Facebook has security problems

So... I'm just about to wrap up a long day after patching some reluctant servers and picking up some other work while waiting on them when an old friend pops into FB Chat and sends a greeting. "Wow", I think, "Good to say hey but it's getting late, I hope this can be somewhat quick."

Then the chat unfolds and I quickly realize that Facebook still hasn't closed the security hole that allows this group to hack accounts, chat up "friends" about "being stuck in London after being mugged at gunpoint last night" The story is always the same, it was scary, nobody was hurt, they took phones, wallets, credit cards, & money but not PASSPORTS! They still have passports and plane tickets but need cash sent ASAP to pay off hotel bill and get a cab to the airport.

The interesting thing is that this has been going on within FB for over a year. I chat with them to keep them busy and see what lines I can feed them to test what they'll "accept" as true when I know it's not. I've made up relatives in London of the person whose account was hacked, gave away names at the US Embassy, and asked why they didn't ask me for the keys for my place in London City. Only once did the perp pick up on my stringing along and amazingly he didn't just drop me, he decided to curse at me via FB chat. If it kept him from hitting one gullible/overly caring person then my job was done.



Beware - FB has a serious security hole that has not been acknowledged. There have been unsubstantiated reports that an FB app partner had their user bank and passwords stolen. Be safe, use a password on FB that you do not use anywhere else. Change it every 6 months or so. But most of all, don't go running off to Western Union to wire cash to that "friend" that is stuck in London unless they'll give you the Hotel phone number so you can call them and verify the truth first (who knows, someones friend might actually get mugged in London the night before they're supposed to fly out and not have anyone else to turn to)



Below is our "chat" from this evening/early morning:





1:17am Eric Hi How are you?



1:17am Me hey there! Having "fun" finishing some patches



1:17am Eric not too good at the moment



1:18am Me well, up at this hour - it's not usually good stuff. Work or personal?



1:18am Eric personal We are stranded in london,england and we need help flying back home



1:18am Me really? (at this point I knew it was a scammer)



1:19am Eric yes We got mugged at a gun point last night cash, credit cards and cell phone's were stolen



1:20am Me bummer everyone ok?



1:21am Eric yes we are all ok and thank God we are still alive



1:21am Me Which airport are you trying to get out of?



1:22am Eric Heathrow return flight leaves tonight but we need some money to pay off the hotel bills and also get a cab to take us to the airport So i was wondering if you could help



1:24am Me checking



1:24am Eric all we need is 1000pounds



1:26am Me got better - Delta flight 5 out of Heathrow has 4 seats open - just you, wife and kids? (this doesn't describe this friends family - testing the scammer....)



1:26am Eric yes We still have our passports and plane tickets so don't bother about it We just need to clear the hotel bills and also get a cab to take us to the airport



1:27am Me You mean you didn't stay at your Dad's place? (His Dad doesn't have a place in London that I know of but the scammer doesn't know either...)



1:27am Eric what?



1:29am Me what, what? He didn't sell the loft since last year did he?



1:32am Me E?



1:33am Eric is offline (I either ticked him off or his activity triggered something in FB security - either way this was a much briefer encounter than previous ones. Maybe FB will secure their system before I get to have 'fun' again?)