Fb hacked? Wifi and laptop compromised?

[sec25]

Hello,

I could really use your help. I think my FB has been hacked.. I opened it and I was logged out which was unusual since I never am and I went to Settings and saw I was logged in from two different locations(both windows PC). I only use FB on one laptop, nowhere else. I think it said the other location had been logged in two hours before I was active. It said another city, but FB does that sometimes. I changed the pass and checked again and saw the same thing, this time a different IP address I think than the first login that wasn't me.(so, 2 PCs again)

I logged out of it and changed my pass and email pass later on.

What worries me is how they hacked my password.. It wasn't easy and I don;t think I had a security question and I live in the Balkans so I don;t think people here can just hack a password like that, but they can do other stuff. (I assume)
I had recently given my next-door neighbors my wi-fi pass (IDIOT) and I changed it a week later. My router pass and username was default..
My Q is: What can someone do with ones wifi pass? Can they access my mic/camera? That worries me most.. Is there anyway I could check this to put me at ease? I read about process explorer and seeing which programs or w/e had access to my mic/cam. Is this possible? Is there another way? How can I make sure?
I recently lost a loved one and I;ve experienced a lot of evil and I know there are people who really hate me out there.. twisted people..

Last Q: After having changed wifi and router passwords, did I 'kick out' whoever might have been snooping? Or was that not enough?

Tech Support Guy System Info Utility version 1.0.0.4
OS Version: Microsoft Windows 8.1 with Bing, 64 bit
Processor: Intel® Celeron® CPU N2840 @ 2.16GHz, Intel64 Family 6 Model 55 Stepping 8
Processor Count: 2
RAM: 3984 Mb
Graphics Card: Intel® HD Graphics, -2039 Mb
Hard Drives: C: 448 GB (395 GB Free); D: 16 GB (1 GB Free);
Motherboard: Hewlett-Packard, 2213
Antivirus: Windows Defender, Disabled

[DaveLembke]

If your router was flashed by a hacker with a blackhat version of the firmware for that router, then a password would not matter and they would be right back in. Its not common for this to happen though. If you changed the password to something complex and dont use the same password for other places then people should be locked out. However depending on the age of the router, some routers hackers can air-snort packets and figure out your wireless key and get in onto your network again, however they should remain locked out of making changes to the router as for a WEP key etc isnt enough to gain access to the settings for a router. Additionally if its someone hacking you by wifi then its a neighbor or wardriver and might be pretty easy to find the person given the limited range of wifi.

If your extremely worried and your router is an oldie then buying a new router and setting it up with a password different from the default is a sure way of keeping them out of the settings.

Mic and Camera on PC should be off limits to someone, but if you have a network attached MIC or Webcam then anyone on the wifi network would have access to these nodes that lack a firewall. The computers firewall should keep people out of turning on camera and mic.

Have you run a virus scan with up to date definitions and malwarebytes to make sure you dont have any keyloggers installed on your computer?

[sec25]

I don't know how I just saw this.. Thank you!!

1. How do I check if I have a network attached mic/cam?

2. I have recently purchased a new laptop(old one needed replacing anyways) and a router. So, I need to get this all done right, or I it will have all been in vain.

My questions are the following:
1. Is it enough to get a new PC and router to make sure eth is clean? I have ADSL as far as I know. Someone told me I could get a VPN to make sure as the network can be tampered with in other ways. ( I have no idea how. All that comes to mind are the cables and the phone when I think of my connection).
Would a VPN cover me completely if the network has been tampered with?
What could they have tampered with network wise, IP address wise or w/e that would not be solved by getting a new PC and router.

2. Another important Q is: If I don't have a different network and share a router with someone at home, is there anyway of making the shared router and my laptop secure from other devices also using said router?

A guest option you mentioned could be a solution? Can this possibly work for a connection via cable to the router also(for devices that aren;t mine and could possibly be infected), not just wifi? To make a guest option on my router for both wifi and cable connection to router from devices I don't personally use? By this guest option I would separate myself from other devices I don't use?

If not possible, can I have two routers on the same network(same IP address?) And would that work to keep my router and laptop secure or does sharing the same network impose a security risk anyways?

I assume each router would have their own passwords? Or is this only possible if they have different IPs?

Could a VPN possibly cover the dangers of a shared router?


Finally, is there ath else I should do to ensure a safe everything?


I really need assistance.. and I need to get this done really soon. All the insight you can give me and kind, thorough advice would be immensely appreciated.

[patio]

New router...

Change provider...

Done.

P.S.  Just cause yer paranoid doesn't mean they aren't out to get you...all this over a FB account ...
Just sayin.


BTW Defender is listed as dis-abled...that doesn't help either.

[BC_Programmer]

Personally this sounds like a case of being technically proficient enough to have an idea what is *possible* but not being able to properly evaluate the possibilities and eliminate the highly improbable. It is only when you eliminate the likely that you should even consider the improbable.


1. The additional login location

many online services provide a login framework that is accessible via Web API. Facebook is one of the bigger services that do so. You can login to Facebook to comment on blog posts, share posts, like them, or even just as a "login" for a web page. Those services are usually handled by one of their servers and will typically show up as an authentication. If the software using the API does it poorly it could log you out of active sessions.

The other login will appear to be from another computer in one of their nearby data centers and will be identified largely with information from your computer, such as OS.

This happens with services like Microsoft Accounts as well. I've seen "Sign in successful" security events which show on their map as being on the other side of the Country. But I was able to trace it down to specific times that I was using my MS Account- eg to sign into OneDrive or other services.

2. Continuing to show it after changing password

Changing a password doesn't always deauthenticate already logged in sessions, and even if it does, there are typically "protections" internally to prevent internal API-controlled "Logins" from being deauthenticated when a password is changed, at least until that session is ended.