Re:I lost €4k in a Facebook scam
by GoblinSlayer on Monday September 14, 2020 @12:24PM
(#24472002)
You mean they extracted your primary full access token, not the generated restricted oauth token?
Re:I lost €4k in a Facebook scam
by londons_explore on Monday September 14, 2020 @03:17PM
(#24473975)
If your app has a webview in it, on both iOS and Android, you have full access to run script inside that webview and take/set cookies for any domain. You can easily take the auth cookie.
Some Google auth cookies can only be used on the same tls session that created them[1]. That means the TLS session resumption information (which can be tied to hardware platform features like the TPM) is required to make use of a stolen auth cookie. Unfortunately while that approach has big security benefits, it's pretty anti-user-privacy.
[1]: https://nakedsecurity.sophos.com/2018/10/25/could-tls-sessio...
Re:I lost €4k in a Facebook scam
by NiekvdMaas on Monday September 14, 2020 @01:04PM
(#24472481)
Yes, pretty sure. It wasn't an oauth screen but the actual FB login screen.
While you are absolutely right, I want to highlight that this was done in a quite sophisticated way. It's actually the real login page of Facebook in a webview. I have 2FA on all my accounts including FB, so it looked very legit. Once you have logged in, they seem to grep the token and close the webview.