Facebook Security Hole Due to Dumb User

 

A few days ago, I started receiving all kinds of strange notifications and friend requests in an account that I don’t use for Facebook. I started getting concerned because of the volume of requests. I wasn’t sure if this was a phishing scam or malware, but I was getting annoyed at the number of pieces of mail being generated. The owner had signed up as Why-do U-Care. The name alone made be wonder what kind of scam was about to happen.

Of course each of these had a link to whatever I was being notified about. So, first in a VM to be safer, I clicked one of the links (the source of the email message actually was a legit Facebook non spoofed header, but just to be safe…) and without any trouble at all, I was able to reset the password to this phantom account.

 

.Here is the password change email I received.

fb1

Now how this person signed up with one of my email addresses and was able to use the account for a few days without verifying that email address is troublesome indeed.

Anyway, I reset the password and logged in to the account to insure that there wasn’t anything else going on that impacted me. This is some guy in California. A really stupid one to boot.

Next I got a throw away email address elsewhere and added it to the account, verified it, then set it as primary and removed my own misused email address. I changed the account name to DoNot Use. I then attached the email address that *I* own to a different Facebook account that *I* own as a secondary address. (Not my main account). Verified it, etc.

I then went into Why-DO U-Care, now DoNOT Use account with the throw away account login and scheduled it for deletion.

I am now getting about six of the following an hour from Facebook that look like:

 

fb2

 

Each time I click the button didn’t initiate this choice. This joker keeps trying to claim MY email address.

Facebook has a problem, and there is a person out there that needs psychiatric help and needs to be restrained from using the Internet (or at least who needs to understand he just can’t make up any old email address).

Seriously, Facebook allowed me to access this account just by initiating a password reset because I happen to own the email address this stupid person used. There is a security issue here, and this person should have never been allowed to use the account without acknowledging an email sent TO the email address he was trying to use. If anyone knows anyone at Facebook, please relay.