4 Methods Hackers Use to Steal Facebook Passwords

Despite numerous security incidents over the years, Facebook remains one of the most popular social networks, with its user base continuing to grow. As of December 31, 2017, Facebook had 2.13 billion monthly active users and about 1.4 billion daily users. Facebook has become a significant part of our lives—we share birthdays, anniversaries, vacation plans, current locations, and even personal milestones and struggles. There are even books written by clinical psychologists detailing the impact Facebook has on our emotions and relationships.

However, we often forget that we are being watched. While we use Facebook to connect with friends, there are people who use it for malicious purposes. By sharing information, we may be giving away details that can be used against us. Hackers can learn when we’re not home, how long we’ll be away, and even answers to security questions, all from the information we willingly post on our profiles.

The more technology becomes part of our lives, the more vulnerable we become. Even if you don’t share everything publicly, someone with enough motivation can fill in the gaps and gain access to your email or Facebook account. In fact, you don’t have to be a professional hacker to break into someone’s Facebook account. Sometimes, it can be as easy as installing a browser extension like Firesheep. Facebook even allows account recovery without knowing the password by using codes sent to three friends. In this article, I’ll show several methods hackers and even regular people use to access Facebook accounts, along with tips on how to protect yourself from each method.

Method 1: Password Reset

The simplest way to access someone else’s Facebook account is by resetting their password. This method is easier if you’re on the victim’s friends list.

1. Find the email address used for the victim’s Facebook account (often listed in their profile’s contact section). Hackers use tools like TheHarvester for this. More details can be found in this guide.
2. Click on Forgotten account? and enter the victim’s email. When their account appears, click This is my account.
3. When asked if you want to reset the password via email, click No longer have access to these?
4. Enter an email address you control (it must not be linked to any Facebook account).
5. You’ll be asked a security question. If you know the victim well, you might be able to answer it. If you answer correctly, you can change the password and log in after 24 hours.
6. If you can’t answer the question, click Recover your account with help from friends. Select 3–5 friends to receive codes, which you’ll need to enter to regain access. You can either create fake accounts and add them as friends or ask real friends to share the codes with you.

How to Protect Yourself:

• Use a unique, private email address for your Facebook account.
• Choose a security question with an answer that can’t be guessed from your public profile. Avoid pet names, anniversaries, or teacher names.
• Select three trusted friends for account recovery, so random acquaintances can’t help reset your password.

Method 2: Keyloggers

Software Keyloggers

A software keylogger is an application that records every keystroke made on a computer without the user’s knowledge. The attacker must first install the keylogger on the victim’s computer. Once installed, it runs in the background and can send the collected data to the attacker’s email.

For more information, check out this guide on installing a keylogger. You can also find free keyloggers or even write your own in C++.

Hardware Keyloggers

Hardware keyloggers work similarly but require physical access to the victim’s computer. The attacker plugs a USB device between the keyboard and the computer, which records all keystrokes. Later, the attacker retrieves the device to access the data. Some models, like Keyllama, work on any operating system. There are also Wi-Fi-enabled keyloggers that can send data wirelessly.

How to Protect Yourself:

• Use a firewall to monitor network activity and detect suspicious behavior, as keyloggers often send data over the internet.
• Install a password manager, which fills in forms automatically without using the keyboard, making it harder for keyloggers to capture your passwords.
• Keep your software up to date to patch vulnerabilities.
• Change your passwords regularly—every two weeks if you want extra security. This way, even if your password is stolen, it quickly becomes useless.

Method 3: Phishing

Phishing is more complex than the previous methods but remains one of the most popular ways to steal Facebook accounts. The most common phishing attack involves creating a fake login page that looks identical to Facebook’s. The attacker sends the link to the victim, who enters their credentials, unknowingly giving them to the attacker. Creating a convincing phishing page requires some technical skill, including setting up web hosting and cloning the Facebook login page. For more details, see this guide on website cloning.

How to Protect Yourself:

• Never click suspicious links in emails. Always check the URL before logging in, and if in doubt, go directly to the Facebook website.
• Phishing links can also be sent via websites, chats, text messages, or even pop-up ads. Never enter confidential information on suspicious pages.
• Use antivirus software and web protection tools (like Norton or McAfee).

Method 4: Man-in-the-Middle Attack

If an attacker is physically near the victim, they can set up a fake Wi-Fi network to intercept login credentials. Tools like Wi-Fi Pumpkin allow hackers to create fake Wi-Fi hotspots using a wireless adapter and a Raspberry Pi. Once the victim connects, the attacker can analyze traffic or redirect them to a fake login page.

How to Protect Yourself:

• Never connect to open or unencrypted Wi-Fi networks.
• Be especially cautious with networks outside public places. For example, a network named “Google Starbucks” is suspicious if there’s no Starbucks nearby. Hackers can use previously collected data to trick your device into connecting to a fake network.
• If you have trouble connecting to Wi-Fi, check for duplicate network names in your area.
• If your router asks for a password to enable the internet or displays a page with many grammar mistakes, you may be connected to a fake hotspot.

Additional Hacks

Advanced users can explore guides like Same Origin Policy Facebook hack and Facebook Password Extractor (the second method is a bit easier).

How to Protect Yourself:

• In your Facebook account settings, enable Secure Browsing (HTTPS). Tools like Firesheep can’t intercept cookies if you use secure protocols.
• Always use SSL. Install browser extensions like HTTPS-Everywhere and Force-TLS for Firefox.
• Log out after using Facebook. Firesheep can’t maintain a session if you’ve logged out.
• Only use trusted Wi-Fi networks. Hackers can sit in a nearby café and access your data without your knowledge.
• Use a VPN to encrypt all your traffic. Even if someone intercepts your data on a fake Wi-Fi network, they won’t be able to read it.

Conclusion

Social networks help us stay in touch with old friends and meet new people. With just a few clicks, you can create events, send greetings, or express your feelings to loved ones. Even though there are ways your account can be hacked, as described above, you can still use social networks safely by taking certain precautions and thinking twice before posting personal information. The less you share, the harder it is for hackers to access your account.

If your Facebook account is ever hacked, follow the steps in this guide to recover access.

Author: Nelson Aguilar