{"id":59401,"date":"2016-04-20T09:03:35","date_gmt":"2016-04-20T07:03:35","guid":{"rendered":"https:\/\/www.easypromosapp.com\/blog\/how-to-prevent-your-facebook-account-from-being-stolen-a-case-study-and-four-basic-tips\/"},"modified":"2023-02-14T10:38:35","modified_gmt":"2023-02-14T09:38:35","slug":"how-to-prevent-your-facebook-account-from-being-stolen-a-case-study-and-four-basic-tips","status":"publish","type":"post","link":"https:\/\/www.easypromosapp.com\/blog\/en\/how-to-prevent-your-facebook-account-from-being-stolen-a-case-study-and-four-basic-tips\/","title":{"rendered":"How to prevent your Facebook account from being stolen: basic tips"},"content":{"rendered":"\n

The case<\/h3>\n\n\n\n

\u201cHello Easypromos. I know how to win all your Facebook voting contests. What will you give me if I tell you how?\u201d The user signed his email with a false name which didn\u2019t correspond to any user who\u2019d registered with Easypromos or participated in a contest. My colleagues in the technical development department took this email as a challenge and began investigating the case.<\/p>\n\n\n\n

The first thing they did was to analyze the email \u2013 in particular the headers, which included information regarding the IP address the message was sent from. This IP address was contrasted with the IP addresses of all users who\u2019d participated in contests via the Easypromos platform. One participant was located: he was from Portugal and he\u2019d won a photo contest by obtaining the most votes for his entry.<\/p>\n\n\n\n

In order to participate in that photo contest all participants had had to register using their Facebook account<\/b>. This made it possible for us to locate and analyze the public profile of this Facebook user. The profile was limited, owing to the user\u2019s privacy settings. However, some shared posts, mostly about surfing, were visible on the user\u2019s Timeline. Interestingly, the majority had been shared from a single website.<\/p>\n\n\n\n

\n

In order to streamline registration, participants were given the option of connecting their Facebook account via the standard Facebook login system, used for registration by many websites<\/p>\n<\/blockquote>\n\n\n\n

My colleagues then turned the focus of their investigation to the website. First they analyzed unrestricted public information, such as the website\u2019s domain name. The technical and administrative contact details of the domain name coincided with the name of the user in Facebook: the user was also the owner of the website.<\/p>\n\n\n\n

It appeared to be website about surfing, containing travel tips, users\u2019 experiences, opinions regarding equipment, and so on. It also included a forum, in which users asked and answered questions. In order to participate in the forum users had to register, and they were given the opportunity to do so using their Facebook account<\/b> via the standard Facebook Login system commonly used by many websites with registration. Users who registered using their Facebook account were identified with their Facebook name and profile photo.<\/p>\n\n\n\n

Our breakthrough came when my colleagues took one of the Facebook profiles listed in the forum and compared it with the list of users who voted for the winning entry in the photo contest. We found him: the forum member had indeed been one of the voters.<\/b> We picked another forum member and made the same comparison. One more, we discovered that the user had voted for the winning photo. We found the same pattern again and again. In fact, almost 100% of forum members had seemingly voted for the photo contest winner.<\/p>\n\n\n\n

Of course, it was possible that the user had merely used the forum, or sent its members a newsletter, to request that they vote for his photo. But then why did he write to us to say he\u2019d found a way of winning all our contests? Using a forum to ask members for votes might work from time to time, but it wouldn\u2019t be possible to this for every contest. Forum members would soon get fed up of being used in such a way. We decided to analyze the public profiles of those who\u2019d voted in the contest. We found that their profiles did not fit with the profiles of users who normally participate in our contests, and, furthermore, looking through their Timelines we couldn\u2019t find any instance of the winning photo being shared by these users.<\/p>\n\n\n\n

\n

We wrote to 20 users. 12 responded: none had ever voted for this participant.<\/p>\n<\/blockquote>\n\n\n\n

The next step was to get in touch with these users <\/b>to ask them directly via private Facebook messaging whether or not they\u2019d really voted for the winning photo. We identified ourselves using our personal Facebook profiles, making it clear that we formed part of the Easypromos team, and asked them directly whether or not they\u2019d voted for the photo. We wrote to 20 users. 12 responded, all saying that they\u2019d never voted for the winning participant.<\/p>\n\n\n\n

Our suspicions had been confirmed: this individual had used the profiles of members of his forum to vote for his own entry<\/b>. He was using their email addresses and passwords to log into their Facebook accounts and cast a vote in their names. How did he get their passwords? Well, many of them registered for his forum with the same password they used to access their Facebook accounts.<\/p>\n\n\n\n

We investigated further and discovered online tutorials, videos and documents giving ideas and techniques for stealing users\u2019 access data. In addition to the method that we\u2019ve outlined above, another common technique is Facebook Phishing<\/b>. This involves displaying a false login page which seems identical to the authentic Facebook login page. The victims, believing they\u2019re connected to Facebook, enter their email addresses and passwords<\/b> in an attempt to log into their accounts. However, in reality users are supplying their login details to the phisher behind the false webpage.<\/p>\n\n\n\n

Our four tips<\/h3>\n\n\n\n

How can you avoid having your Facebook access details stolen? Here are four tips:<\/p>\n\n\n\n

Change your Facebook password frequently<\/h4>\n\n\n\n

It\u2019s a good idea to change your Facebook password every 90 days for security reasons.<\/p>\n\n\n\n

If you use your Facebook account to register for a website \u2013 which then asks you to provide an additional password \u2013 don\u2019t use the same password as you use for Facebook<\/h4>\n\n\n\n

Facebook enables websites to give users the chance to sign up and log in quickly and securely, so that an additional password is not normally required. However, some websites might also request an extra password to complete the registration process. If this happens to you, make sure the additional password is not the same as your Facebook password.<\/p>\n\n\n\n

Always verify the URL and SSL certificate when connecting to Facebook<\/h4>\n\n\n\n

Facebook phishing is when users are deceived into trusting a fake version of the Facebook Login Page. This situation may arise when a user accesses the Facebook Login Page from an external link. When accessing Facebook from an external link we suggest you carry out the following checks to ensure you\u2019re not the victim of a phishing attack:<\/p>\n\n\n\n