Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?

Question

Recently Facebook was hacked with 50M accounts compromised.

I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended.

I'm writing in reference to your Information Security Stack Exchange account:

I wanted to let you know that we've observed some rudeness in your latest activity. We get it; anyone who's ever tried to engage with others online has probably been tempted to lash out at someone else. This is just a friendly reminder that we require all participants to act in a professional and civil tone when using these sites. If another user has wronged you in some way, please do not respond in kind. Simply flag the content for moderator attention and move on.

If this is a simple misunderstanding, no harm done. Sometimes it is helpful to remind ourselves on occasion that keeping things friendly and constructive doesn't have to be at odds with being right — so enjoy the site, bring your sense of humor, and please be tolerant of others who may not know everything you know.

We have temporarily suspended your account; you may return after 30 days.

Regards, Information Security Stack Exchange Moderation Team

I haven't been on Information Security in months. My latest comment was in February.

Can a hacker who hacked Facebook log into a linked Information Security account and suspend other accounts, edit the questions to point to malicious URLs, or delete content?

Could a moderator of one Stack Exchange site see content that a user wrote on another Stack Exchange site, and suspend the account on the Stack Exchange site they moderate in retaliation? (This happens on Reddit.)

I really have no idea what if anything I said, and I really doubt I said anything at all. I really think the system has been compromised.

I can't even ask on Meta Information Security because it says I need 5 reputation now:

You must have at least 5 reputation on Information Security Stack Exchange to ask a question on meta, but you may ask a question about your own Information Security Stack Exchange post specifically.

Answer 1

Can a hacker who hacked Facebook log into a linked Security.StackExchange account and suspend other accounts, edit the questions to point to malicious URLs, or delete content?

That's kind of the point of going in and changing your password and re-securing your Facebook account if your login information was compromised - so that people can't login to your account and do anything they want as you. We have absolutely no way of knowing if your particular account is secured or compromised on our end - Facebook is the one that does all the authentication on their end and then sends you back to us with a "yep, this user checks out" message to verify the login. If anything, we would have to rely on Facebook to simply disallow further OAuth logins using your account until it's been resecured.

As far as destroying things, they'd have a hard time completing much of anything unless they happened to get into a moderator's account. A lot of things are rate-limited to prevent abuse (e.g. you can only delete so many of your own posts in a singe day). And no matter what malicious things they're doing, they're likely to get spotted doing them very quickly and get the account suspended until things get figured out.

Could a moderator of one exchange see content that a user wrote on another exchange, and suspend the account on the exchange they moderate in retaliation?

Moderators by default cannot see anything that their regular permissions don't allow them to see on any sites where they're not a moderator. However, moderators can and do share information about users who are causing problems on multiple sites at the same time, in order to make determinations of whether a user's behavior might be consistently appearing across the network. This kind of conclusion often leads to them escalating the situation to the Community Team for further network-wide review.

---

As far as your specific case, there isn't any evidence that your account is compromised. The offending comment was posted from your account using the same IP address you always access the site from, so at worst, you left your computer unattended and someone posted something. If you'd like more detailed information, use the contact form - I'm not copying that comment here.

Answer 2

Yes, they can.

https://twitter.com/jpolakis/status/1046086964410294272

There are many nuanced and not-so-obvious issues that arise due to how Single Sign-On functionality interacts with local account management on 3rd parties (referred to as relying parties in the context of SSO). Facebook's current actions do not prevent these attacks (2/n).

Another very critical yet overlooked problem is that the stolen tokens can be used to obtain access to a user’s account on other websites that support Facebook SSO even if the user doesn’t use Facebook SSO to access them. This depends on 3rd party implementations. (6/n)

Depending on how a site implements local account management, in some cases attackers can gain access to users' 3rd party accounts that haven't been associated with their FB account. In other cases the attacker is simply presented with a new account (under the user's name). (7/n)

While not applicable here, 3rd parties can "instruct" FB during SSO to make users first re-login w/ their password (thus preventing attacks using stolen cookies and not passwords). We found that the vast majority of 3rd parties do not “instruct” FB to make the user re-login (8/n)

More importantly, once attackers gain access to those 3rd parties, they can maintain access to user accounts in those websites using the cookies set by those sites. No matter what FB does, they can’t do anything to prevent attackers’ from accessing those accounts. (9/n)

In a less obvious attack, we demonstrated how attackers can use the FB token to create accounts for the user on websites where they don’t have an account already; this could be used for a variety of attacks from spam/phishing to identity-related scams. (13/n)

More surprisingly, attackers can set a long-term trap and wait for users to create an account on those sites and start using them in the future. For instance, attackers might be particularly interested in the user data or account functionality offered by popular website X. (14/n)

Even if the user doesn’t have an account on X, attackers can create the user’s account on X using FB SSO, and wait for the user to join X in the future. Given the nature of SSO, the pre-existence of that account won’t be apparent to the user upon joining. (15/n)