About 30min ago someone or some-bot posted a spam album to my FB account;Additionally they;- Accepted all pending Friend requests- Opened up Privacy Settings- Tagged all Friends into the spam postsI've since cleaned it all up, de-authorised all active sessions, changed password, enabled 2FA and login alerts.I'm currently trying to figure out exactly how my account was compromised, suspect either;- Password compromised through Facebook brute force attack (password was relatively strong and unique)- Rogue Android app interfering with Facebook App (Android 4.4.2 rooted)- Facebook CSRF or XSS vulnerabilityMy PC's, email and networks are pretty locked down (don't use public Wifi etc) so don't consider those as a point of access.FB access log shows a suspicious login from a Sydney based IP (110.33.216.187) on Dec 18.
↧