IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

The business of hacking your Facebook account

A step-by-step guide to how a criminal could pick up your email address and password - all they would need to get into an email or social networking account.

Scammers are moving away from email to social networks, taking advantage of insecure accounts to send real-looking scam messages.

But how are criminals doing this? Trend Micro shared an example of how an account is hacked from the original message a user will receive, to the point where the domain owner makes business by harvesting emails.

The Scam

First of all, a message is sent to a user on Facebook, MySpace, Bebo, or a similar social network. It says: "Did you know your profile pic is over gabblebase.com?"

If you click on www.gabblebase.com - it's not a malicious link, but you may get seriously annoyed by the fact it's difficult to get away from the page - you can follow the steps through with a fake identity to see how it works. One of the options you will get is to put a password for your pictures.

The tendency for some users is to use a common password for every site that they use. If a user opts for a password they use for the social network they were originally sent the message for, they've done three things: they've showed what social network they're on, given an email address, and given a password all you need to hack a Facebook or email account.

The fake site has a disclaimer claiming it will never send spam to your email address and is not a MySpace or Facebook login page, a clever way of making the user feel more comfortable.

Researching Gabblebase, Trend Micro revealed that it was linked to a server in Las Vegas run by someone called Adam Arzoomanian. He owns 423 domains in total, to avoid being blocked by filters.

The Business Model

Trend Micro revealed that the domain of the site was Chinese and called 'dreamstarmail'. The owners of the site now have all the details that they would need to enter a social networking or email account - and therefore send messages in an attempt to part users from their money.

Members who referred users to this criminal site also had the potential to earn money by taking a percentage of the profits the email harvesters made.

Trend Micro security advisor Rik Ferguson said: "This neat little social engineering trick is relying on users' habit of using common passwords, so now the criminal would have your email and your password. It's pay day."

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to incorporate password protection into your security strategy
Sponsored

How to incorporate password protection into your security strategy

3 Aug 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022
Facebook business accounts hijacked by infostealer malware campaign
Security

Facebook business accounts hijacked by infostealer malware campaign

26 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022