(Sysadmins, scroll to the bottom for a list of domains to block). There’s a scam making the rounds on Facebook, making use of Facebook Messenger to spread. I've updated the post with a few additional domains to block, and to show the different behavior on mobile versus PC. The attacker then diverts the SMS containing a one-time passcode (OTP) to their own computer or phone, and can gain access to the target's Facebook account.Updated 20-March: My initial analysis was limited due to traveling without my laptop, and with unreliable data service. Now, when asked for a phone number or email address linked to the target account, the hacker needs to provide the legitimate phone number. The attacker first needs to click on the 'Forgot account?' link on the homepage to reset your password. The designing flaws in SS7 have been in circulation since 2014 when the team of researchers at German Security Research Labs alerted the world to it.

SS7 has long been known to be vulnerable, despite the most advanced encryption used by cellular networks. The researchers from Positive Technologies, who recently showed how they could hijack WhatsApp and Telegram accounts, now gave the demonstration of the Facebook hack using similar tricks, Forbes reported. So, malicious hackers could trick SS7 into diverting text messages as well as calls to their own devices.Īll they need is the target's phone number and some details of the target's device to initiate the silent snooping. However, an issue with the SS7 network is that it trusts text messages sent over it regardless of their origin. SS7 or Signalling System Number 7 is a cell phone signaling protocol that is being used by more than 800 telecommunication operators worldwide to exchange information with one another, cross-carrier billing, enabling roaming, and other features.

Messenger com login password