Hello!
Previously, Roblox Username LuaClass made a post on how attackers have been abusing a flaw in Roblox’s account recovery flow that allows them to permanently change how account recovery works after gaining unauthorized access to a Roblox account.
Despite this issue being marked as fixed, it unfortunately isn’t. I have suspicions that my friend has fallen victim to this exploit as they state that attempts at recovering their compromised account, Roblox Username qroqifqfqcni, have been unsuccessful because the system has wiped out all information required to recover the account (including the ability to come to support with the user’s original email).
(If support detects something off in the account recovery process, they seem to bar you from future support requests, resulting in the user having their account permanently lost.)
From all of the following information we’ve gathered, what the attacker can do to the victim’s account is as follows:
Users Who are NOT ID Verified:
If a user who is currently NOT ID Verified gets their account hacked, the attacker will attempt to swap out all information as usual and later find a way to remove 2FA from their account (2FA email, 2FA app, etc.) via support or any other method that will disable it and (not notify the victim once the swap has been done).
When changing the account’s DOB under a certain age, it appears that it will reset crucial information and make it impossible for the original owner to gain access to their account. DOB is not accessible with ID verification, which is why the attacker will move on to the second step:
Users Who ARE ID Verified:
If a user who IS currently ID Verified and gets their account hacked, the attacker will remove the existing ID verification by resetting it (as Roblox allows you to do this twice). From what I have discovered when resetting ID verification is that it does not prompt the user with 2FA or any security method, allowing attackers to reset your verification without issue. My belief is that the only way to prevent this is by verifying your ID twice, and thus, completely shutting the door out for a reset. However, this poses the risk of having the wrong age attached to your account.
Below, I’ve attached an image of how it looks to reset your ID verification. Keep in mind that anyone who has access to your account can do this without security prompts.
Once this method is done to the victim, the user is helpless as it prevents them from ever getting their account back as support is automated, and if denied, can’t do much (or if the self-serve doesn’t work, they can’t do anything as well). This buys time for the attackers to sell off any valuables in the account. Since trading hold exists, it also motivates them to lock people out of their accounts via this method.
Below is what will happen if you try to go to support with a DOB locked account.
This vulnerability abuses COPPA laws, but if the original owner has the details to their account, they should still have the right of access to support. This exploit has impacted dozens of accounts (to my knowledge) which are otherwise completely secure, including my friend.
Expected behavior / conclusion:
Attackers should not be able to lock people out via changing crucial parts of their accounts, such as DOB. Additionally, other methods of disrupting account recovery could be mitigated by reducing trade hold times or making it harder for attackers to reset information.
If any staff member can look into this issue as well as the issue that prevents my friend from verifying ownership, it would be greatly appreciated. Hopefully, sharing this can shed some light to the issue and prevent future attackers from abusing this method and overriding information crucial to recovery.
References:
Thank you.