meaning it is not impossible to bypass in every situation, but stops attacks in most cases. Get back to us when you can pass a high school class on computer security.
  • It might have been a test -- "how far can we turn up the heat before the frogs jump out?" This time, they found the answer was 'too hot', but that's still good data for them.

    • We're all slowly boiling -- it's more a question of how fast you can turn up the heat. Maybe we should start explicitly distinguishing between sarcasm and prediction in our dystopian posts so it's easier to find when we've crossed various lines. Either that, or we need to condition our sense of privacy to be more warm-blooded than cold-blooded, per your analogy.

    • Re: (Score:1)

      by Anonymous Coward
      This begs for a website to graphically show the Facebook temperature. It would feature a frog in a pot of water and a timeline showing various Facebook privacy SNAFUs. The timeline would default to now, but you could slide the frog back on the line to previous SNAFUs to see the graphic change to various different indications of frog discomfort. Someone needs to get to work.

  • We may not have AI yet... (Score:3)

    by RhettLivingston ( 544140 ) on Saturday February 17, 2018 @08:43PM (#56145118) Journal
    but the computer is apparently perfectly capable of being the fall guy.
  • It's not that some facebook system accidentally send messages that worries me. It's the fact that a random facebook system had access to a phone number given in the context of setting up 2FA. That tells me that facebook does not internally treat 2FA numbers as private and secure information.

  • What's that old chestnut? (Score:3)

    by QuietLagoon ( 813062 ) on Sunday February 18, 2018 @10:14AM (#56146836)
    It is easier to ask for forgiveness afterward than to ask for permission beforehand. A bug? Yeah, I'll buy that, and the Brooklyn Bridge. To go, please.

  • Bug? (Score:2)

    by Agripa ( 139780 )

    The bug was they got caught and someone fussed about it.

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Close