Part 1 here

Continuing on from the Part 1 story, not long after I saw this story from Linus Tech Tips – they’d been hacked and although that’s on YouTube and I just lost my personal Facebook account, they sound like the same issue. This is worth a watch to understand what’s going on, if you think because you’ve got 2FA set up, you’re completely safe:

I still don’t know exactly what happened, but my cookie being hijacked made sense based on what I saw on the access logs – the same browser cookie used for auth that I’d used many months before, but no new login attempt, no MFA hacks etc.

Facebook have the same issue as YouTube – there is no MFA challenge when you change something major about your account, like your display name. It would make sense to do so when major profile changes are made, but they don’t.

Beyond that, logging onto Facebook today I saw an alert about my other profile – which was my taken over one but the browser was still aware (the account wasn’t deleted, purely completely blocked/disabled by Facebook). I’d also note here that I didn’t receive any email or other alert,

I thought I’d log back onto the account out of intertest, and was presented with a different screen:

This sounded like I might be able to get the old account back – so going through the process was purely a SMS code to type in based on my saved phone number, asking me if the phone number/email addresses were correct, then kicking of a bot who’s also a doctor seeing what actions might have been done under my account:

Strangely, this bot who I don’t believe actually is a qualified doctor, came back to tell me nothing was changed on my account:

Ah, I must have always been Lily and not realised it… even though the downloaded logs showed that was the last change on my Facebook account. If this system can’t detect that, it’s already failed.

Those Extra security settings were purely to get notifications and emails if my account is ever logged on at a new device – not a terrible thing, but probably not going to save me at 1am.

I really don’t want my old profile now anyway, but it has let me easily delete the Facebook Page I had for ‘Adam Fowler IT’ so that’s now gone.

I was considering maybe reviving the old account, but I couldn’t even change the name back because I’d changed it in the last 60 days.

Also, there might be something historical I want to get from the account, and although I have everything downloaded, it’s a bit of a pain to go through so rather than deleting the account, I changed the account profile photo to ‘do not use’ and deactivated it.

Overall, I’m still very unimpressed over the entire process, and the above continues to prove how even one of the most valuable companies in the world still gets this stuff so wrong.

And I couldn’t recover it.

A few weeks ago, I woke up to look at my phone, opened the Facebook app and saw someone else’s account flash up, which then changed to a message saying that my account had been de-activated due to breaking community standards. I first thought ‘this isn’t even my account’ but upon logging out and in, I soon came to the realization that it was actually my account.

This also affected Facebook Messenger, which I could no longer access. Others could see my account in chats, with it’s new name ‘Lily’ and profile picture (which on doing a reverse Google Image search, I found was a very popular fashion influencer – and not the potentially breaking community standards type).

Facebook had an option on signing in for me to request the decision to be reviewed. As it seemed like it was a pretty cut and dry case where someone had somehow accessed my account, I followed that process. The process sounds like a scam in itself but is an actual thing they do – first I had to take a photo of myself and upload it, then take a photo of some sort of ID and upload that too. After that, the automated Facebook system told me to wait for the results of that review.

Only an hour or so later I logged back in to check, and saw this message:

I’m going to conclude that their review process isn’t very thorough, or they’ve automated it and it’s come back in the negative for some reason. Although I don’t expect much of Facebook, I did expect to get my account back, but that was a dead end. I didn’t really care about my Facebook account too much – I was really just using it for Messenger, as well as Facebook Marketplace and some local news/events stuff. Creating a new account didn’t take long and got me back to where I needed to be.

I was still curious on what happened – I was using a unique email address and password for Facebook, and 2FA was configured; any time I’d log onto a new device I’d get an existing device to prompt via the Facebook app to authenticate. I used the ‘Download Your Information’ button above, which took several hours to be ready and give me some download links.

The 3 ZIP files Facebook provided contained quite a large amount of information – it’s interesting to see how much data they actually keep about your activities – too many to list, but some examples:

“Advertisers using your activity or information” (list of thousands)

“Your off-Facebook activity” (thousands again, example – Menulog feeds back searches, purchases etc)

“IP Address Activity”

That’s when I became ‘Lily’.

Interestingly, “Authorised Logins” shows no logins from this IP, but there is a record under “Session updated“

Unsurprisingly the IP appears to be a VPN endpoint. I’m no cyber expert, but appears someone potentially obtained a cookie off me to gain access judging by the first 4 characters, as the logs show I first used it in April 2022.

The other biggest ‘loss’ I had from losing this account was any other service I used that I’d done the lazy thing of using my Facebook account to set up access, rather than creating an individual account. One I knew I’d done this with, I could luckily follow a reset password process using the email address I used for Facebook.

I also lost control of my Facebook page where articles from here were posted – there’s probably a way to take this over, but having a quick read it requires uploading your ID, and that didn’t go to well so far.

I still haven’t been able to exactly work out how access was obtained, or what was actually done with the account to breach community guidelines (maybe just impersonating someone famous was enough) despite having all these logs. I’ve gone through chats, page likes etc and could not see anything suspicious.

The biggest lessons learned I can pass on from this is – realise that you may lose your Facebook account at any time, and despite doing the right thing and being able to prove you are you, not be able to recover it. Also, don’t be lazy and use that account to access other services if the other service can let you create an account in another way (ideally email + password + another authentication factor). If you are concerned about what Facebook might be gathering for you, follow their instructions on how to download your data – it gets presented in a nice HTML front page to dig through.

Also – if you post on social media about your account being hacked, a bunch of bots will respond and recommend services to get your account back. Ignore these.

Update: Check out Part 2 where I get the account back.

Do you have a car?
Does it have Android Auto?
Does it only support wired connections and not wireless?
Do you use an Android phone?
Do you like dongles?

If you answered ‘yes’ to all of those questions, then this is the product for you.

I’ve been using the MA1 for about two months. I’ll start with the “Before MA1 Time”:

My new car had Android Auto support, but only via USB plugged in via the middle console of the car. I had high hopes for using Android Auto, particularly for mapping as I’d be confident it’s better than any car’s build in GPS and map solution; but jumping in the car and having to plug the phone in every time is a pain. It might sound like a small pain, but it’s enough to not bother – getting the phone out my pocket, docking it in a phone holder and plugging the USB-C cable in is enough, but then there’s the 20-30 seconds it takes to detect and start actually working. I slowly did this less and less, until I’d only go through it when I had a new destination to go to and knew that before getting to the car.

This has a few negatives, partly the mixed experience in navigating the car’s entertainment system depending if I was plugged in or not, but also not having the benefits of Google Maps telling me where there were delays on each trip and suggesting alternate paths (which comes in handy driving to work where there’ll be an inevitable daily car crash somewhere, holding up traffic).

---

Enter the Motorola MA1 Wireless Car Adapter For Android Auto™. A small enough dongle designed to make a wired only Android Auto car, wireless. It does what it says on the box, and very simple to pair via Bluetooth and get started with. Once paired, there’s nothing to do – I get in the car, turn it on, and within 10 seconds Android Auto is up and running with my phone still in my pocket.

This means I can do things like quickly scroll to the address of work as I take off in my car and get those traffic benefits. Or, I can control my Podcast app and pick a different item to listen to (legally – my car blocks the touch screen when the car is moving, but allows dial/button controls which I can do at red light).

Answering and making calls was already fine by normal Bluetooth – it’s probably easier to look up contacts now but I’d normally use a Google voice command to call someone anyway. No real difference there.

The only negatives I can call out about this device are that the cable between USB port and dongle is a bit stiff and can’t be twisted – if inconvenient though, I’m sure a USB extension cable would work to get the dongle in a preferred location. The second is that because it’s now running via Bluetooth, I do have a rare occasional dropout and I think it’s actually when I drive in a certain physical location near a hospital; possibly something’s getting in the way of Bluetooth itself. It does take about 20ish seconds to recover, but will do so without having to do anything but wait.

I purchased mine via Telstra Plus Rewards with some points that were going to expire, but you can also buy via Amazon.

Worth checking out for those that answered ‘yes’ to all those questions at the start – it’s a lot cheaper than getting a new car with wireless Android Auto.