Developer Loses Single-Letter Twitter Handle Through Extortion 448
Hugh Pickens DOT Com writes "Naoki Hiroshima, creator of Cocoyon and a developer for Echofon, writes at Medium that he had a rare one-letter Twitter username — @N — and had been offered as much as $50,000 for its purchase. 'People have tried to steal it. Password reset instructions are a regular sight in my email inbox,' writes Hiroshima. 'As of today, I no longer control @N. I was extorted into giving it up.' Hiroshima writes that a hacker used social engineering with Paypal to get the last four digits of his credit card number over the phone then used that information to gain control of his GoDaddy account. 'Most websites use email as a method of verification. If your email account is compromised, an attacker can easily reset your password on many other websites. By taking control of my domain name at GoDaddy, my attacker was able to control my email.' Hiroshima received a message from his extortionist. 'Your GoDaddy domains are in my possession, one fake purchase and they can be repossessed by godaddy and never seen again. I see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise? access to @N for about 5 minutes while I swap the handle in exchange for your godaddy, and help securing your data?' Hiroshima writes that it''s hard to decide what's more shocking, the fact that PayPal gave the attacker the last four digits of his credit card number over the phone, or that GoDaddy accepted it as verification. Hiroshima has two takeaways from his experience: Avoid custom domains for your login email address and don't let companies such as PayPal and GoDaddy store your credit card information."
the moral of the story (Score:5, Insightful)
like so many other articles, this just seems like another reminder to never ever use godaddy
Re:the moral of the story (Score:5, Insightful)
like so many other articles, this just seems like another reminder to never ever use godaddy
Perhaps this is more of an indictment of using ANY non-big-brother email provider for login information to ANY domain registrar. It seems to me the crux of this attack was to a) gain access to the victem's domain registrar account and then b) hijack the domain MX record so all email to that domain goes to the attacker's server. At that point, you can reset all the victem's passwords to all accounts and ALL password reset emails will go to the attacker.
Time to enable 2-factor on all my registrar accounts.
Re: (Score:2, Insightful)
gain access to the victem's domain registrar account
Sometimes I hate not being able to spell :(
Re: (Score:3)
What kind of moron spells the same word the same way, twice in a row? Doesn't he have any imagination?
Re:the moral of the story (Score:5, Insightful)
Two-factor probably wouldn't have helped here. They reset the account credentials, assuming the owner lost the ability to log in. That would have included resetting any "2nd factor."
I don't think any action on the user's part would have helped any of this other than maybe his comment about the TTL on the MX record.
Re: (Score:2)
Re: (Score:3)
You can use gmail with your own domain name. It used to be free (and still free if you got grandfathered in). There are good reasons to use your own domain name with out without gmail. Most notably it looks more professional and you can actually have a very nice looking email instead of @gmail.com I have @.com, and my last name is 4 letters. It can also be more secure if you provide smtp access over ssl for your organization and so email within your own domain is usually fully encrypted while going over the
Re: (Score:3)
I run my own email server, so adding Google into the mix lengthens the chain of trust, not shortens it.
Of course, a registrar would probably be less likely to be socially engineered to changing the domain ownership of gmail.com than my domain, but I do use a good registrar (gandi.net) and do have two-factor auth turned on.
Re:the moral of the story (Score:5, Funny)
Re: (Score:3)
Time to enable 2-factor on all my registrar accounts.
No, time to use a registrar that does not use untrained idiots for customer support. This would not have happened at SafeNames. Of course, SafeNames is more expensive than GoDaddy. But if you are protecting a business asset worth over $50k, you do not worry about a few bucks a year.
Re:the moral of the story (Score:4, Insightful)
Or paypal? IMHO they're the ones who enabled the entire operation here. They gave away the last four digits of the guy's credit card to a stranger...
Granted, godaddy should have required a photo id as well.
They're both rubbish.
Re:the moral of the story (Score:4, Insightful)
They gave away the last four digits of the guy's credit card to a stranger...
I'm not going to defend paypal, but the last 4 digits are generally considered safe to identify a distinct credit card without sharing enough information to allow identify theft. That godaddy accepted the last 4 digits as proof of ownership is far more disturbing than that paypal probably asked 'will this be using the card ending with "1234"?' while the scammer was digging for info.
Still, I've been avoiding paypal since I got over my old ebay habit. [cue Weird Al song]
Re:the moral of the story (Score:5, Insightful)
Seconded. Pretty much everyone throws around the last four indiscriminately - hell, they're sent unencrypted in pretty much every order receipt emailed by anyone in the world. Using them for authentication is extremely stupid.
Re:the moral of the story (Score:5, Insightful)
They gave away the last four digits of the guy's credit card to a stranger...
Not to defend PayPal, but the last 4 digits are often not treated as particularly secret. They put it on your credit receipts, many sites show them to help you figure out which card you have registered with them... Yeah, PayPal shouldn't be giving it out, but GoDaddy really really shouldn't be using it as some sort of ID verification. One of these is kinda dumb, the other is weapons-grade dumb.
Re:the moral of the story (Score:5, Informative)
They gave away the last four digits of the guy's credit card to a stranger...
Not to defend PayPal, but the last 4 digits are often not treated as particularly secret. They put it on your credit receipts, many sites show them to help you figure out which card you have registered with them... Yeah, PayPal shouldn't be giving it out, but GoDaddy really really shouldn't be using it as some sort of ID verification. One of these is kinda dumb, the other is weapons-grade dumb.
I know it's common practice, but it really shouldn't be -- the last four digits of your credit card number are really 3 digits plus the Luhn check [wikipedia.org]. That means that with that string, you can test out all the number combinations and arrive at a significantly narrowed set of possible credit card numbers.
Take for example American Express -- the first 4 digits are known (they're the card ID). If you give away the last four digits, that's 3 digits and Luhn. That means that you now have only 8 unknown digits, and they have to be in a permutation that totals with the other 7 digits to the proper Luhn total. In effect, this means that you can also reliably guess the 5th and 12th digit (as they're paired with the known digits and have an extremely limited set of permutations for the remaining 6 -- only a few hundred for in-my-head calculations.
That may still sound like a lot, but it means that if you have access to the last four digits of 1,000 cards, you're likely going to get the correct card number on the first try on a significant portion of them.
Summary: the last number of a credit card shouldn't be given out, as it tells a lot more about the entire number than it appears at first glance.
Re:the moral of the story (Score:5, Informative)
I know it's common practice, but it really shouldn't be -- the last four digits of your credit card number are really 3 digits plus the Luhn check. That means that with that string, you can test out all the number combinations and arrive at a significantly narrowed set of possible credit card numbers.
It doesn't matter where the check digit is, the fact that it exists changes a 16 digit number into a 15 digit one. (And AMEX is an exception, they're only 15 to start with.) I can give you three digits and the "check" and you will need to guess the other 7 (because one of the 8 is constricted by checksum), or I give you four digits and you guess 7 more and calculate the check.
Once you have the bank and the last four, it is still 7 you get to guess at and the 8th is still limited by having to meet the check.
but it means that if you have access to the last four digits of 1,000 cards, you're likely going to get the correct card number on the first try on a significant portion of them.
One in 10 to the 7th power for each one, right on the first guess, assuming you know the first four from the bank for each one. Let's see, the chance of getting it wrong is 1-1e7, so getting all 1000 wrong is (1-1e7)^1000. I get 0.99990. Very close to 1, but about 1/10,000. Odds say you won't get any of them right on the first guess.
And of course, now that I look up the actual Luhn algorithm [wikipedia.org] it is clear that giving you the check digit actually doesn't help you as much as giving you one of the real digits would. If you have to guess 8 digits that match the check I've given you, you will get false positives for all the failure modes listed in the reference, but if I give you an extra digit you'll have one less digit to get wrong.
Re: (Score:3)
No, this was a clear violation of CPNI. They either needed to confirm his identity via physical photo ID or his password/Pin over the phone. If they gave ANY information about his account at all, even the fact that he had one, without the Pin/Password they violated CPNI and their fines will be substantial.
Now if his Pin was something stupid like his birthday, well that's his own fault.
Re: (Score:3)
This could quite possibly be a PCI violation.
Re: the moral of the story (Score:2)
Re: the moral of the story (Score:5, Insightful)
But they are cheap.
Re: (Score:2)
Many other registrars are inexpensive too like NameCheap and Gandi and BigRock.
Re: (Score:2)
But not the cheapest. 1and1.com is just as cheap if not cheaper and their website is a lot more professional. Godaddy feels like you are on a malware site.
Re: the moral of the story (Score:5, Insightful)
Re: (Score:2)
The moral is to not use a Registrar that allows domain updates from any IP. easydns.com, for example, can be configured to allow DNS updates only from a list of known IPs. That would stop this kind of deviltry in its tracks.
Re:the moral of the story (Score:5, Insightful)
How in the world is that the conclusion you came to? Hiroshima's Twitter handle, in this case, was simply the thing-of-value stolen by the extortionist. The story would have unfolded exactly the same way for a 2-digit Slashdot UID, or a valuable physical object, or just plain old cash. This story is about the method of extortion, not about the target.
If a friend says "I got mugged," do you reply "well, you shouldn't have been carrying a wallet"?
Re: (Score:3)
Re: (Score:3)
Calling victims stupid can be valid, especially if the victims actually were stupid. The term "victim blaming" is useless; while it is true that I think the crooks shouldn't get away, some victims really are idiots and should be called out for being stupid. They're not always idiots, but sometimes they are.
Re:the moral of the story (Score:4, Insightful)
If you didn't want to be raped, you shouldn't have been carrying a vagina.
Sounds like a lawsuit waiting to happen (Score:5, Insightful)
Methinks if Mr. Hiroshima had the funds available, or pro-bono lawyer stepped in, there's grounds for a lawsuit against at least PayPal if not also GoDaddy.
Comment removed (Score:5, Insightful)
Re:Sounds like a lawsuit waiting to happen (Score:5, Insightful)
Why Paypal?
The last four digits of your credit card are printed on pretty much every receipt, shown on every order confirmation page, every "My account saved credit cards" screen, and are usually shown in addition to an expiration date. That's information that's never been considered confidential - quite the opposite indeed. It's pretty much public information.
True, but irrelevant. Think about that for a minute -- you call PayPal and tell them:
"I have forgotten the last 4 digits of my credit card number, can you give them to me".
In what bizzaro parallel universe does that even make sense? There is no amount of "social engineering" that can explain why you need someone to tell you the last 4 digits of YOUR credit card.
PayPal needs to be reamed for such a major fuck up.
Re:Sounds like a lawsuit waiting to happen (Score:5, Insightful)
"I have forgotten the last 4 digits of my credit card number, can you give them to me".
"Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."
Re:Sounds like a lawsuit waiting to happen (Score:5, Insightful)
"I have forgotten the last 4 digits of my credit card number, can you give them to me".
"Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."
In an ideal universe: "Sir, if you tell me the last four digits of the card number, I can tell you if you updated it."
Re:Sounds like a lawsuit waiting to happen (Score:5, Insightful)
Right, in an ideal universe everyone would follow security-conscious procedures. In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric. Quickly helping a friendly, innocent, and clueless-sounding customer, versus remembering and strictly following every procedure in the 400-page employee handbook, doesn't always happen. That's why social engineering works --- the system is not designed for maximum security rigor, but for cutting corners on call-answering costs.
Re: (Score:3)
And I would call that problematic by design. Mr Hiroshima didn't chose this for Paypal's business model, and Paypal is ultimately responsible for this.
Re: (Score:3)
"In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric."
Right, but backing up this thread to the previous point that still makes it PayPal's fault for not ensuring security comes before other arbitrary metrics. That excuses the call centre worker, that is why social engineering happens as you say, but none of it is a viable excuse for PayPal as a company allowing the data to be handed over.
Re:Sounds like a lawsuit waiting to happen (Score:5, Insightful)
I never meant to imply at all that the phone service rep was stupid --- rather, they're a person caught in a system that forces them to act stupidly. The person answering the phone probably has a big timer counting down how long they've got to answer the call to keep up their quota. Despite any "official" procedures for security, the real institutional pressures are centered around cost-cutting and quickly getting people off the line. A conscientious worker who studiously prompts callers for rigorous proof of identity before letting slip the least bit of personal information will be out of a job quick, when their performance is compared against far more "efficient" peers. I did not use "foreign" to imply inferiority of foreigners' intelligence, but rather the dysfunctional results of All-American corporate management who put short-term corner cutting above all else. Minimum-pay, minimally-trained call centers in the cheapest distant locations are a symptom rather than a cause of the system that creates poor security.
Re: (Score:3)
To be fair, corporations don't improve the situation. I had this conversation several times with Telstra staff:
Telstra: Hi, this is Telstra. We want to discuss your account, but to prove you are you, what's your birthday?
Me: You cold-called me, you need to prove who you are, not the other way around.
Telstra: But it's just your birthday, it's not ID.
Me: YOU'RE USING IT FOR ID RIGHT NOW!
Twats.
Re: (Score:3)
SOP for when I was in a call center was that in response to that kind of question, you'd have to let THEM volunteer the information or have them check online.
And even then we'd expect them to verify all the rest of the account information, server IP addresses, billing address, last bill amount, etc...
Re: (Score:3)
Paypal's response should be "I'm sorry, but we can't give this information over the phone" or "You can see a list of cards you have linked to your account on our website." Possibly they could say "Ok, I can give you that information but first give me this Secret Passcode to prove that you are who you say you are." All of these would help actual customers in this situation while guarding against social engineering.
Re: (Score:3)
I routinely get service reps reading my last 4 digits of cards they have on file. This happen on Delta all the time. I have about 6 credit cards on file, and sometimes I need them to make sure specific tickets are on specific cards. I often have a conversation like "That's the one ending in 1011 right? No sir. Is it the 1099? No sir. Really? Which is it? It's the 1014 sir. Oh yeah, that one. ok."
Last 4 are not a secret. Best buy and lots of box retailers now actually ask you for it when you check out. You h
Don't think custom domains were his problem (Score:5, Insightful)
Avoid custom domains for your login email address
Honestly, I don't think that would have helped. I doubt it's much harder to gain control of someone's gmail, yahoo or hotmail account if they are as motivated as it sounds like his attacker was.
Once you gain control of anyone's email account, even if the attacker doesn't have custom domains to hold for ransom, they could easily threaten bank accounts, etc etc.
Re:Don't think custom domains were his problem (Score:4, Insightful)
The problem is that for every super-focused hack like this one, there's a thousand people who forget their access credentials and want their account back, so it makes more sense to have lax security and cover the biggest proportion of your audience.
Re: (Score:3)
Re: (Score:2)
The problem with customs domains is that it created another attack vector that no one really thinks about. The attacker hijacked his mx records and directed his email away. Up until now, I was sitting pretty thinking that I was safe because I used LastPass to create a long fucking Google Apps password and Google Authenticator for two-factor security. I never considered the notion that someone could hijack my mx records. I'm going over to namecheap to enable two-factor authentication.
Two-factor on GoDaddy? (Score:3)
Re:Two-factor on GoDaddy? (Score:5, Interesting)
the godaddy person let him keep trying various numbers until it worked. How can you trust them when it comes to security at all.
These companies need to be held accountable for their actions.
Re: (Score:2)
Are you sure about that? My guess would be that they have internal tools that can get around the 2 factor authentication- what would happen if you lost the token generator? In that case social engineering would still work.
Re: (Score:3)
Godaddy would have just removed the 2nd factor for the same reason they handed over the "1st" factor. Hiroshima pretended he was the user, who has lost the ability to log in. They would have just reset the password and removed two-factor authentication from the account after the identify was "verified."
lawsuit (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3)
The real problem is using the credit card number as authentication of anything other than a credit card purchase. I
Re: (Score:3)
I'd be talking to a lawyer. Sounds like someone at Paypal owes $50k to Mr. Hiroshima.
Nobody owes him any money whatsoever. He claims it was "valued at over $50,000", but it's worth exactly $0 until he sells it.
Re:lawsuit (Score:5, Informative)
Patience may be rewarded. Somebody will start using @N at some point, and that person will have a money trail to the criminal.
"Don't 'Let' Them?" (Score:4, Insightful)
don't let companies such as PayPal and GoDaddy store your credit card information.
I wonder, does Mr. Hiroshima realize that consumers have little to no (closer to the latter) control over what a corporation does with our credit card info once we make a purchase with them?
Does he know of some nuclear option the rest of us aren't aware of?
Re: (Score:2)
Stupid people prevent us from having secure things (Score:5, Insightful)
This is a story about how 'real' people hate secure things. Nerds are all about creating encryption and security that requires knowing a secret key. Real world people deal with the fact that they forget secret keys, and want companies to restore their data for them. So for companies to keep customers, they have to create workarounds for the secret keys.
As a result the only way to for sure secure something, is to not depend upon companies who have 'real' people for customers.
Re:Stupid people prevent us from having secure thi (Score:4, Insightful)
This is the truth, some customers are not partial to jumping through hoops for secured access, at all.
For those of us that want the hoops, why don't these companies offer you the ability to opt-out of the 'workaround' security practices?
Because "real" customers would think they want to have the higher level of security, when in reality they still want the lower level of security. If the company offers higher security to them, the customer will accept it, and then the customer will get upset when the company delivers it to them. The customer will then change to a competitor who promises high security but in reality delivers low security, because that is what they really want.
Classic IT mistake - you need to deliver what the customer wants, not what they ask for.
Re: (Score:3)
Except that doesn't help, because you can't run your own domain name registration.
And this is why.. (Score:2)
And this is why I avoid Twitter, GoDaddy & PayPal like the plague they are.
not going to end well (Score:2)
i get the feeling that this is high enough profile where the extortionist is going to get a beatdown by one of the tech companies involved.
Multiple credit cards (Score:5, Insightful)
When the Target data breach happened, I commented here about some of the advantages to using throw-away, preload credit cards (which limits your potential loss and allows you to quickly switch to an entirely different account if you feel the other might be compromised). I was modded down by people who have bought into the whole big-bank credit card racket, and the attitude "why should I worry, when the bank is responsible and I'll eventually get my money back". Well here is yet another advantage of using preloaded credit cards. You load money on it, pay your annual hosting fees, etc, and then just toss it and get another next year to make the next annual payment. This story illustrates the advantages of using an entirely different credit card per service, so the card you use with Godaddy is not the same as you use with Paypal.
Yes, yes, it will cost you $3 each time you load a card to make that yearly payment, but you can decide for yourself what that extra $3 can buy you.
Re: (Score:2)
I like this idea, but have never used preloaded cards before. Do they work like "real" credit cards, ie, broadly accepted like any card? How do you load them up with money, can you buy value with a credit card or does it require a cash transaction?
There was a story in the paper today about banks reissuing 150 million cards due to the Target debacle and I thought -- why don't they just do that every year anyway? Or when they issue cards, maybe they should give you a 12 pack of cards that are only good for
Re:Multiple credit cards (Score:5, Informative)
For Mr. Hiroshima, that $3 would have apparently bought him continued ownership of his single-letter Twitter account.
Re: (Score:3)
Second, a "bit of a hassle" doesn't quite do justice to describing the process of having all your money stolen electronically at some inconvenient time, and then jumping through hoops for the process of reclaiming your money. Oh, were you busy? Because now you need to devote many many hours to this task immediately.
OR... (Score:2)
I kid, of course... I have no reason to doubt the story as given. I do find it odd that someone would actually break the law (at the very minimum, identity theft and extortion) in such a contrived chain of events... Just to gain control of s
Should not be to difficult to get it back (Score:5, Insightful)
After all Twitter knows which new eMail-address is holding @N. Should not be to hard to figure the real person behind it. And simply asking Twitter to hand it back should also work.
What you don't know... (Score:5, Interesting)
Is that the current controller of N is legitimate, and *this* story is the social engineering attack to get control of it.
Re: (Score:2)
Hah, that's the first thing I thought of as well. He could have accepted that $50,000 and now be trying to get that domain back.
Re: (Score:3)
the real reason has traditionally been that if virtual goods (like the account or items in the game world) can be shown to have a legitimate real-world value then there is a good possibility that they might end up with legal liability in the event that their server code screws up and erases the account (or, possibly, even if a bug in their code causes items in the game economy to loose significant value in the real-world).
In my case, it was because I didn't want to deal with "I bought/sold an account but the other person ripped me off" reports. It's worthwhile to be very vocal up front that it's not allowed, even if you don't actually care, just so people realize they're doing such transactions at their own risk.
All right, I'll bite. (Score:4, Interesting)
Nope (Score:5, Insightful)
This is like kidnap or a mugging. At no point do I have an actual incentive to give in to such a person's demands. "We won't hurt you / them / your website if you do X". I have *absolutely* no guarantee of that.
I *cannot* win. If I do everything you request, you could still trash my domain / stab me anyway / kill your hostage and there's nothing I can do to stop that.
As such, non-compliance is no different to compliance in such a situation. So why voluntarily give them MORE power over you / your assets?
As it is you would have to wipe servers, settings, email etc. and start again even if they did honout their agreement.
But then, you have to remember, this person is already committing a crime... what's in their conscience that will make them honourcan agreement concerning that crime.
Let them squirm, report them, regain control when you can, then purge their access from your systems.
Anything else is just stupid.
Re: (Score:3)
Easy to say right now. Harder to say if you are the one who is facing someone who has access to the DNS records of all of your websites (and has locked you out) or (even worse) a mugger with a gun pointed at you.
Just rewards for using GoDaddy (Score:2)
Did you really expect GoDaddy to care about protecting your interests?
Some excellent alternatives were offered by respondents on the OPs blog, and I'll add another - moniker. Their claim to fame? They have "never lost a domain". And, so, they have a really good reason to keep others from taking your domain - they'd have to give-up that claim. They also offer a reasonably-priced enhanced security feature, though I feel it's unnecessary given the company's history. (And just checked, they still make the claim
Use Two-Factor Authentication On Gmail (Score:3)
This story reminds me why I don't use GoDaddy and, if you haven't already done so, activate two-factor authentication on your Gmail account.
It's not bulletproof (what is?) but it's an extra layer of security that keeps a hacker from getting control of your email account.
I can't picture the endgame here (Score:2)
A social-engineering blackhat extorted a distinctive and notable, and thus allegedly valuable, Twitter handle from its legitimate registered user.
Why?
It's like stolen art: the thief can't display it without implicating himself. The thief can't sell it, because the fool that buys it can't display it without implicating himself, and the thief by association (and vulnerability to investigative back-tracking).
So.... why?
A lot of work to go to for the sole purpose of effectively destroying a Twitter handle.
Windfall (Score:2)
The good news for him is that PayPal and GoDaddy and Twitter now owe him a hell of a lot more than $50,000.
It goes deeper than GoDaddy, unfortunately. (Score:5, Interesting)
Simply put -- consumers can't be trusted to be able to deal with complex secure authentication schemes. That's why there's so many easy-to-guess "What city did you grow up in?" password-reset functions. There are so many weak links in the chain of trust, it takes a concerted effort on the individual's part to secure it.
The CEO of Cloudflare fell victim to this when someone CONVINCED AT&T TO REROUTE HIS VOICEMAIL, starting a chain of events that wound up with the interloper having complete control over Cloudflare and the myriad of sites that use CF (and therefore trust it to send legitimate data).
It's a bit exciting/fascinating to read about the chain of events, (particularly the timeline):
http://blog.cloudflare.com/the... [cloudflare.com]
http://blog.cloudflare.com/pos... [cloudflare.com]
Multi-factor authentication on GoDaddy (Score:4, Interesting)
Re: (Score:3)
I use Google Voice as my phone number, you insensitive clod!
Re: (Score:3)
"Hey godaddy, my house burned down with that phone in it, so I can't get to those messages nor or ever, please change it to my new number 1234-4321 so I can receive your messages again."
Re: (Score:3)
And how is it not possible for a mobile phone to burn, or get lost, or otherwise cause you to lose access? It's quite interesting you even thought I was talking about a fixed line. That option never crossed my mind when writing that comment.
stand alone email addresses? (Score:2)
What about @A to @Z \ @N? (Score:2)
Should we not all now jump up and try the same for the other one letter handles? As a matter of civil upsetness?
How would you like your steak? (Score:3)
Well done.
Rare, one-letter Twitter username (Score:3, Funny)
GoDaddy admits they were social engineered (Score:3)
Re:"Social engineering" (Score:5, Insightful)
Re:"Social engineering" (Score:4, Interesting)
Hi, this is $name with account $account, and I had my identity stolen a while ago. They changed all of my account information, and I want to check to see if this account was hacked. What are the last 4 of the SSN on the account?
Of course, the customer support rep wants to be helpful, and the person already knows the other account identifiers... so the idea of fraud never crosses their mind.
Re:"Social engineering" (Score:5, Insightful)
Of course, the customer support rep wants to be helpful, and the person already knows the other account identifiers... so the idea of fraud never crosses their mind.
Um, they don't have to make a fraud/non fraud. The policy should be to never give out details. Ever.
Re:"Social engineering" (Score:5, Insightful)
That would be Paypal that gave out the last four digits. And really, that's not at all uncommon - you can usually get that information from just about anyone who's holding your credit card information "Hi, I wanted to confirm which card I have associated with this account. Are the last four digits 1234? No, they're 8462? Ah, that explains it, thank you." Hell, they tend to be listed on every single email receipt sent unencrypted across the internet.
GoDaddy is still on the hook in my eyes though - given the completely unsecure treatment of the last four by pretty much everyone, using it for any sort of authentication purposes is completely asinine.
Re:"Social engineering" (Score:5, Insightful)
"Hi, I wanted to confirm which card I have associated with this account. Are the last four digits 1234?
"Our policy is to never give out that sort of information on the 'phone. Why don't you log into your account and check?"
Re: (Score:2)
So Hiroshima is an idiot because someone convinced an employee at PayPal that he was infact the account owner and to give out the last 4 digits of someone elses credit card?
Or is he an idiot because someone at GoDaddy who also in breach of proper authentication of account ownership gave access to the person with the last 4 digits of the credit card number?
Help me out here, I am so confused about how him being less "worthless and superficial" would have stopped someone else from giving out his account inform
Re: (Score:2)
The attacker changed all the godaddy customer information, Godaddy doesn't believe he's the owner of the domains.
Re:I must be missing something. (Score:5, Insightful)
That's totally absurd. I can't believe a service provider like Godaddy has no record history or history of customer information change. Of course, this historical informaiton may not be available to the first level of customer support. But come on... that shouldn't be the end of it.
Actually, I'm surprised that a service like Godaddy doesn't have checks in place for cases like this. An account where ALL the customer information is changed within a short period of time, should raise alarm bells. The owner, under the contact information previously available, should automatically be contacted.
Re: (Score:2)
They do now.
Re: (Score:2)
it's a bit like a two character slashdot nick... my... precious...
Re:comeuppance? (Score:5, Insightful)
Re: (Score:3)
And how about don't swim with sharks?
If he wasn't a social media (value = what exactly?) then this would never have happened anyway.
Don't get your desirable twitter handle stolen by not having it? I can think of a car analogy for that.
Re: (Score:3)
That's why your answer to security questions shouldn't be any weaker than your main password. What was your first pet's name? "e3d0b512214fa". What street did you grow up on? "aa16b70cc9526fe". Store the answers in your own strongly-encrypted password file. Just because they ask for weak identifying info, doesn't mean you have to play along.