Developer Loses Single-Letter Twitter Handle Through Extortion

Hugh Pickens DOT Com writes "Naoki Hiroshima, creator of Cocoyon and a developer for Echofon, writes at Medium that he had a rare one-letter Twitter username — @N — and had been offered as much as $50,000 for its purchase. 'People have tried to steal it. Password reset instructions are a regular sight in my email inbox,' writes Hiroshima. 'As of today, I no longer control @N. I was extorted into giving it up.' Hiroshima writes that a hacker used social engineering with Paypal to get the last four digits of his credit card number over the phone then used that information to gain control of his GoDaddy account. 'Most websites use email as a method of verification. If your email account is compromised, an attacker can easily reset your password on many other websites. By taking control of my domain name at GoDaddy, my attacker was able to control my email.' Hiroshima received a message from his extortionist. 'Your GoDaddy domains are in my possession, one fake purchase and they can be repossessed by godaddy and never seen again. I see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise? access to @N for about 5 minutes while I swap the handle in exchange for your godaddy, and help securing your data?' Hiroshima writes that it''s hard to decide what's more shocking, the fact that PayPal gave the attacker the last four digits of his credit card number over the phone, or that GoDaddy accepted it as verification. Hiroshima has two takeaways from his experience: Avoid custom domains for your login email address and don't let companies such as PayPal and GoDaddy store your credit card information."

Comments

the moral of the story

[royallthefourth]

like so many other articles, this just seems like another reminder to never ever use godaddy

Re:the moral of the story

[davek]

like so many other articles, this just seems like another reminder to never ever use godaddy

Perhaps this is more of an indictment of using ANY non-big-brother email provider for login information to ANY domain registrar. It seems to me the crux of this attack was to a) gain access to the victem's domain registrar account and then b) hijack the domain MX record so all email to that domain goes to the attacker's server. At that point, you can reset all the victem's passwords to all accounts and ALL password reset emails will go to the attacker.

Time to enable 2-factor on all my registrar accounts.

Re:the moral of the story

[rwven]

Or paypal? IMHO they're the ones who enabled the entire operation here. They gave away the last four digits of the guy's credit card to a stranger...

Granted, godaddy should have required a photo id as well.

They're both rubbish.

Re: the moral of the story

[techprophet]

I never understood while people did in the first place. Their website has always been ugly as sin and barely functional; their tv advertisements have never had anything to do with their actual business; they get way more bad press than good (have they ever gotten good press?).

Re:the moral of the story

[davek]

gain access to the victem's domain registrar account

Sometimes I hate not being able to spell :(

Re:the moral of the story

[rwven]

Two-factor probably wouldn't have helped here. They reset the account credentials, assuming the owner lost the ability to log in. That would have included resetting any "2nd factor."

I don't think any action on the user's part would have helped any of this other than maybe his comment about the TTL on the MX record.

Re: the moral of the story

[SuricouRaven]

But they are cheap.

Re:the moral of the story

[hawkinspeter]

How about if he'd used GMail or a similar mail provider? It sounds like the problem was that he was using his own domain for email and GoDaddy was the weakest link.

Re:the moral of the story

[Anonymous Coward]

They gave away the last four digits of the guy's credit card to a stranger...

I'm not going to defend paypal, but the last 4 digits are generally considered safe to identify a distinct credit card without sharing enough information to allow identify theft. That godaddy accepted the last 4 digits as proof of ownership is far more disturbing than that paypal probably asked 'will this be using the card ending with "1234"?' while the scammer was digging for info.

Still, I've been avoiding paypal since I got over my old ebay habit. [cue Weird Al song]

Re:the moral of the story

[David_W]

They gave away the last four digits of the guy's credit card to a stranger...

Not to defend PayPal, but the last 4 digits are often not treated as particularly secret. They put it on your credit receipts, many sites show them to help you figure out which card you have registered with them... Yeah, PayPal shouldn't be giving it out, but GoDaddy really really shouldn't be using it as some sort of ID verification. One of these is kinda dumb, the other is weapons-grade dumb.

Re:the moral of the story

[Anonymous Coward]

And remember, you can't ever be targeted for monetary extortion if you never have any money.

Way to miss the point there...

Re: the moral of the story

[nullchar]

Many other registrars are inexpensive too like NameCheap and Gandi and BigRock.

Re:the moral of the story

[Anonymous Coward]

You didn't misspell twice, you misspelled victim. Oh, wait..

Re:the moral of the story

[Anonymous Coward]

> The conclusion I came to is "NEVER use Twitter".

You can replace the word Twitter everywhere in this story with your service of choice, and still be extorted for the account. Why do you think that avoiding twitter saves you from this kind of fraud?

Re:the moral of the story

[sodul]

You can use gmail with your own domain name. It used to be free (and still free if you got grandfathered in). There are good reasons to use your own domain name with out without gmail. Most notably it looks more professional and you can actually have a very nice looking email instead of @gmail.com I have @.com, and my last name is 4 letters. It can also be more secure if you provide smtp access over ssl for your organization and so email within your own domain is usually fully encrypted while going over the public internet.

Gmail has been shown on a napkin to be pretty much fully readable while being transferred from one Google DC to an other one.

Re:the moral of the story

[ArhcAngel]

gmail would have worked. Google never answers the phone or email support requests anyway.

Re:the moral of the story

[Antipater]

How in the world is that the conclusion you came to? Hiroshima's Twitter handle, in this case, was simply the thing-of-value stolen by the extortionist. The story would have unfolded exactly the same way for a 2-digit Slashdot UID, or a valuable physical object, or just plain old cash. This story is about the method of extortion, not about the target.

If a friend says "I got mugged," do you reply "well, you shouldn't have been carrying a wallet"?

Re: the moral of the story

[sodul]

But not the cheapest. 1and1.com is just as cheap if not cheaper and their website is a lot more professional. Godaddy feels like you are on a malware site.

Re: the moral of the story

[Anonymous Coward]

I don't know how it is for US but in France 1 and 1 raise the price of name registering by 50% at the start of this year.
(So I'm quitting this year)

Re:the moral of the story

[sconeu]

This could quite possibly be a PCI violation.

Re:the moral of the story

[Anonymous Coward]

using last 4 digits as ID is just pure madness. On the internet I use virtual card so the number is never the same. Until now I should have used 200 of them

Re:the moral of the story

[jythie]

A while back I was reading a piece written by someone who was mugged and yeah, the person got lots of victim blaming including that he should not have been carrying valuable things in the first place.

Re: the moral of the story

[Pope]

1and1 was one of the shittiest registrars during the whole dot-com boom.

Re:the moral of the story

[TCiecka]

I cannot believe I didn't think of MX records as a big vulnerability here.
Thank you sir, for noting this in your post!

Re:the moral of the story

[cyberchondriac]

Glad I finally dumped them last year. They gave me quite the runaround on the first attempt too, some crap that I'd changed something and had to wait another several months.

Re: the moral of the story

[scubamage]

Because Danica Patrick in skimpy clothing sells.

Re:the moral of the story

[Em Adespoton]

They gave away the last four digits of the guy's credit card to a stranger...

Not to defend PayPal, but the last 4 digits are often not treated as particularly secret. They put it on your credit receipts, many sites show them to help you figure out which card you have registered with them... Yeah, PayPal shouldn't be giving it out, but GoDaddy really really shouldn't be using it as some sort of ID verification. One of these is kinda dumb, the other is weapons-grade dumb.

I know it's common practice, but it really shouldn't be -- the last four digits of your credit card number are really 3 digits plus the Luhn check. That means that with that string, you can test out all the number combinations and arrive at a significantly narrowed set of possible credit card numbers.

Take for example American Express -- the first 4 digits are known (they're the card ID). If you give away the last four digits, that's 3 digits and Luhn. That means that you now have only 8 unknown digits, and they have to be in a permutation that totals with the other 7 digits to the proper Luhn total. In effect, this means that you can also reliably guess the 5th and 12th digit (as they're paired with the known digits and have an extremely limited set of permutations for the remaining 6 -- only a few hundred for in-my-head calculations.

That may still sound like a lot, but it means that if you have access to the last four digits of 1,000 cards, you're likely going to get the correct card number on the first try on a significant portion of them.

Summary: the last number of a credit card shouldn't be given out, as it tells a lot more about the entire number than it appears at first glance.

Re:the moral of the story

[Em Adespoton]

This could quite possibly be a PCI violation.

It isn't on GoDaddy's part -- depending on how it was done, it may or may not be on PayPal's part.

Re:the moral of the story

[Immerman]

Seconded. Pretty much everyone throws around the last four indiscriminately - hell, they're sent unencrypted in pretty much every order receipt emailed by anyone in the world. Using them for authentication is extremely stupid.

Re:the moral of the story

[Immerman]

Sure, plenty of good reasons to use your own domain for normal correspondence - but for authentication purposes you're better off shortening the chain of trust as much as possible. Rarely will the email address used for domain registration, or even your slashdot account, impart any measure of professionalism. It's used for automated authentication, automated notifications, and very, very rarely, contacting you by humans who might theoretically read the email address that was automatically filled in when they clicked the "email this person" link.

Re:the moral of the story

[allaunjsiIverfox2]

Calling victims stupid can be valid, especially if the victims actually were stupid. The term "victim blaming" is useless; while it is true that I think the crooks shouldn't get away, some victims really are idiots and should be called out for being stupid. They're not always idiots, but sometimes they are.

Re:the moral of the story

[Bing Tsher E]

All we need to carry now is our compromised near-field cellphones.

What could be simpler?

Re:the moral of the story

[Charliemopps]

No, this was a clear violation of CPNI. They either needed to confirm his identity via physical photo ID or his password/Pin over the phone. If they gave ANY information about his account at all, even the fact that he had one, without the Pin/Password they violated CPNI and their fines will be substantial.

Now if his Pin was something stupid like his birthday, well that's his own fault.

Re: the moral of the story

[Quirkz]

I never used 1and1 as a registrar, just for hosting, but they had some ridiculously bad tech support. Example: I was having trouble receiving email, and had to argue with support about how he didn't like how I filled out the initial form for about half an hour. This might be understandable if he was just trying to properly verify I was me, but after it was all over he then said, "Well, you're not getting email because we're experiencing a DDOS and it's down for everybody." If he'd said that first, it would have saved a lot of trouble. I felt like most of my interactions with them went like that.

Re:the moral of the story

[Anonymous Coward]

Two factor verification where the second factor is a one time verification code sent to your cellphone would have prevented this as the attacker would not have had the verification code needed to take control in the first place.
This should almost be standard practice. The only hassle is I'd rather not dish out my cellphone number willy-nilly as that would merely cause a ton of spam SMSs being sent to my phone.

Re:the moral of the story

[HornWumpus]

What kind of moron spells the same word the same way, twice in a row? Doesn't he have any imagination?

Re:the moral of the story

[rthille]

I run my own email server, so adding Google into the mix lengthens the chain of trust, not shortens it.

Of course, a registrar would probably be less likely to be socially engineered to changing the domain ownership of gmail.com than my domain, but I do use a good registrar (gandi.net) and do have two-factor auth turned on.

Re:the moral of the story

[sconeu]

I meant on PayPal's part.

Yet another reason I will never use PayPal.

Re:the moral of the story

[cant_get_a_good_nick]

It is a damn poor mind indeed which can't think of at least two ways to spell any word.

-- Andrew Jackson

Re:the moral of the story

[Obfuscant]

I know it's common practice, but it really shouldn't be -- the last four digits of your credit card number are really 3 digits plus the Luhn check. That means that with that string, you can test out all the number combinations and arrive at a significantly narrowed set of possible credit card numbers.

It doesn't matter where the check digit is, the fact that it exists changes a 16 digit number into a 15 digit one. (And AMEX is an exception, they're only 15 to start with.) I can give you three digits and the "check" and you will need to guess the other 7 (because one of the 8 is constricted by checksum), or I give you four digits and you guess 7 more and calculate the check.

Once you have the bank and the last four, it is still 7 you get to guess at and the 8th is still limited by having to meet the check.

but it means that if you have access to the last four digits of 1,000 cards, you're likely going to get the correct card number on the first try on a significant portion of them.

One in 10 to the 7th power for each one, right on the first guess, assuming you know the first four from the bank for each one. Let's see, the chance of getting it wrong is 1-1e7, so getting all 1000 wrong is (1-1e7)^1000. I get 0.99990. Very close to 1, but about 1/10,000. Odds say you won't get any of them right on the first guess.

And of course, now that I look up the actual Luhn algorithm it is clear that giving you the check digit actually doesn't help you as much as giving you one of the real digits would. If you have to guess 8 digits that match the check I've given you, you will get false positives for all the failure modes listed in the reference, but if I give you an extra digit you'll have one less digit to get wrong.

Re:the moral of the story

[Anonymous Coward]

They've actually fully encrypted their connections now in the wake of Snowden releases

Re: the moral of the story

[rickb928]

You, as an example.

Re:the moral of the story

[rwven]

The problem is, the attacker called godaddy personally. As part of the account credential reset process, they probably would have completely removed two-factor authentication from the account over the phone to allow him to regain control of things.

Re:the moral of the story

[houstonbofh]

Time to enable 2-factor on all my registrar accounts.

No, time to use a registrar that does not use untrained idiots for customer support. This would not have happened at SafeNames. Of course, SafeNames is more expensive than GoDaddy. But if you are protecting a business asset worth over $50k, you do not worry about a few bucks a year.

Re:the moral of the story

[houstonbofh]

Huh. The conclusion I came to is "NEVER use Twitter". I've deliberately refused to join it and that just reinforced why I refuse to do so. I can't be targeted for my Twitter handle if I don't use the service. GoDaddy has its problems for sure (and I admit to being a customer at present) but I'm not totally convinced that no other registrar wouldn't have done the same thing.

It would absolutely not have happened at SafeNames. Why? Because you have a sales rep who knows you and your phone number. And my sales rep would have placed the call on hold and called my cell to ask what was up.

However, they are more expensive than GoDaddy. For good reason.

Re:the moral of the story

[houstonbofh]

I had to migrate names off GoDaddy once. It took almost a year to get them all. And I had to renew most of them before they would transfer them. On some of the international ones I also had to renew the proxy office service, even though we had an office in those countries.

Re:the moral of the story

[Plunky]

What I don't understand is, that .. yes, the extortionist stole the twitter handle. but wait, if it is stolen property he can't actually use it or sell it without falling foul of the law, can he? Also, that handle is in a known position and it is under the control of a known entity who can be compelled by a court order to return its control to the genuine owner.

or do twitter not care?

Re:the moral of the story

[Anonymous Coward]

a bit of correction.

Banks get the number in blocks of first 6 digits, not first 4 digits.

Re:the moral of the story

[Anonymous Coward]

It is eve online all over again.

Re:the moral of the story

[Anonymous Coward]

Some years ago, a Sprint security rep called me to verify a new account for a phone. He asked for the first 5 of my social. I was certain this was some sort of phishing attempt, because no reasonable security department would actually ask its users to respond to such a ridiculous question on the receiving end of a phone call. They said they'd have to shut it off, and I told them to do so. Sure enough, it was legit. They shut it off. I had to go to a Sprint store to get it turned back on, and it took a while because they had no idea what I was talking about at the store.

Re: the moral of the story

[Anonymous Coward]

Would love to switch to Gandi as I've heard many nice things about them, but they don't offer email catchall's.

(Yes, I know many people frown upon catchall email accounts ... but I want them.)

Haven't heard of BigRock; will need to look more into NameCheap.

Re:the moral of the story

[Anonymous Coward]

Your chain of trust now includes Gandi.net.

What it comes down to; is do you trust Gandi.net more than Google.com to be hijacked or hacked?

Your answer is probably yes, but based on the size and resources available to google to prevent that, my answer is no.

I prefer google at the end of my chain, than a company I do not recognise.

(chain pun not intended, but its true, they are the holder of my identity and I can recognise that - even if I don't like it!)

Re:the moral of the story

[chuckinator]

Bazinga!

Re:the moral of the story

[Mr. Slippery]

Of course, a registrar would probably be less likely to be socially engineered to changing the domain ownership of gmail.com than my domain

Sure. They'd social engineer GMail instead.

Re:the moral of the story

[Jayfar]

No, this was a clear violation of CPNI. They either needed to confirm his identity via physical photo ID or his password/Pin over the phone. If they gave ANY information about his account at all, even the fact that he had one, without the Pin/Password they violated CPNI and their fines will be substantial.

Now if his Pin was something stupid like his birthday, well that's his own fault.

As far as I understand it, CPNI rules only apply to telecommunications carriers.

http://en.wikipedia.org/wiki/C...

Re:the moral of the story

[Charliemopps]

Yea, I work for a telecom, I'm using my industry term. But the same rules apply to other businesses that use credit cards/accounts/billing, they're just under different legislation.

Re:the moral of the story

[Anonymous Coward]

That doesn't help, if someone hijacks your domain, they can change the MX away from Google and point to their own servers. So your setup wouldn't have prevented such an attack.

Re:the moral of the story

[Anonymous Coward]

I lost my original (since beta) Gmail address (and subsequently my WoW account) a couple years ago and could not find a single way to contact a real person about it. All I got was a webform asking me silly questions like "What month/year did you create your account?", "What was the email address of the person that invited you?", and even "Enter the email of 5 frequently emailed contacts".

I understand they have a huge userbase and can't possibly tend to ever lost account personally, but it was still a kick in the guts to resign myself to creating a new account.

Re: the moral of the story

[Anonymous Coward]

Yup! Just add your own MX record pointing to your server and give it a lower weighting. Say, make yours a 10 and theirs a 20. When you disable SMTP on your server, mail flow resumes back to their server again. It could stay that way until the owner notices the extra MX record via Dig command or stumbling on it one day when reviewing DNS records.

Re:the moral of the story

[ArhcAngel]

Try reversing fraudulent charges to your Google Wallet account...I didn't think it would be possible to be worse than PayPal! I haven't used that service since.

Re:the moral of the story

[jaymz666]

Does your browser not offer a spell check? Or if using a mobile device they often "helpfully" correct words, too.

Re:the moral of the story

[jaymz666]

Two factor authentication is useless unless people are held to those two factors.
It's a balance between convenience, customer service and security, but if you can bypass the second factor then it's all for show and just an inconvenience.

There may be a better solution, like emailing and calling on the phone and asking specific information, but I'm sure more experienced people have thought longer and harder about it.

Re:the moral of the story

[Anonymous Coward]

While PayPal and GoDaddy are tragic comedies in the internet world to begin with.

It's pretty sad that someone [an attacker] would go through this for a nit-witter account! I can see going after someone that is an a-hole. I don't know what type of person Naoki Hiroshima is, he could be a really nice person, or an a-hole, or the attacker is someone that holds a grudge against Naoki. Could be someone that tried to buy the account went another direction hiring someone to hi-jack his information then blackmail him out of the account.

I don't know to me just a complete waste of time, to do this for an twitter account, time and energy that could be spent doing something worthwhile..

Re:the moral of the story

[S.O.B.]

Time to enable 2-factor on all my registrar accounts.

No, time to use a registrar that does not use untrained idiots for customer support.

Or do what I do. I host my own sites (not on GoDaddy) and I have a registrar reseller account so I am my own registrar. I like to think that if someone calls me up to get access to my registrar account that I would catch it.

Re:the moral of the story

[radarskiy]

If you didn't want to be raped, you shouldn't have been carrying a vagina.

Re:the moral of the story

[allaunjsiIverfox2]

I'm not sure I understand your point.

Re:the moral of the story

[dywolf]

let's not ignore paypal here.
sounds like a lawsuit against them is in order here.

Re:the moral of the story

[Anonymous Coward]

You'd be surprised. Back when I used ICQ, I had a six-digit UIN that people tried to scam me out of all the time, just because it's a short and convenient number.

Re:the moral of the story

[Anonymous Coward]

The victim was probably asking for it, flaunting that sexy twitter handle. If he didn't want to be attacked, he should have used better encryption.

Re:the moral of the story

[Unequivocal]

Yeah double plus. I just went an enabled two factor on my registrar account. Kind of obvious that having a weak auth there is a major security hole but I hadn't really been paying attention to it.

Re:the moral of the story

[Unequivocal]

How much more expensive? I went to their website and they don't even print their price list anywhere I could see.

Re: the moral of the story

[Anonymous Coward]

<3 Namecheap

I've had domains registered with them for a while and I love them. I switched from GoDaddy back during the SOPA crap.

Re:the moral of the story

[Anonymous Coward]

Quotes from the article at https://medium.com/p/24eb09e026dd
>> Thank you very much, your godaddy password is: V;Mz,3{;!’g&

> The attacker quickly took control of the username and I regained access to my GoDaddy account.

At which point you published the password. It would have been good to change the password before publishing it. Sigh...
Anyone want some domain names with a history known to be successful enough to get a $50,000 twitter name?

> > if you’d like I can go into detail about how I was able to gain access to your godaddy, and how you can secure yourself
> > ...
> > I have not found a way to heighten godaddy account security, however if you’d like me to recommend a more secure registrar i recommend: NameCheap or eNom (not network solutions but enom.com)

Oh, yes. Thank you! I always like to switch my domains to a registrar that is recommended by someone who initiates attacks using social engineering. I'm sure that the person making this recommendation would never do anything so immoral as to recommend me to a company with bad security. The person who is making this recommendation would never think about doing something as immoral as attacking me in the future.

On a very different note, http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ is the second (out of two) comments I found at the bottom of the article. That article shows another person saying that their life got affected by a company (this time Amazon, rather than PayPal) revealing the last 4 digits of the credit card number, and then having that information be used at another location (this time Apple, rather than GoDaddy).

The article's first comment is http://d.pr/n/KUMK which discusses a similar story experienced by someone else (with the two-letter twitter account JB, highly sought by people wishing to exploit fans of Jonas Brothers or Justin Bieber). The attack was the same as the Wired article (Amazon, then Apple). Except that this story has a happier ending, (at least partially) due to the attacked person being faster than the attacker, and some luck. The luck is simply that with Amazon's lax security, the attacker could have destroyed the services used on his Amazon cloud account, which multiple companies rely upon.

Re:the moral of the story

[bkcallahan]

Time to enable 2-factor on all my registrar accounts.

Sorry, that point in time was several years ago.

Re:the moral of the story

[Anonymous Coward]

Two-factor probably wouldn't have helped here. They reset the account credentials, assuming the owner lost the ability to log in. That would have included resetting any "2nd factor."

I don't think any action on the user's part would have helped any of this other than maybe his comment about the TTL on the MX record.

Well at least he knows who to nuke.

Re:the moral of the story

[mdenham]

Gotta keep their prices secure from someone who might try and steal 'em, you know.

Re:the moral of the story

[houstonbofh]

It is because they are not going after people who shop on price. I don't agree with the approach, but I understand. It is about half again as much as the cheap guys.

Re:the moral of the story

[Fjandr]

But, but, I shouldn't have to worry about having the crap kicked out of me whenever I want to walk into a Hell's Angels club and piss on the shoes of the first person I see inside! Assault is not a laughing matter, and you shouldn't blame me for those bikers putting me into the hospital. It's THEIR fault!

Re:"Social engineering"

[hawkinspeter]

Who, the person working at GoDaddy? Or the owner of the domain for using GoDaddy?

Sounds like a lawsuit waiting to happen

[Rinisari]

Methinks if Mr. Hiroshima had the funds available, or pro-bono lawyer stepped in, there's grounds for a lawsuit against at least PayPal if not also GoDaddy.

Re:Sounds like a lawsuit waiting to happen

[squiggleslash]

Why Paypal?

The last four digits of your credit card are printed on pretty much every receipt, shown on every order confirmation page, every "My account saved credit cards" screen, and are usually shown in addition to an expiration date. That's information that's never been considered confidential - quite the opposite indeed. It's pretty much public information.

GoDaddy was insane to consider it valid authentication information. You might just as well treat someone's name as their password.

Re:Sounds like a lawsuit waiting to happen

[rudy_wayne]

Why Paypal?

The last four digits of your credit card are printed on pretty much every receipt, shown on every order confirmation page, every "My account saved credit cards" screen, and are usually shown in addition to an expiration date. That's information that's never been considered confidential - quite the opposite indeed. It's pretty much public information.

True, but irrelevant. Think about that for a minute -- you call PayPal and tell them:

"I have forgotten the last 4 digits of my credit card number, can you give them to me".

In what bizzaro parallel universe does that even make sense? There is no amount of "social engineering" that can explain why you need someone to tell you the last 4 digits of YOUR credit card.

PayPal needs to be reamed for such a major fuck up.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

Credit card processors are responsible for the security of the information in their possession. If my company ever did that, our ability to process credit cards would be revoked.

Re:Sounds like a lawsuit waiting to happen

[femtobyte]

"I have forgotten the last 4 digits of my credit card number, can you give them to me".

"Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."

Re:Sounds like a lawsuit waiting to happen

[malakai]

I routinely get service reps reading my last 4 digits of cards they have on file. This happen on Delta all the time. I have about 6 credit cards on file, and sometimes I need them to make sure specific tickets are on specific cards. I often have a conversation like "That's the one ending in 1011 right? No sir. Is it the 1099? No sir. Really? Which is it? It's the 1014 sir. Oh yeah, that one. ok."

Last 4 are not a secret. Best buy and lots of box retailers now actually ask you for it when you check out. You have to broadcast it in the air in front of everyone in line.

The issue here is GoDaddy. If GoDaddy doesn't have a 2 factor auth system option you should not be using them for DNS hosting.

Re:Sounds like a lawsuit waiting to happen

[codegen]

"I have forgotten the last 4 digits of my credit card number, can you give them to me".

"Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."

In an ideal universe: "Sir, if you tell me the last four digits of the card number, I can tell you if you updated it."

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

In my experience with GoDaddy, they require either a 4 digit pin or the last SIX digits of the card on file. That the ne'er-do-well was able to get access with the only last four digits of the card sounds like a mistake by the support agent at GoDaddy.

Re:Sounds like a lawsuit waiting to happen

[firex726]

SOP for when I was in a call center was that in response to that kind of question, you'd have to let THEM volunteer the information or have them check online.

And even then we'd expect them to verify all the rest of the account information, server IP addresses, billing address, last bill amount, etc...

Re:Sounds like a lawsuit waiting to happen

[Jason Levine]

Paypal's response should be "I'm sorry, but we can't give this information over the phone" or "You can see a list of cards you have linked to your account on our website." Possibly they could say "Ok, I can give you that information but first give me this Secret Passcode to prove that you are who you say you are." All of these would help actual customers in this situation while guarding against social engineering.

Re:Sounds like a lawsuit waiting to happen

[jythie]

Paypal has secured themselves a nice little niche where a lot of the laws other companies live by do not apply to them. In return they do a wonderful job of kicking companies out of the economy that the DoJ could not otherwise legally go after.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

Trick question, you'll never get a service rep on the phone.

Re:Sounds like a lawsuit waiting to happen

[J'raxis]

GoDaddy here is no more insane than any company that uses "secret questions" to guard users' passwords. I've pointed out to people for years that the idea of protecting a piece of information that is unobtainable (your password, if you're careful enough not to leak it yourself, and it's strong enough to not be guessable) with information that is easily obtainable with just a modicum of effort (e.g., your mother's maiden name, the city in which you were born, your first pet, ...), is an absolutely stupid idea. And it sounds like this guy's GoDaddy account fell victim to exactly that kind of attack.

Maybe if word of this attack gets around other companies will switch to something more secure than easily-answerable "secret questions" to reset someone's password.

Re:Sounds like a lawsuit waiting to happen

[femtobyte]

Right, in an ideal universe everyone would follow security-conscious procedures. In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric. Quickly helping a friendly, innocent, and clueless-sounding customer, versus remembering and strictly following every procedure in the 400-page employee handbook, doesn't always happen. That's why social engineering works --- the system is not designed for maximum security rigor, but for cutting corners on call-answering costs.

Re:Sounds like a lawsuit waiting to happen

[Pope]

"Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."

"Hi, customer, go login to you account and see for yourself. It would've taken less time to do that than waiting on the phone for one of us to answer."

Re:Sounds like a lawsuit waiting to happen

[femtobyte]

"I think the firewall-thingy at work is blocking something? I tried going to the page, but couldn't get through --- I don't really understand how computers work. Look, I'm in a hurry to put a purchase through for my wife's anniversary present, but I don't want it going on the wrong card. I though customer service was the right place to call? Can you just help me out here?"

Re:Sounds like a lawsuit waiting to happen

[logicnazi]

No, this is irrelevant.

If paypal was neither negligent with his data nor violated any privacy laws the fact that in an ideal world they shouldn't have allowed this information to become available is irrelevant.

I mean the law has to have a single answer for whether companies need to keep last four digit info on their super secure system because access to that information would allow affected users to sue or not.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

Firewall at work blocks paypal but not shopping?

Maybe after Paypal gets sued then their customer service reps will stop believing BS like that. And that's why Paypal should get sued.

If you want to be used for serious stuff like $$$ you better treat things more seriously.

Re:Sounds like a lawsuit waiting to happen

[Em Adespoton]

"I have forgotten the last 4 digits of my credit card number, can you give them to me".

"Hi, Paypal phone service person, I recently switched banks, and I think I might need to update my card info. I forget if I did this earlier --- can you tell me which card you've already got on file for me? Just the last four digits would be enough, thanks."

In an ideal universe: "Sir, if you tell me the last four digits of the card number, I can tell you if you updated it."

Indeed -- or even "Would you like me to email you your current statement, Sir?" -- which is of course not as secure.

But PayPal isn't a bank, so probably doesn't have the same training and penalties in place as banks do. This could just as easily been pulled off at somewhere like Amazon though, as they've got your credit card on file too. Actually, there's a lot of places you could call -- after all, you only need access to one of them to start building the PII trail that will eventually get you into the account you want.

Re:Sounds like a lawsuit waiting to happen

[Bing Tsher E]

I have talked to human voicees from both PayPal and eBay.

They didn't even seem to have a foreign (non-Usian) accent.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

When I worked for a phone catalog company, we had to be told the last 4 digits, and then we could confirm or not if that number had been used.

Re:Sounds like a lawsuit waiting to happen

[Ash Vince]

In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric.

I agree with you mostly but there is no need to assume the phone service dude for is in a foreign country to be this stupid. I know a few people who would do this just because they are too stupid to see the problem with what they are doing, that is why the are likely to spend their entire working lives on IT support desks without ever moving upward.

Re:Sounds like a lawsuit waiting to happen

[femtobyte]

I never meant to imply at all that the phone service rep was stupid --- rather, they're a person caught in a system that forces them to act stupidly. The person answering the phone probably has a big timer counting down how long they've got to answer the call to keep up their quota. Despite any "official" procedures for security, the real institutional pressures are centered around cost-cutting and quickly getting people off the line. A conscientious worker who studiously prompts callers for rigorous proof of identity before letting slip the least bit of personal information will be out of a job quick, when their performance is compared against far more "efficient" peers. I did not use "foreign" to imply inferiority of foreigners' intelligence, but rather the dysfunctional results of All-American corporate management who put short-term corner cutting above all else. Minimum-pay, minimally-trained call centers in the cheapest distant locations are a symptom rather than a cause of the system that creates poor security.

Re:Sounds like a lawsuit waiting to happen

[atheos]

"In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric"
And I would call that problematic by design. Mr Hiroshima didn't chose this for Paypal's business model, and Paypal is ultimately responsible for this.

Re:Sounds like a lawsuit waiting to happen

[Joce640k]

And Twitter as well....

I would have called Twitter and said "Somebody's going to change my account in the next hour, it's a thief!". Even if they didn't pay any attention, he'd have a bit more evidence.

Paypal is the real evil though. Why would Paypal *ever* give out a credit card number over the phone?

(And what could you possibly say to them to make them give out that information? The mind boggles....the only explanation is that they need to fire somebody)

Re:Sounds like a lawsuit waiting to happen

[ShaunC]

Last 4 are not a secret. Best buy and lots of box retailers now actually ask you for it when you check out. You have to broadcast it in the air in front of everyone in line.

Wait, what? Admittedly I don't shop at Best Buy anymore, but if I'm checking out and I swipe my credit card, why would they ask for the last 4 digits? I just gave the whole number to the card reader.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

here is GoDaddy. you should not be using them

FTFY

Re:Sounds like a lawsuit waiting to happen

[rthille]

Secret questions make plenty of sense:

What high school did you attend? ljdf1243097dsafnllsdfj12342341
Who was your favorite teacher? 9f1301d6eab107a1d0bd

Re:Sounds like a lawsuit waiting to happen

[Xest]

"In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric."

Right, but backing up this thread to the previous point that still makes it PayPal's fault for not ensuring security comes before other arbitrary metrics. That excuses the call centre worker, that is why social engineering happens as you say, but none of it is a viable excuse for PayPal as a company allowing the data to be handed over.

Re:Sounds like a lawsuit waiting to happen

[marcosdumay]

In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric.

Well, that's PayPal's decision. Why should they get a free pass just because they decided to act in a harmfull way? (Shouldn't it be the other way around?)

Re:Sounds like a lawsuit waiting to happen

[dingman]

It's supposed to increase the odds that the original card is physically present. That magnetic stripe read could have been encoded onto a used hotel key. Many brick and mortar stores actually instruct the cashier to look at the last four themselves, which would catch such things if they did. In my experience, most of them are happy to simply ask you to read it to them, which doesn't help much of anything that I can think of.

Re:Sounds like a lawsuit waiting to happen

[malakai]

Sadly a lot are doing this now. Even if you swipe, they will ask for the card, and then punch in the last 4.

  I stopped giving them the card and asked them what they needed, and they would still ask for the last 4. I got concerned when my wife's card was used within 40 mins of us buying something at a Best Buy at _another_ Best But location across town. We think the cashier called someone and gave them the digits. They had her security code as well. My wife had handed her card to the cashier at the cashiers request.

Pretty good memory for the cashier to remember the digits, expiration, and security code. That or it's a local security guy with access to the video cameras over the cashier. Or she had her phone sitting some where nearby and would wave the card over the camera for someone else to read.

Sadly, it's not really my problem. American Express needs to figure out how to handle these merchants and their employees. It's what I pay AMX for.

Re:Sounds like a lawsuit waiting to happen

[femtobyte]

Right, Paypal shouldn't get a free pass on this. They create these problems by setting up systems that sacrifice customer security for stockholder profits. My point in replying to the original post is that social engineering attacks don't operate on simplistic "bizarro world" principles of "hey, I forgot my CC number, mom's maiden name, and social security --- tell me!". Rather, they operate in manners that exploit systematic weaknesses (e.g. prioritization of fast, friendly service over paranoid security rigor), in a manner that is likely to seem plausible to a reasonable person at the moment (hence likelihood of success). Fixing security isn't as simple as telling your employees not to be dumbasses --- you need a top-to-bottom approach of the kind Paypal is clearly negligent of.

Re:Sounds like a lawsuit waiting to happen

[gnapster]

The reason is to verify that the number stamped into the plastic is the same as the number encoded on the magstripe. It's really easy to overwrite magstripe data. I have been asked to confirm the last four at grocery stores; they usually ask for the card, but if you recite the last four, it's usually satisfactory.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

>Right, in an ideal universe everyone would follow security-conscious procedures. In the real universe, the phone service rep is a minimum-wage worker in a foreign country, whose top priority is keeping down their time-per-call-resolution metric.

Which is why you design the helpdesk terminal UI so that it never shows the card number to the phone monkey in the first place. Instead, the user types in the number and the terminal tell the user if it is correct or not.

Re:Sounds like a lawsuit waiting to happen

[evilviper]

Think about that for a minute -- you call PayPal and tell them:

"I have forgotten the last 4 digits of my credit card number, can you give them to me".

In what bizzaro parallel universe does that even make sense? There is no amount of "social engineering" that can explain why you need someone to tell you the last 4 digits of YOUR credit card.

You don't ASK for the last 4 digits explicitly... That wouldn't hardly be "social engineering" would it?

You would ask something like: "The seller is saying he didn't receive the money. Which payment method did I use for my last transaction?"

Paypal isn't going to start reading expiration dates, issuing bank, card colors, etc., they're going to jump straight to the last-4 digits to identify which specific credit card was used. And there's nothing wrong with that (except not correctly identifying the person on the phone to begin with). PCI-DSS explicitly allows saving the last 4 digits of the card in the clear. You can't make a purchase with just that info, and it really doesn't make it possible to guess the rest of the digits, the CVV2, etc.

The last 4 digits of your credit cards are every bit as public as your date of birth, street address, phone number, mother's maiden name, etc. And any company that allows access to sensitive accounts from just that information, has zero security. And if their lack of security allows someone else to steal or misuse something you've paid for (like DNS entries) then they're is serious legal trouble.

Re:Sounds like a lawsuit waiting to happen

[isorox]

The reason is to verify that the number stamped into the plastic is the same as the number encoded on the magstripe. It's really easy to overwrite magstripe data. I have been asked to confirm the last four at grocery stores; they usually ask for the card, but if you recite the last four, it's usually satisfactory.

Chips are hard to overwrite.

You do use chips on your cards right?

Re:Sounds like a lawsuit waiting to happen

[Desler]

Last 4 are not a secret. Best buy and lots of box retailers now actually ask you for it when you check out. You have to broadcast it in the air in front of everyone in line.

Because your unable to just hand them the card to read?

Re:Sounds like a lawsuit waiting to happen

[gnapster]

Not here in the USA. I have never seen a chip-and-PIN-capable reader here at the point of sale. Not all countries are as advanced and security-conscious as, say, the United Kingdom.

Re:Sounds like a lawsuit waiting to happen

[nblender]

Not even Visa has a collective brain between them. They left a voicemail for me telling me there was this suspicious activity on my account and to please call "1-800-xxx-yyyy".... I called the 1-800 number on the back of my card instead (which was different than the number they left) and tried to convince the Visa representative what a bad idea it was for Visa to leave their phone number in a voice-mail... She kept trying to say "but we have you confirm all of your details with us so that we know it's you"... I was just not able to get through to her. So I spoke to her supervisor who was similarly afflicted and unable to be convinced.. I wasn't able to speak with the person holding the brain that day.

Re:Sounds like a lawsuit waiting to happen

[Alistar]

Indeed,

Up here in Canada, it is very very rare that I see a retailer that doesn't support the chip, but when I was down in Florida, I couldn't find a single one that took the chip, even major chains, including one we have in Canada.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

This, This is how the conversation should have gone, if it went any other way then Pay Pal is in CPNI violation and can be held liable for any and all damages. not to mention the huge ass fine that will be coming there way.

Re:Sounds like a lawsuit waiting to happen

[Anonymous Coward]

Im guessing the when you called in to the airline they had you verify the account first some other way and thus were able to tell you anything on your account.

Re:Sounds like a lawsuit waiting to happen

[CCarrot]

The last 4 digits of your credit cards are every bit as public as your date of birth, street address, phone number, mother's maiden name, etc.

Fun fact: when a company asks you for your mother's maiden name as a security question, you don't have to actually use your mother's maiden name...throws these type of 'social engineering' jerks all for a loop :)

Re:Sounds like a lawsuit waiting to happen

[Zaelath]

To be fair, corporations don't improve the situation. I had this conversation several times with Telstra staff:

Telstra: Hi, this is Telstra. We want to discuss your account, but to prove you are you, what's your birthday?
Me: You cold-called me, you need to prove who you are, not the other way around.
Telstra: But it's just your birthday, it's not ID.
Me: YOU'RE USING IT FOR ID RIGHT NOW!

Twats.

Re:Sounds like a lawsuit waiting to happen

[Culture20]

I know a few people who would do this just because they are too stupid to see the problem with what they are doing, that is why the are likely to spend their entire working lives on IT support desks without ever moving upward.

If they can't see why this is a problem (beyond maybe the first slip-up and a severe reprimand), then they need to not work any longer in an IT support-desk role, and instead be shifted into the restaurant business.

Re:Sounds like a lawsuit waiting to happen

[Culture20]

I'd just ask them to read the card instead. For the paranoid, cover all but the last four digits when showing it to the cashier.

Re:Sounds like a lawsuit waiting to happen

[Culture20]

I do that with salted hashes when I can. But, I had to use one once, and I said to the guy on the other end: "Now bear with me, because I encrypted the answer, so it looks like a long mess of numbers and letters and I'll need to tell you them a character at a time." His immediate response: "Yeah, that's it! I've reset your passphrase to #####" Me: "...."
So that's all it takes if you know someone doesn't use traditional words in the security questions.

Re: Sounds like a lawsuit waiting to happen

[Anonymous Coward]

Purchase something with your credit card and I'm pretty sure a lot of times the last four will be printed on the receipt. It has usually been considered okay to give out the last four because it's impossible to determine the original number but unique enough to use to differentiate between cards held by one person.

Re:Sounds like a lawsuit waiting to happen

[rthille]

Wow. Just wow. I guess you could go with things like 'battery horse staple ...', which hopefully the guy at the other end of the phone would insist the user read out...

Re:Sounds like a lawsuit waiting to happen

[ShaunC]

Like you, I'm still not seeing the security benefit. If I've encoded someone else's card data onto my Radisson hotel key from last year, all I need to do is remember what the last 4 digits of my victim's card are, and I'm good? Oh yeah, that's foolproof. Have the cashier swipe the card instead and they can look at whatever they want to.

The only thing Best Buy ever asked me for at checkout was my ZIP code, and I gave a bogus answer even to that, just on principle. They don't need my ZIP, Radio Shack doesn't need my address, etc. I just want to buy $X and get the fuck out.

Re:Sounds like a lawsuit waiting to happen

[Unequivocal]

I disagree - godaddy should not rely on last 4 digits of CC for anything related to security. Paypal giving up the last 4 digits is way less of a problem than godaddy relying on them. The two systems interlocked of course is where this real misery occurred.

Re:Sounds like a lawsuit waiting to happen

[metrix007]

American. USian is not a fucking term.

Don't think custom domains were his problem

[egranlund]

Avoid custom domains for your login email address

Honestly, I don't think that would have helped. I doubt it's much harder to gain control of someone's gmail, yahoo or hotmail account if they are as motivated as it sounds like his attacker was.

Once you gain control of anyone's email account, even if the attacker doesn't have custom domains to hold for ransom, they could easily threaten bank accounts, etc etc.

Re:Don't think custom domains were his problem

[Nemyst]

If your Google account doesn't have your credit card number on file and uses two-factor auth, I think it'd be a lot harder to crack into it even using social engineering. The problem is always that most sites are designed so that in the event of people forgetting EVERYTHING, they can still recover their account somehow. If we accepted that losing your password, your security data for recovery and your two-factor auth would mean you lose your account (or you need something very, very elaborate to recover it, much more than just your last four CC numbers), security would be improved.

The problem is that for every super-focused hack like this one, there's a thousand people who forget their access credentials and want their account back, so it makes more sense to have lax security and cover the biggest proportion of your audience.

Re:Don't think custom domains were his problem

[darkmeridian]

The problem with customs domains is that it created another attack vector that no one really thinks about. The attacker hijacked his mx records and directed his email away. Up until now, I was sitting pretty thinking that I was safe because I used LastPass to create a long fucking Google Apps password and Google Authenticator for two-factor security. I never considered the notion that someone could hijack my mx records. I'm going over to namecheap to enable two-factor authentication.

Re:Don't think custom domains were his problem

[PRMan]

It would be VERY hard to break into a Google account using social engineering. First you'd have to find an actual person at Google.

Re:Don't think custom domains were his problem

[isorox]

It would be VERY hard to break into a Google account using social engineering. First you'd have to find an actual person at Google.

That's easy, just find an active google-plus account

Re:Don't think custom domains were his problem

[CodeBuster]

First you'd have to find an actual person at Google.

As others have pointed out, they [Google] routinely ignore support requests and a real person almost never answers the support line. Some might think that this is a bad thing, but actually there's a silver lining. If you cannot call Google or contact support to reset your account then it's likely that an attacker will also fail to get through. Combined with the fact that no domain registrar is going to reassign gmail.com to some random caller and you actually have a fairly decent security situation. Hard to social engineer due to poor customer service and practically impossible to get the gmail.com domain MX record reassigned, especially over the phone.

Two-factor on GoDaddy?

[Admodieus]

If your account has two-factor enabled, any account change will require entry of that limited-time token. Now, if the person doing the social engineering was able to access the account in the first place with only the last four digits of the card number, then they may have also been able to bypass this or turn it off with the help of the customer support rep. But I didn't see any mention of this in the article and wanted to point it out for those who use GoDaddy and are afraid of a similar situation occurring.

Re:Two-factor on GoDaddy?

[jaymz666]

the godaddy person let him keep trying various numbers until it worked. How can you trust them when it comes to security at all.

These companies need to be held accountable for their actions.

Re:Two-factor on GoDaddy?

[AuMatar]

Are you sure about that? My guess would be that they have internal tools that can get around the 2 factor authentication- what would happen if you lost the token generator? In that case social engineering would still work.

Re:Two-factor on GoDaddy?

[rwven]

Godaddy would have just removed the 2nd factor for the same reason they handed over the "1st" factor. Hiroshima pretended he was the user, who has lost the ability to log in. They would have just reset the password and removed two-factor authentication from the account after the identify was "verified."

Re:Two-factor on GoDaddy?

[Anonymous Coward]

Hiroshima pretended he was the user

I think you may have the people in this story mixed up.

Re:Two-factor on GoDaddy?

[rwven]

Names maybe. :P

Re:Two-factor on GoDaddy?

[Anonymous Coward]

Working for a national company that does consultation work for medical practices, I have called several times saying, "I am a consultant working with client XXX who has a domain of YYYY. They don't have the credentials anymore; can you update the email address on the account so we can reset the password?"

They do it all the time, without fail. Even with a company that clearly has no relationship with the account they're talking about, sans the word of a stranger on the phone.

I've also spoken to GoDaddy before about domain transfers for my personal account. I told them that I had no access to the email account on file and they just changed it to an unrelated domain, let me accept the domain transfer, and changed it back to the original one.

GoDaddy is horrible. Switch registrars as soon as you can. I'm using Hover now, but I have only been using them for a couple of weeks. So far they seem like they're on the up and up, but we'll see.

I must be missing something.

[Anonymous Coward]

Can't he just get the domains back and then alert twitter to reclaim his handle??

Re:I must be missing something.

[jaymz666]

The attacker changed all the godaddy customer information, Godaddy doesn't believe he's the owner of the domains.

Re:I must be missing something.

[Anonymous Coward]

Maybe he never was the owner?

If he was then his registrar could lookup when the account was last changed, what the previous data was, and what to revert it back to.

Re:I must be missing something.

[geogob]

That's totally absurd. I can't believe a service provider like Godaddy has no record history or history of customer information change. Of course, this historical informaiton may not be available to the first level of customer support. But come on... that shouldn't be the end of it.

Actually, I'm surprised that a service like Godaddy doesn't have checks in place for cases like this. An account where ALL the customer information is changed within a short period of time, should raise alarm bells. The owner, under the contact information previously available, should automatically be contacted.

Re:I must be missing something.

[Anonymous Coward]

He should not have surrendered control of any other account. The attacker had no reason to return control of the domain to this poor fool; that the attacker did is mostly just luck. Mr. Hiroshima should have started a legal process against GoDaddy for control of his legally paid for domain name, as contractually required. Now that he surrendered control of some username, he will have to try to convince Twitter that he should get control of that back, but there is really no legal reason that Twitter must do anything.

Re:I must be missing something.

[firex726]

Similar deal happened to me and Steam a few years back, after a few ticket replies and me providing the expected government documents, they returned it to me.

Re:I must be missing something.

[jythie]

You would be surprised at how often services design their database to only have the most recent information, with no way to store historical version.

Re:I must be missing something.

[Anonymous Coward]

Depending on the design of your tables, it can be extremely difficult or even impossible to store historical information. Saving every change as a record makes querying for current information tremendously more resource intensive.

Re:I must be missing something.

[Anonymous Coward]

If someone is physically holding a .40 to someone's head and demanding they change over info, Twitter will be obligated to change it back.

Same with this guy. He was coerced into handing the info over.

Re:I must be missing something.

[mythosaz]

Anyone who's ever moved a domain from a stubborn registrar feels this guy's pain.

They'll look into his dispute, BY FAX, over the next few months, and send him a resolution by postal mail -- and by postal mail, I mean postal mail to the domains "real" (read: current) owner.

Re:I must be missing something.

[Immerman]

>The owner, under the contact information previously available, should automatically be contacted.
Agreed.
And they should be contacted *before* the change is made. I could easily see a carelessly written automated process change the domain information, and then send an "undo this change" email to the previous contact address, which thanks to the change is now actually under the attacker's control. Anything short of validation-before-change opens the doors to variations on the attack. And of course you don't want snail-mail validation, because that's slow and expensive. As are phone calls. (Pennies, *pennies* per minute. Do you have any idea how many sports cars per year that would buy?)

Re:I must be missing something.

[jythie]

*nods* and when one is first starting a company, designing tables like that is generally simpler, so a lot of places do so and then are stuck with them.

Re:I must be missing something.

[houstonbofh]

And while he did, all of his business websites are down, or diverted to malware lookalikes. That can cost tens of thousands of dollars an hour! Read the article. He was worried about he websites.

Re:I must be missing something.

[CCarrot]

Maybe he never was the owner?

If he was then his registrar could lookup when the account was last changed, what the previous data was, and what to revert it back to.

Oh wow, so you're saying that maybe this whole story is actually just a massive social engineering attempt by Hiroshima to hijack the @N Twitter handle???

I...I think my brain just exploded...

one action to take

[JaiWing]

sue GoDaddy. aiding and abetting in the act of a FELONY.

Re:one action to take

[Anonymous Coward]

sue GoDaddy. aiding and abetting in the act of a FELONY.

The act of capitalizing random WORDS you think are important does not MAKE other people agree WITH your statements. Not even if you're a crackpot conspiracy THEORIST handing out poorly-photocopied leaflets LINKING the rise in the price of creamed corn with an ethnic group in your neighborhood THAT you don't like.

lawsuit

[internerdj]

I'd be talking to a lawyer. Sounds like someone at Paypal owes $50k to Mr. Hiroshima.

Re:lawsuit

[Anonymous Coward]

There's no reason to believe the offer was real and backed up by real money.

Re:lawsuit

[Anonymous Coward]

I..I don't think that's how that works. Please read summary again.

Re:lawsuit

[u38cg]

Remoteness. Won't fly. Godaddy is the one to go after.

Re:lawsuit

[Solandri]

I really doubt that lawsuit would get very far. The only evidence against Paypal is the written testimony of a known criminal (the guy who conducted the attack). For all we know, the attacker could be a worker at Starbucks who lifted Mr. Hiroshima's credit card number when he bought coffee there. And he hates Paypal (like most of us do) so he's setting up a false trail leading to Paypal.

The real problem is using the credit card number as authentication of anything other than a credit card purchase. It's something that's seen by dozens if not hundreds of people in a month, and trivial to record with a quick photo. Absolutely silly to use it for identity verification.

Re:lawsuit

[Anonymous Coward]

Or a date with Danika Patrick... ;-)

Re:lawsuit

[Anonymous Coward]

Or a date with Danika Patrick... ;-)

...and her friend, herpes.

Re:lawsuit

[Pope]

I'd be talking to a lawyer. Sounds like someone at Paypal owes $50k to Mr. Hiroshima.

Nobody owes him any money whatsoever. He claims it was "valued at over $50,000", but it's worth exactly $0 until he sells it.

Re:lawsuit

[bill_mcgonigle]

Patience may be rewarded. Somebody will start using @N at some point, and that person will have a money trail to the criminal.

Re:lawsuit

[Anonymous Coward]

Nobody owes him any money whatsoever. He claims it was "valued at over $50,000", but it's worth exactly $0 until he sells it.

What's the purpose of the Kelly Blue Book, if, by your logic, every car is worth exactly $0 until it is actually sold?

If has evidence of receiving multiple offers to buy his handle at $50,000+, a court would place that value on his handle. The real question is whether he actually owns his Twitter handle or if Twitter retained ownership rights (read the TOS!). In the latter case, he would have to ask Twitter nicely.

I would hope Twitter intervenes on his behalf.

Re:lawsuit

[recoiledsnake]

This is where bitcoin comes in.

Re:lawsuit

[houstonbofh]

This is where bitcoin comes in.

A system where every single person useing it can track every single payment ever made. Your point?

Re:lawsuit

[guevera]

The purpose of Kelly Blue Book is to fool buyers about market prices -- it actually lists asking prices, but it sure doesn't make that obvious. Car dealers love them some KBB.

Re:lawsuit

[Anonymous Coward]

Not to belabor the point, but Twitter is not some fly-by-night operation. Surely they can at the very least lock down the @N handle until it is investigated.

Re:lawsuit

[Unequivocal]

Going further OT here.. My understanding is that transactions into and out of some bitcoin exchanges can effectively wash out this "paper" trail? So if the criminal seller and buyer arrange to exchange bitcoins via certain exchanges (designed to wash/hide transaction histories), criminal seller hands over one set of bitcoins and criminal buyer walks way with different bitcoins altogether? Since there's no regulation to my knowledge of money laundering in bitcoin exchanges (yet) this isn't even an illegal business practice?

"Don't 'Let' Them?"

[CanHasDIY]

don't let companies such as PayPal and GoDaddy store your credit card information.

I wonder, does Mr. Hiroshima realize that consumers have little to no (closer to the latter) control over what a corporation does with our credit card info once we make a purchase with them?

Does he know of some nuclear option the rest of us aren't aware of?

Re:"Don't 'Let' Them?"

[Anonymous Coward]

I think the implication was do not use CCs for purchases from either company.

Re:"Don't 'Let' Them?"

[Anonymous Coward]

bitcoin ;)

Re:"Don't 'Let' Them?"

[Laxori666]

You could try using temporary credit card numbers for all online purchases. Looks like citibank provides this service.

Re:"Don't 'Let' Them?"

[Anonymous Coward]

So you think he's telling us we should use PayPal instead?

Re:"Don't 'Let' Them?"

[Anonymous Coward]

i see what you did there.

Re:"Don't 'Let' Them?"

[bill_mcgonigle]

The most likely answer is one-time-use credit card numbers, which many banks offer. I haven't seen them yet for debit cards, which is a shame.

Re:"Don't 'Let' Them?"

[jythie]

Even if bitcoin itself falls out of favor, the tech behind it could indeed provide a good template for solving a number of problems credit cards have.

Re:"Don't 'Let' Them?"

[Jason Levine]

Except this same problem would exist for non-online credit card transactions. You go to a restaurant and pay your bill with a credit card. The waiter takes it into the back to charge it. One quick smartphone camera snap later and he has your entire credit card number. Two if he takes a photo of the back to get the 3 digit code there. Even if the waiter is honest, the credit card information can go into the company's databases which can then be hacked (e.g. Target, Michael's). Even if all this doesn't take place, the last four digits of your credit card number are printed on a piece of paper that can easily be misplaced/stolen and obtained by someone else.

Re:"Don't 'Let' Them?"

[PraiseBob]

I've seen quite a few websites that give you the choice as to whether you store the card for future payments or not. Looking up payment history is typically a different process than looking at the card information that is stored directly in your user account records.

At the extreme, you could use your main credit card to purchase multiple one-time use visa gift cards. Then your card information doesn't match between websites, and you can expose the full card number of a now empty card with no negative consequences.

Re:"Don't 'Let' Them?"

[CanHasDIY]

I've seen quite a few websites that give you the choice as to whether you store the card for future payments or not. Looking up payment history is typically a different process than looking at the card information that is stored directly in your user account records.

Like Amazon. People voluntarily giving info is not what I'm talking about, obviously.

At the extreme, you could use your main credit card to purchase multiple one-time use visa gift cards. Then your card information doesn't match between websites, and you can expose the full card number of a now empty card with no negative consequences.

That's actually not a bad idea, presuming you buy the cards somewhere other than Target.. or Walmart, or K-Mart, or any of the other retailers who hang onto your information without telling you about it (at least, not until after someone breaks in and steals it).

That is the situation I am referring to.

Re:"Don't 'Let' Them?"

[Anonymous Coward]

My bank used to offer one time (well not really one time, but you create them with a certain amount) electronic VISA debit cards and now they use Mastercard, surely some bank near you has the service on offer.

Re:"Don't 'Let' Them?"

[Anonymous Coward]

Does he know of some nuclear option the rest of us aren't aware of?

I'm pretty sure Hiroshima is aware of nuclear options

Re:"Don't 'Let' Them?"

[Anonymous Coward]

Oh, should you really be saying "nuclear" in a story about Mr. Hiroshima?

Re:"Don't 'Let' Them?"

[guevera]

Does he know of some nuclear option the rest of us aren't aware of?

I'd suggest Tyler Durden's approach. Bonus points for no radioactive fallout.

Re:"Don't 'Let' Them?"

[Laxori666]

True, it's just a lot easier and thus more likely to happen online. I guess. Maybe once I had fraudulent charges without losing my card and I might even be making that up. Twice the bank changed my number for security reasons saying there had been a data preach so perhaps it was preempted a few times.

Stupid people prevent us from having secure things

[jader3rd]

This is a story about how 'real' people hate secure things. Nerds are all about creating encryption and security that requires knowing a secret key. Real world people deal with the fact that they forget secret keys, and want companies to restore their data for them. So for companies to keep customers, they have to create workarounds for the secret keys.

As a result the only way to for sure secure something, is to not depend upon companies who have 'real' people for customers.

Re:"Social engineering"

[Anonymous Coward]

So Hiroshima is an idiot because someone convinced an employee at PayPal that he was infact the account owner and to give out the last 4 digits of someone elses credit card?

Or is he an idiot because someone at GoDaddy who also in breach of proper authentication of account ownership gave access to the person with the last 4 digits of the credit card number?

Help me out here, I am so confused about how him being less "worthless and superficial" would have stopped someone else from giving out his account information.

And this is why..

[Jaysyn]

And this is why I avoid Twitter, GoDaddy & PayPal like the plague they are.

Re:And this is why..

[Rob the Bold]

And this is why I avoid Twitter, GoDaddy & PayPal like the plague they are.

That's how to prevent this exact problem from happening to you. But why couldn't something similar happen with other parties involved? Just because we like to pick on GoDaddy here doesn't mean other companies don't have at least one employee answering the phone that can be fooled by some clever con man. The only sure way to prevent something of yours from being stolen or extorted away is not to have anything of any value to anyone else. And that solution has some obvious disadvantages . . .

Re:And this is why..

[Jason Levine]

Honestly, I don't see Twitter as being the issue here. He gave the person access to the Twitter account under duress, but Twitter can't differentiate between duress and willingly. You could substitute pretty much anything for Twitter - even Slashdot. (Though, I doubt few hackers would go to such lengths to secure a low digit user ID.)

Paypal shouldn't have given that information out, but the last four digits of your credit card are hardly considered a huge secret. Of all the people involved, GoDaddy's the guiltiest as they shouldn't be relying on that information as a "super secret passcode". They might as well use the person's middle name as the passcode.

Re:And this is why..

[Anonymous Coward]

What does Twitter have to do with anything negative here?

What good is using a stolen twitter handle?

[Anonymous Coward]

Why is a 1 character handle valuable anyway?

Also, won't everyone know it's stolen?

Re:What good is using a stolen twitter handle?

[Enry]

They do now.

Re:What good is using a stolen twitter handle?

[v1]

What good is using a stolen twitter handle?

it's a bit like a two character slashdot nick... my... precious...

not going to end well

[Gravis Zero]

i get the feeling that this is high enough profile where the extortionist is going to get a beatdown by one of the tech companies involved.

Multiple credit cards

[Dan East]

When the Target data breach happened, I commented here about some of the advantages to using throw-away, preload credit cards (which limits your potential loss and allows you to quickly switch to an entirely different account if you feel the other might be compromised). I was modded down by people who have bought into the whole big-bank credit card racket, and the attitude "why should I worry, when the bank is responsible and I'll eventually get my money back". Well here is yet another advantage of using preloaded credit cards. You load money on it, pay your annual hosting fees, etc, and then just toss it and get another next year to make the next annual payment. This story illustrates the advantages of using an entirely different credit card per service, so the card you use with Godaddy is not the same as you use with Paypal.

Yes, yes, it will cost you $3 each time you load a card to make that yearly payment, but you can decide for yourself what that extra $3 can buy you.

Re:Multiple credit cards

[dkleinsc]

Yes, yes, it will cost you $3 each time you load a card to make that yearly payment, but you can decide for yourself what that extra $3 can buy you.

Nothing, really, since the bank will eat the costs of the fraud. It's annoying, yes, and it's a bit of a hassle, but generally you aren't buying much of value for that $3.

Re:Multiple credit cards

[swb]

I like this idea, but have never used preloaded cards before. Do they work like "real" credit cards, ie, broadly accepted like any card? How do you load them up with money, can you buy value with a credit card or does it require a cash transaction?

There was a story in the paper today about banks reissuing 150 million cards due to the Target debacle and I thought -- why don't they just do that every year anyway? Or when they issue cards, maybe they should give you a 12 pack of cards that are only good for 30 days from first use, and then they auto-expire and you have to activate the next card in your pack. You can go on from there and get more restrictive and say that you can only have N active at a time, etc.

  Then I start to wonder how big the pool of possible credit card numbers is -- are there enough numbers total to allow everyone to suddenly use 10-20x as many as they use now?

Re:Multiple credit cards

[Anonymous Coward]

The catch there is that you (a) have to remember (or pay attention to reminders) to do that again next year (no automatic renewals for you), and (b) have to be reasonably sure of what your cashflow at that point next year will be. Oh, and (c), have to be sure the registrar's renewal system won't fuck up on you.

I managed to lose a domain because of some combination of the above. the (c) part was that the company's processing system billed the card before flagging the domain as renewed, and somehow errored out between those two steps. ("Transactions? We don't need not stinkin' transactions!"). By the time I got it sorted out, the domain had been flagged as expired and some third party had squatted on it. I've got auto-renew on my other domains now.

Re:Multiple credit cards

[Chris Mattern]

Nothing, really, since the bank will eat the costs of the fraud. It's annoying, yes, and it's a bit of a hassle, but generally you aren't buying much of value for that $3.

For Mr. Hiroshima, that $3 would have apparently bought him continued ownership of his single-letter Twitter account.

Re:Multiple credit cards

[Anonymous Coward]

Thank you Captain Hindsight, but who is going to use a separate credit card for every transaction they make?

Without the hindsight of knowing it was PayPal & GoDaddy he'd have to use a different CC for every single company he does business with. Is that what you're advocating? Loading a different CC for every bill you pay?

Re:Multiple credit cards

[Xylantiel]

You do not appear to understand what he is getting at. In the case referred to in the original article, the credit card info stored at one company was used as proof of identity to another company. i.e. your credit card can be used to identify you uniquely if you only use one credit card. On the other hand if you use pre-paid limited-use cards, this doesn't work. This seems like a general benefit to prevent companies from cross-tracking purchasing habits. But the interesting thing here is this case shows that it also provides additional protection against identity theft-type attacks using your credit card info. Basically because you don't have unique credit card info.

But really that godaddy would give control of your account to somebody that has your credit card info is outrageously stupid on their part. Credit cards are a payment method, not an authentication method. The bank will only eat the cost of payment fraud. This was probably some undertrained phone support person thinking there was no other way to get this guy's account access back, which is ludicrous since he probably has ICANN contact information recorded. They could have hung up and called him back using known-good contact info and the whole scheme would have fallen apart.

As others have said, the lesson is don't use godaddy since they are so "customer-friendly" that they are insecure. This just makes me glad that I moved away from godaddy a while ago.

Re:Multiple credit cards

[Anonymous Coward]

"Then I start to wonder how big the pool of possible credit card numbers is -- are there enough numbers total to allow everyone to suddenly use 10-20x as many as they use now?"

Ladies and gentlemen, I give you the easiest math problem of all time!

Re:Multiple credit cards

[PraiseBob]

First, the bank doesn't simply "eat" the cost of that fraud. They pass that cost on to customers.

Second, a "bit of a hassle" doesn't quite do justice to describing the process of having all your money stolen electronically at some inconvenient time, and then jumping through hoops for the process of reclaiming your money. Oh, were you busy? Because now you need to devote many many hours to this task immediately.

Re:Multiple credit cards

[Anonymous Coward]

Real credit cards also limit your potential loss. Most will not hold you liable for fraud, and if they try to, you can simply refuse to pay the fraudulent charges and let them try to collect on it. That's how credit works. Your outlay is nothing. A prepaid card, of course, isn't credit at all. In fact it's the other way around. You are extending credit to the issuer, by giving them your money up front on the promise that they will forward that money as payment for your purchases. It's no different than using a gift card except it's not tied to a single store. You're trading your trust in one faceless corporation for another faceless corporation.

Some cards offer VANs (virtual account numbers) that you can use as throwaways, without the hassle of actually getting a new card/account, if all you want is a layer of obfuscation between you and the merchant. Citi for example has this service and it's free to use. If you absolutely, positively need new, standalone accounts for every transaction and don't mind paying small fees each time, then you'd probably be better served doing this the old fashioned way, with money orders or cashier's checks.

It's not that you're wrong about desiring more security for your payment information. It's that your methodology is a Rube Goldberg machine.

Re:Multiple credit cards

[nabsltd]

Ladies and gentlemen, I give you the easiest math problem of all time!

Without domain knowledge, you won't get within an order of magnitude of the actual number of available card numbers.

For example, the first 6 digits of the card number are the "issuer identification number" (IIN), and the last digit is a check digit. So, not every arbitrary sequence of 16 digits can be used as a credit card number, and even fewer are possible because of the assigned IINs.

Re:Multiple credit cards

[Anonymous Coward]

My Bank of America (the horror!) credit card allows me to generate new visa numbers at will through their ShopSafe feature. I set a limit for it and each number locks to the first merchant that charges to it. All charges show up on my master account so I pay one bill. There is no fee for it and it is the perfect way to purchase stuff online. This feature alone keeps me from switching to a local bank or credit union since I haven't found any of them that offer the same.

Re:Multiple credit cards

[mounthood]

When the Target data breach happened, I commented here about some of the advantages to using throw-away, preload credit cards (which limits your potential loss and allows you to quickly switch to an entirely different account if you feel the other might be compromised). I was modded down by people who have bought into the whole big-bank credit card racket, and the attitude "why should I worry, when the bank is responsible and I'll eventually get my money back". Well here is yet another advantage of using preloaded credit cards. You load money on it, pay your annual hosting fees, etc, and then just toss it and get another next year to make the next annual payment. This story illustrates the advantages of using an entirely different credit card per service, so the card you use with Godaddy is not the same as you use with Paypal.

Yes, yes, it will cost you $3 each time you load a card to make that yearly payment, but you can decide for yourself what that extra $3 can buy you.

You've missed the point: the valuable thing is not the credit card or the fraudulent access it allowed, it's the DNS names and websites he's running. Having one-use credit cards may, or may not, have stopped the attacker in this case, but it definitely would not have secured the websites. Fraud and extortion can't be stopped by changing credit cards.

Re:Multiple credit cards

[Xest]

So would contacting the police or companies involved who could have gotten Twitter and GoDaddy to freeze all account access until identity was verified and access handed back to him but apparently he wasn't smart enough to do that either..

Re:Multiple credit cards

[bleckywelcky]

Would this be better or worse than using the bank-supplied CC number generator for each purchase?

Re:Multiple credit cards

[phorm]

And made renewals and all sorts of other things a bit pain in the backside...

Re:Multiple credit cards

[Anonymous Coward]

you mean this
https://www.bankofamerica.com/privacy/accounts-cards/shopsafe.go
and its free (included with certain credit cards)

Re:Multiple credit cards

[Anonymous Coward]

FYI citi credit cards also have this.

Re:Multiple credit cards

[david_thornley]

With a credit card, it's only mildly inconvenient. I notice the fraudulent charges, and dispute them via certified mail.

At that point, I am not out any money, since I don't pay the fraudulent charges. If the merchant doesn't dispute my claim, I need do nothing else. I'm not sure what the procedure is after that, since I've never encountered it.

And, yes, the bank takes its cut of the transaction, so purchases are slightly more expensive for me than if every transaction was cash. As far as I'm concerned, it's worth it.

Re:Multiple credit cards

[Anonymous Coward]

You can work out the maximum pool using the restrictions of the Luhn algorithm.

Beyond that - https://www.bluebird.com/ is Amex & Walmart's (what a pair) entry into prepaid and seems like an easy setup.

Another alternative is keep the big bank but use their auto-number generator for each online transaction see http://www.fatwallet.com/forums/finance/761509/ for more.

Re:Multiple credit cards

[Anonymous Coward]

i.e. your credit card can be used to identify you uniquely if you only use one credit card. On the other hand if you use pre-paid limited-use cards, this doesn't work.

That's only valid if you use different cards, this guys could have used "limited-use" cards, but if he used the same for GoDaddy and PayPal, he would be screwed anyway. One would need to use a different card for each transaction to be resistent to GoDaddy's incompetence.

Re:Multiple credit cards

[CCarrot]

And made renewals and all sorts of other things a bit pain in the backside...

Not really, not if you use Google Wallet or PayPal. Payment is still coming from the same processor, you just have to be sure that a card with sufficient funds is loaded and selected as the primary payment method (got burned by that once) before the renewal date, and you should be good :)

I won't use anything but gift cards for micro-purchases like Apps and stuff. Google has enough info on me, no way they're getting a live CC number too...

Re:Multiple credit cards

[Kalriath]

No, the bank does not eat the cost of the fraud. The merchant does, and Visa/Mastercard/Amex merchant agreements forbid doing anything to reduce that risk (e.g. ID sighting)

Re:Multiple credit cards

[Kalriath]

Plus let's not forget that it's run through an algorithm (Luhn) which must equal a certain number (or is it multiple of a number).

Re:Multiple credit cards

[Anonymous Coward]

The bank does pass the cost on to customers, but not directly.

Fraudulent charges reported by consumers actually end up costing the business where the fraudulent transaction was made. The bank marks the transaction as fraud, and takes the money back from the merchant. There's very little direct cost to the bank. Sadly, this creates an ecosystem where there's little incentive for the CC companies and banks to do anything useful regarding fraud...because they carry little to no risk.

OR...

[pla]

OR! Does this Slashdot FP itself count as a social engineering attack by Naoki Hiroshima to pressure GoDaddy/Twitter/Paypal/SomeoneElseEntirely into submission, possibly for the stated purpose (control of @N), or for something seemingly unrelated but actually useful?

I kid, of course... I have no reason to doubt the story as given. I do find it odd that someone would actually break the law (at the very minimum, identity theft and extortion) in such a contrived chain of events... Just to gain control of something they won't even realistically get to use (can you imagine trying to use @N for the next few months through the massive volume of hate-tweets it will get?)

Re:OR...

[jythie]

On the other hand, if this was the case, it would be a truly epic example of social engineering (right up there with using the human flesh search community to carry out personal vendettas).. good enough that the person could probably write a book about it and probably get community forgiveness simply for being so ballsy.

Re:OR...

[hawaiian717]

I do find it odd that someone would actually break the law (at the very minimum, identity theft and extortion) in such a contrived chain of events... Just to gain control of something they won't even realistically get to use (can you imagine trying to use @N for the next few months through the massive volume of hate-tweets it will get?)

I don't, because it's happened before. I haven't reread the article to see if this states it, but I recall hearing that the reason the hacker did all this to Mat Honan was because he decided he wanted his @mat twitter handle.

paid poster pickens wordiest of all

[Anonymous Coward]

phewww

Should not be to difficult to get it back

[angel'o'sphere]

After all Twitter knows which new eMail-address is holding @N. Should not be to hard to figure the real person behind it. And simply asking Twitter to hand it back should also work.

So, fucking what.

[Anonymous Coward]

So fucking what. Now that @N has been stolen, file a police report. Tell Twitter that they're now obliged to send the IP of whomever uses @N to the police.

Good job, you've acquired a useless handle. Try to sell it? The buyer gets nabbed instead. Of course, the burden of proof of actual extortion is on the moron who handed over the credentials in the first place instead of contacting their hosting company. Smells like a dead fish up in here.

Re:So, fucking what.

[kaizendojo]

Oh how I would love to be there to see the RCA Victor Dog expression on the Police face when he tries to describe what the 'stolen item' is. "Your what was stolen now? Your bird? What the hell is a Twittle?"

Re:So, fucking what.

[Anonymous Coward]

Says the man with the nym from an 1871 poem.

Re:So, fucking what.

[kaizendojo]

Run by the townships communications/PR department. Not by the cop at the front desk who is going to look at you with a blank expression and say, "So what do you want us to do about it?" For a crime to be committed, the cops need to ascribe a dollar value to the stolen item. Having had my home broken into by a relative who took only mementos - irreplacable mementos - that had no real dollar value I can tell you first hand that they are not going to call out an APB for someone's Twitter handle. If you believe that they would, then I think you are the one living in a SNL skit.

Re:So, fucking what.

[Anonymous Coward]

Oh how I wish I had mod points right about now.... +1 Funny

Re:So, fucking what.

[JabberWokky]

My comment was about the crazy assertion that, in the year 2014, when Twitter is omnipresent on every broadcast network, overlaid on many cable shows, and routinely quoted in online news, the most likely result of bringing up Twitter to a professional law enforcement officer would be that they so unexposed to the concept of Twitter that they would genuinely have no idea what the term meant and think the person was saying their bird was stolen.

Anything you have ascribed to me beyond that would not seem to be present in either my comment, or the comment I was replying to.

Goodbye GoDaddy

[Anonymous Coward]

I will now be advising my employer to move all domains from GoDaddy to somewhere else.

Re:

[davide marney]

The moral is to not use a Registrar that allows domain updates from any IP. easydns.com, for example, can be configured to allow DNS updates only from a list of known IPs. That would stop this kind of deviltry in its tracks.

Re:comeuppance?

[Antipater]

"It's entirely your fault that a thief held a gun to your wife's head and demanded your Babe Ruth-autographed baseball. If you didn't have a Babe Ruth-autographed baseball in the first place, it never would have happened."

Yeah

[Anonymous Coward]

Because acting like a brain dead conturd is always the right response.

How about calling the FBI and then suing the companies that are going to take your livelihood in identity theft?

Giving in to extortion is never a good thing.

Re:Yeah

[Anonymous Coward]

CNN covered this story. Those are quotes of a US senator to a field reporter, yesterday, on the friggin air. Google it.

All right, I'll bite.

[Tenek]

I will assume since it hasn't come up already that there is some reason Twitter can't just give him back the handle. What is it?

Re:All right, I'll bite.

[Anonymous Coward]

They followed their own internal processes and were not to blame for acting appropriately. I'm sure they have reviewed it. They aren't going to add a new process that anyone could follow, to circumvent their current account protections.

Why would they alter an account because of a fancy story on the internet (that could possibly be partially or totally fake)? It's irrelevant to them.

Re:All right, I'll bite.

[JaredOfEuropa]

Twitter and similar companies have processes for "celebrity" accounts. This guy is no celebrity but perhaps sufficiently high-profile, and combined with the unusual @N nick and multiple attempts to steal the account as evidenced by the many password reset messages, there's enough grounds for an exception. Companies hate exceptions, but they hate bad press even worse.

Re:All right, I'll bite.

[Anonymous Coward]

> Companies hate exceptions, but they hate bad press even worse.

Again, this is not Twitter's problem. It's not a matter of bad press for them since they didn't do anything wrong. In the next 48 hours it might be reset. There's no legal obligation to do so and the current owner would have a decent legal recourse against twitter (from wherever he's originating) if he can prove damages. I have a feeling twitter will check on the current owner's responses before summarily stripping the account and handing it over to someone else (even a news-celeb). If nothing useful comes back in 48 hours to assure twitter's investigators, then it might revert.

Nope

[ledow]

This is like kidnap or a mugging. At no point do I have an actual incentive to give in to such a person's demands. "We won't hurt you / them / your website if you do X". I have *absolutely* no guarantee of that.

I *cannot* win. If I do everything you request, you could still trash my domain / stab me anyway / kill your hostage and there's nothing I can do to stop that.

As such, non-compliance is no different to compliance in such a situation. So why voluntarily give them MORE power over you / your assets?

As it is you would have to wipe servers, settings, email etc. and start again even if they did honout their agreement.

But then, you have to remember, this person is already committing a crime... what's in their conscience that will make them honourcan agreement concerning that crime.

Let them squirm, report them, regain control when you can, then purge their access from your systems.

Anything else is just stupid.

Re:Nope

[Anonymous Coward]

It isn't like a mugging at all. If he stabs you there's another charge against him in case he's caught.
Also, I'd rather give the mugger a few bucks than spend a few hundred in a hospital or die. You can pretend you'd be able to disarm the guy, but in my experience they usually grab you from behind and work in groups so unless you're Chuck Norris they'd put a bullet in you even if you somehow manage to kill one of them.

Re:Nope

[Anonymous Coward]

100% dead-on. Makes me think of the movie "Ransom" with Mel Gibson.

The whole world now knows... my son, Sean Mullen, was kidnapped, for ransom, three days ago. This is a recent photograph of him. Sean, if you're watching, we love you. And this... well, this is what waits for the man that took him. This is your ransom. Two million dollars in unmarked bills, just like you wanted. But this is as close as you'll ever get to it. You'll never see one dollar of this money, because no ransom will ever be paid for my son. Not one dime, not one penny. Instead, I'm offering this money as a reward on your head. Dead or alive, it doesn't matter. So congratulations, you've just become a two million dollar lottery ticket... except the odds are much, much better. Do you know anyone that wouldn't turn you in for two million dollars? I don't think you do. I doubt it. So wherever you go and whatever you do, this money will be tracking you down for all time. And to ensure that it does, to keep interest alive, I'm running a full-page ad in every major newspaper every Sunday... for as long as it takes. But... and this is your last chance... you return my son, alive, uninjured, I'll withdraw the bounty. With any luck you can simply disappear. Understand... you will never see this money. Not one dollar. So you still have a chance to do the right thing. If you don't, well, then, God be with you, because nobody else on this Earth will be.

Re:Nope

[Anonymous Coward]

Even after taking the cash, the extorter still needs some leverage to encourage the extortee to keep quiet and not involve the authorities. If the extorter takes the money and trashes the websites or kills the hostage, then the extortee has nothing to lose about raising a fuss and calling in the authorities to trace the money (and has evidence of a crime actually having been committed, rather than just claims about anonymous extortion demands). Honoring the extorter's side of the deal means the situation might stay hushed up longer, without drawing unwanted attention from committing the threatened crime. Honesty and integrity need not come into play.

Re:Nope

[Anonymous Coward]

Also this.
Why don't people think this true logically?
If someone is blackmailing you into doing something illegal the result will only be you in an even worse position.
Because now you can be blackmailed into doing things with whatever you just did for them.
Also, get in the car and drive or I'll shoot you. I think I'll take my chances and get shot here, where someone can find my body, rather than disappear and never be heard from again.

So you gave him your twitter account. Now he has your twitter, and websites. gg no re.
The correct response is to contact go daddy and the police or FBI immediately.
First of all wire-fraud, extortion, identity theft, a whole bunch of charges that you can throw at this person.
There is no second of all.

Re:Nope

[jythie]

*nods* the vast majority of real muggings, the person just wants the money. Give them that and they generally go away, quickly.

Kidnappings are a little more varied and vary by culture.

Re:Nope

[Jason Levine]

Easy to say right now. Harder to say if you are the one who is facing someone who has access to the DNS records of all of your websites (and has locked you out) or (even worse) a mugger with a gun pointed at you.

Re:Nope

[pspahn]

Right? I was talking with a friend that works for a pot facility here in Colorado. The news outlets are finally starting to catch wind of the fact that some of these people are moving $50k in cash on a regular basis, and doing stories about the security practices being put in place.

My friend said she was often nervous while doing her job, and I asked her, "If some dudes with guns came in and demanded the cash, wouldn't you give it to them and try to get them out the door as quickly as possible?" She obviously agreed.

I guess the only difference between that and this story is Mr. Hiroshima was never put in direct life-threatening danger. The example about mugging, however, is completely off base. If someone mugs you, you give them your shit and get a hold of the police. If someone mugs you and you have a bigger gun than they do and decide to use it, you're betting the rest of your life on a coin flip.

Re:Nope

[neminem]

I feel compelled to respond with a quote from Firefly:

  Simon: I don't think my last act in this verse is gonna be betraying my sister.

Jubal Early: You're gonna help me. 'Cause every second you're with me is a chance to turn the tables, get the better of me. Maybe you'll find your moment. Maybe I'll slip.

Re:Nope

[ledow]

I'm sure he's really worried about another charge when he's holding a knife and demanding your money. And in any decent legal system, knife offences are all pretty similar in scale, from possession to actual stabbing - because you have NO reason to be carrying it around without it being you threatening to stab people.

The fact is, you have no idea what his intentions are. He might well just be saving the time to search your body so he asks you first and always intends to stab you anyway. He's mugged you, the perfect way to stop you identifying him (if you're alone, pretty much the only way he'll get "caught") is to take you out of the equation.

Nobody's saying disarm him, you probably can't. But fuck him. Why help him get your wallet? Google your local area and "mugging stabbed" and see how many times the victim is stabbed ANYWAY, even after giving the money / phone / whatever.

If they grab you from behind, I agree, there's not much you can do. Fighting won't do much there. But why bother to help? They're going to kick the shit out of you anyway, and the more of them there are, the greater the chances of the fucking oddball who'll kill you for street cred is among the group.

I'm not saying resist, I'm saying don't help beyond what you need to. If they want your wallet, giving it to them or not isn't going to help you any because you can't trust them. But if they have your keys and demand you drive them to your house where your kids are, then it's a whole different (and more comparable to the situation) ball game. It's the same situation, scaled to the same extreme, and what fucking moron would go along with that if your kids aren't CURRENTLY under threat as they have no access to them / no idea where you live?

In that case, fuck 'em. Don't even have to be stroppy to them or fight back, just don't help them. Chances are, they have decided whether to stab you or not before you even know they are there. Your actions mean little.

And in this case, where nothing more than financial value is at stake, fuck them even more. The equivalent of "Hand over your bank account or I'll use your credit card?"... Fuck 'em.

Re:Nope

[Anonymous Coward]

the vast majority of real muggings, the person just wants the money. Give them that and they will keep doing it to other people

FTFY

So there's you are, at that moment, the only thing standing between Mugger McStabby and fifty innocent people, including the elderly, women, etc. You can risk your life to fight to protect the others, or you can pay him to leave you alone and go threaten and rob them instead.

Re:Nope

[orgelspieler]

Well, that mentality doesn't seem to bother shipping companies. They've been indirectly bankrolling pirates for a decade now.

Fighting a mugger is even more pointless than not paying a pirate. You're not protecting anybody if you know you're going to get your ass whupped anyway. AND they still get your wallet.

Re:Nope

[Anonymous Coward]

Agreed, but in the victim's defence, you don't have the luxury of calm, clear thought when you're the one under the gun.

In any case, I find it hard to believe that he won't get his account back in short order. Moreover, the criminal will most likely be caught, and everything will be as it should.
The criminal made no effort to keep the victim quiet after the deed was done. Did he plan what to do with the account after the did was done and he lost the leverage?
It's not like a typical ransom where you can take the money and run. He now has an account he can't use because it's unchangeable (which is why it was valuable in the first place).

This story just has stupid written all over it (from PayPal to GoDaddy to the genius criminal behind all this).
I predict the criminal to be a 20-something kid studying in a university. He did it for kicks and will be quite surprised when he learns there are hard consequences for what he did.

Re:Nope

[jythie]

well, if it is important to your manhood to punch out someone threatening you with a weapon, go right ahead. But don't pretend it is for hypothetical other people.

Re:Nope

[Rich0]

Believe it or not I've actually heard it argued that when terrorists hijack an airliner the military should just shoot it down killing everybody on board.

I'm not sure I like that approach, but if it were a credible threat it would certainly eliminate the incentive for hostage-taking. Terrorists might still try to blow up planes, but hijacking them is a lot more work with more risk of failure just to get to the same end result.

I guess that is what the russians were thinking back when they stormed that theater...

Re:Nope

[Anonymous Coward]

*nods* the vast majority of real muggings, the person just wants the money. Give them that and they generally go away, quickly.

And then mug someone else? If everyone adopts this attitude, doesn't it make mugging a very enticing occupation, since there is a sure reward with little risk? Seriously, I'd like to see a serious analysis of this - what's the best response at the system-wide level, not just individual?

Re:Nope

[dpidcoe]

This is like kidnap or a mugging. At no point do I have an actual incentive to give in to such a person's demands. "We won't hurt you / them / your website if you do X". I have *absolutely* no guarantee of that.

I *cannot* win. If I do everything you request, you could still trash my domain / stab me anyway / kill your hostage and there's nothing I can do to stop that.

If he wanted to trash your domain, he'd have already trashed it. Why risk letting you contact customer support and freeze everything until the identity thing could be sorted out. By not wrecking it straight away (and also offering to help secure it later), he was signaling that he was interested in actual reward, rather than just breaking stuff for the fun of it. Plus, trashing it after the fact just out of spite is bad for future "business" for him.

Re:Nope

[Anonymous Coward]

Plus, trashing it after the fact just out of spite is bad for future "business" for him.

Unless the message was digitally signed, the attacker has no way of proving it was him who did it last time.

Re: Nope

[Anonymous Coward]

So the kidnapper can just kidnap an adult, murder him, kill the kid and play hero.

Re:Nope

[Anubis IV]

There actually are some rather significant differences between compliance and noncompliance in such situations. For instance:
1) The risk/reward ratio may vary drastically, leading to different outcomes. In the case of a mugging, they may very well be unwilling to kill you, simply because of the greatly increased risk of getting caught and the greatly increased consequences if they should be apprehended. Robbing you with a knife or at gunpoint may be their limit, in which case your noncompliance could indeed result in an outcome that is more beneficial to you.

2) On the other hand, if you believe that the person you're facing is willing to kill you, then the most important thing for you is to remain useful for as long as possible. Should you not comply at all, they may cut their losses and kill you. Similarly, should you provide them with everything they need from you, you'd have made yourself a liability. In such a situation, remaining useful is of prime importance, because...

3) ...Your compliance or lack thereof can buy more time for you. This matters, since it may give the police time to find you, give a bystander more of a chance to walk by and disrupt things, or gives you more of a chance to find a way to win the encounter.

Long story short, you're quite correct that you have no guarantees. That said, there are certainly situations where you stand to gain something by providing them with some of what they want.

Re:Nope

[Anonymous Coward]

True, you have no guarantee, but the reasonable interpretation is this:

A) Hey B, give me that candy bar (@N) I want, or I'll burn everything else you own (domains).

B has two options:
1) Practical: Concede and hope they don't burn it all anyway.
2) Principled: Lose everything other than @N and risk that too.

Odds of A Saying" Oh, you refuse. I admire your principled stand and concede defeat, here's it all back" - less than good.

Re:Nope

[TangoMargarine]

The news outlets are finally starting to catch wind of the fact that some of these people are moving $50k in cash on a regular basis, and doing stories about the security practices being put in place.

"Hey, these guys seem to be moving a lot of money. Maybe we should do a story on it."
"You know what would be even better? If we described what their security is like so people can circumvent it."
"Heh, yeah."

Re:Nope

[TangoMargarine]

Completely unrelated, but that same guy made an appearance on a subsequent Tim Minear show ("Drive"), with Nathan Fillion in the main role...as a Detective Ehrle :).

Re:Nope

[Anonymous Coward]

I actually have some personal experience in this area, my Uncle was kidnapped by Colombian revolutionaries (the FARC) in 1994 and we paid two ransoms to secure his release.

We did have incentive to give into their demands because a professional kidnapper/extortionist has an incentive to honor their side of the arrangement; if they don't and this becomes known their future income revenue is threatened. It was well known that the FARC generally released hostages whose families paid, and killed those whose families did not.

I'm only posting AC because I'm lazy, my Uncle was Thomas Hargrove. You can google him, if you care to.

Re:Nope

[cas2000]

the best response at a system-wide level is universal unemployment benefits - the dole. as a right, not as some form of time-limited insurance based on their previous employment. ditto for universal health care, socialised health care, not private insurance.

in short, the things that civilised western democracies have but the USA does not.

people who have a minimal regular income, and are able to feed, house, and clothe themselves and their families are less desperate and less likely to commit crimes to get some cash. same if they are able to access medical services *without* going tens or hundreds of thousands of dollars into debt.

it's cheaper to society than the cost of crime, the cost of unsafe streets, the cost of police, the cost of hospitalisations or death when muggings go wrong, and it's cheaper than the cost of prison.

there will, of course, still be a tiny handful of crazies who prefer the criminal life, or are incapable of anything else, but there's nowhere near enough people like that for it to be a serious concern...easily handled by police. most people would rather not be criminals, or to be so desperate that they have no other choice but to threaten others.

Re:Nope

[Anonymous Coward]

A) Muggers don't think they'll be caught (likely for good reason, based on the descriptions in the "campus alert" e-mails I used to get). Thus, they don't care about hypothetical charges. Plus, it's foolish to assume they're objectively weighing the risks/benefits.

B) The OP's point is that you don't have a choice whether a mugger harms you or not. The mugger wants you to think you do, but has absolutely zero reason to comply with your wishes. Generally they demand you give up your means of resisting as well (e.g. your cell phone or weapon). Heck, most muggers don't even claim they won't hurt you if you obey, that's your mind desperately seeking some method to control the situation, so it does the illogical thing and trusts someone who just violated your trust.

Re:Nope

[jythie]

This is type of situation is actually covered in any good course on game theory.

Re:Nope

[pspahn]

Pretty much the same thing I thought when they were just doing local news stories on the subject. Now that these stories and being covered on national news, the cat is most certainly out of the bag.

Fortunately, there have been "sympathetic banks" that have been allowing these businesses to operate a bank account with a wink and nudge.

Re: Nope

[kaatochacha]

That's almost what happened in the movie: The kidnapper pretended to "stop" his accomplices, and claim the reward.

Re:Nope

[kaatochacha]

However, you paid TWO ransoms? It sound like the FARC weren't too terribly interested in disturbing future revenue.

Poor Hiroshima

[jez9999]

Looks like his account got nuked.

Re:Poor Hiroshima

[Anonymous Coward]

Too soon...

What you don't know...

[Junta]

Is that the current controller of N is legitimate, and *this* story is the social engineering attack to get control of it.

Re:What you don't know...

[Shatrat]

Hah, that's the first thing I thought of as well. He could have accepted that $50,000 and now be trying to get that domain back.

Re:What you don't know...

[Anonymous Coward]

It would be the most elaborate and unbelievable social engineering attempt ever. But the corroborating evidence is in favor of Mr. Hiroshima regardless of any idea that he might simply be trying to social engineer the account through public media.

Re:What you don't know...

[GameMaster]

Even if that were true, it shouldn't really matter to Twitter. I don't see how Twitter accounts should be any different than MMORPG accounts. Most of the companies that run MMORPGs have been fighting the idea that players can buy and sell accounts for about as long as the genre has existed. To a lesser extent, this might be because they are miffed that they aren't making any money off the transaction but the real reason has traditionally been that if virtual goods (like the account or items in the game world) can be shown to have a legitimate real-world value then there is a good possibility that they might end up with legal liability in the event that their server code screws up and erases the account (or, possibly, even if a bug in their code causes items in the game economy to loose significant value in the real-world).

Like I said, I would expect Twitter to see individual Twitter accounts the same way. I doubt they want even the possibility that they could be sued for the $50,000 that someone offered this guy for his account and would expect that if you looked at their TOS such transactions are probably a direct violation (I'm too lazy to check such things myself).

Re:What you don't know...

[Quirkz]

the real reason has traditionally been that if virtual goods (like the account or items in the game world) can be shown to have a legitimate real-world value then there is a good possibility that they might end up with legal liability in the event that their server code screws up and erases the account (or, possibly, even if a bug in their code causes items in the game economy to loose significant value in the real-world).

In my case, it was because I didn't want to deal with "I bought/sold an account but the other person ripped me off" reports. It's worthwhile to be very vocal up front that it's not allowed, even if you don't actually care, just so people realize they're doing such transactions at their own risk.

Re:What you don't know...

[Anonymous Coward]

That's, of course, a possibility.
But it should be painfully easy for Twitter's admins to look at the account's history and verify who's in the right.

Re:What you don't know...

[Anonymous Coward]

If you pay $50,000 for an account and don't get anything in writing, then you're a damn fool.
If he got it in writing, then he has nothing to worry about.

Hell, if it had been a clean trade, you'd expect the new owner to be fighting the allegations.

Re:What you don't know...

[wvmarle]

And that is exactly what makes social engineering work: the person being "engineered" (i.e. you) doesn't believe it's a fraud, instead considers it a valid story.

would be nice if...

[Anonymous Coward]

it would be nice if say GoDaddy, PayPal, and twitter made this right. Twitter should at least return the stolen handle, if not ban the other guy for doing illegal things.

Stupid stupid decision.

[Anonymous Coward]

He should have kept his twitter name and then sued the shit out of go daddy and paypal.

On a related note, is there insurance for these kinds of things?
My phisical stuff is all insured, so if someone steals my PC I can claim it with the insurance company.
Are there companies that do the same for domain names or things like that?

Also why are the last 4 digits of your cc number a "secret"? They are printed on the damn card, and hundreds of people get to see it.

Agree. Just call the police...

[Anonymous Coward]

Exactly. I don't understand what the issue is, the solution appears obvious.

Someone even says get a lawyer to sue for $50k. That's not how it works, someone steals something, you know how to get it back... simple.

What am I missing here? He never agreed, he was extorted. The 'agreement' to transfer ownership never occurred.

Re:Stupid people prevent us from having secure thi

[logjon]

So...run your own everything.

Re:

[Anonymous Coward]

And when your ISP hands you a new IP in a new range you've locked yourself out of your sites with that idea. Good job.

Good Old Paypal

[Anonymous Coward]

There are two types of people in the world. People who have been screwed by Paypal and people who haven't used Paypal yet.

Just rewards for using GoDaddy

[jtara]

Did you really expect GoDaddy to care about protecting your interests?

Some excellent alternatives were offered by respondents on the OPs blog, and I'll add another - moniker. Their claim to fame? They have "never lost a domain". And, so, they have a really good reason to keep others from taking your domain - they'd have to give-up that claim. They also offer a reasonably-priced enhanced security feature, though I feel it's unnecessary given the company's history. (And just checked, they still make the claim:

"Moniker is serious about security. In fact, in our history, we’ve never “lost” a domain. Not one."

https://www.moniker.com/domain...

While they aren't under their original ownership neither policies, convenience, nor responsiveness seem to have suffered. (You can always get ahold of them on the phone when there is a problem.)

I don't have any affiliation with moniker, other than being a happy customer. Happy to use a professional registrar that doesn't have a name that makes people snicker.

Use Two-Factor Authentication On Gmail

[HangingChad]

This story reminds me why I don't use GoDaddy and, if you haven't already done so, activate two-factor authentication on your Gmail account.

It's not bulletproof (what is?) but it's an extra layer of security that keeps a hacker from getting control of your email account.

Re:Use Two-Factor Authentication On Gmail

[EmperorArthur]

This story reminds me why I don't use GoDaddy and, if you haven't already done so, activate two-factor authentication on your Gmail account.

It's not bulletproof (what is?) but it's an extra layer of security that keeps a hacker from getting control of your email account.

The problem is quite a few of us with our own domains use a per site E-Mail address. It's useful to know that half my spam comes from equifax. Plus some people decide to forgo Gmail Labels and run their own mail server. In either case, when you have control of the domain you have control of all the E-Mails going to that domain. Many websites either don't have a password reset question, or the answer is easy to guess/brute force.

Put another way: Domain control = E-Mail control = Control of almost all your accounts.

Re:Use Two-Factor Authentication On Gmail

[Anonymous Coward]

Put another way: Domain control = E-Mail control = Control of almost all your accounts.

Did you not read the summary?

The person in question had their own domain with their own email server. The hacker managed to get GoDaddy to give him access so he could change the MX record to redirect all those "controlled" emails.

Gmail, being part of Google, is both highly secure against direct brute attacks (DoS, and such) and resistant to social engineering (Google's customer service is somewhere between terrible and non-existent, there is no way you'll get hold of a representative to socially engineer your way in to begin with).

Re:Use Two-Factor Authentication On Gmail

[balbus000]

I'm sure some people will poke holes in this, but this is what I currently do which works good enough for now:

• I have a personal gmail address that I only give to people I know and trust.
• I have the email address displayed above in the form kmcrandom+[COMPANY]@gmail.com that I use for online accounts. I have filters set up to automatically forward this mail to my primary personal address. So you can set up per-site email addresses without a custom domain.
• For online accounts that don't accept the use of a plus sign, I used the bare kmcrandom@gmail address, and forward email based on the sender domain.
• Mail that doesn't match either of those is immediately deleted.
• All forwarded mail is neatly labeled in my primary personal gmail account.
• I also have two custom domains that I use (very rarely) for professional contacts.

Both gmail accounts have two-factor authentication. I can easily block mail if spam starts coming to one of my assigned addresses. If people start guessing email address (kmcrandom+[GUESSED_COMPANY]@gmail.com) and start spamming, I could easily convert them to be kmcrandom+[UNIQUE_HASH_BASED_ON_COMPANY]@gmail.com.

I can't picture the endgame here

[idontgno]

A social-engineering blackhat extorted a distinctive and notable, and thus allegedly valuable, Twitter handle from its legitimate registered user.

Why?

It's like stolen art: the thief can't display it without implicating himself. The thief can't sell it, because the fool that buys it can't display it without implicating himself, and the thief by association (and vulnerability to investigative back-tracking).

So.... why?

A lot of work to go to for the sole purpose of effectively destroying a Twitter handle.

Re:I can't picture the endgame here

[jythie]

With art this tends to be true because law enforcement has a very good network of international agreements and cooperation for tracking such things down and are willing to expend the energy to do so.

With something like this, not so much. It could easily go to some anonymous buyer who covers their identity well enough and then uses it for spam or marketing or whatever. It could even go to some private organization that use it among themselves.

Re:I can't picture the endgame here

[Pope]

Same reason they put the @mat guy through hell: the hackers have some stupid reason to believe that short Twitter handles are "valuable." There was a big run on short or common word domain names back during the dot-com boom, because this whole Web thing was new and people didn't know how to use it. I guess this is the same thing.

Re:I can't picture the endgame here

[Anonymous Coward]

Because he can. He's probably 16.

Re:I can't picture the endgame here

[Lehk228]

For the Lulz.

Re:I can't picture the endgame here

[Anonymous Coward]

So... why?

How much can be sent by how many slave machines in 5 minutes?

There would be no security trail as anything used to access the Twitter account would not lead back to them, that would all be stolen or false. No risk to the cracker.

Remember a Hacker harms no one, so anything that does harm is NOT a Hacker, they are CRACKERS! Big difference.

Such a use would ultimately cost him the Twitter handle as well.

Question

[Anonymous Coward]

Why, with this story and confirming emails and confirmations from both Go Daddy and Paypal, would Twitter allow the @N name to be used by the attacker anyways?

Twitter needs to step in and remove control from the attack and return it to its proper owner, GoDaddy needs to rip their security team a new one, and Paypal needs to find out who screwed up by giving out credit card info over the phone.

My question is this: While the Hacker was successful in using Social Engineering, what did he THINK would happen when the story broke? That he'd be allowed to retain control of the Twitter name? Is he that daft?

Windfall

[nitehawk214]

The good news for him is that PayPal and GoDaddy and Twitter now owe him a hell of a lot more than $50,000.

Re:comeuppance?

[Anonymous Coward]

If he wasn't on Paypal, then this never would have happened. If he wasn't on GoDaddy, then this never would have happened. If he didn't use credit cards, then this never would have happened. If he didn't use a computer, then this never would have happened. You aren't presenting as simple a solution as you think you are.

It goes deeper than GoDaddy, unfortunately.

[An Ominous Cow Erred]

Simply put -- consumers can't be trusted to be able to deal with complex secure authentication schemes. That's why there's so many easy-to-guess "What city did you grow up in?" password-reset functions. There are so many weak links in the chain of trust, it takes a concerted effort on the individual's part to secure it.

The CEO of Cloudflare fell victim to this when someone CONVINCED AT&T TO REROUTE HIS VOICEMAIL, starting a chain of events that wound up with the interloper having complete control over Cloudflare and the myriad of sites that use CF (and therefore trust it to send legitimate data).

It's a bit exciting/fascinating to read about the chain of events, (particularly the timeline):

http://blog.cloudflare.com/the...

http://blog.cloudflare.com/pos...

Re:It goes deeper than GoDaddy, unfortunately.

[Rich0]

Simply put -- consumers can't be trusted to be able to deal with complex secure authentication schemes.

What complex secure authentication scheme would that be? Is is the one where you authenticate somebody by determining if they know an unchanging number that they provide to every single person they do commerce with? I'll take the NSA's ECC RNG over that any day...

Re:It goes deeper than GoDaddy, unfortunately.

[TangoMargarine]

That's why there's so many easy-to-guess "What city did you grow up in?" password-reset functions.

My favorite bit is when a lot of sites won't even let you come up with your own questions.

Re:It goes deeper than GoDaddy, unfortunately.

[Cro Magnon]

And they ask questions that are totally meaningless to you (such as "Where did you meet your wife?" to the average slashdotter).

Multi-factor authentication on GoDaddy

[marcgvky]

I am a GoDaddy customer and had a problem with my ex-partner: he tried to social engineer his way into grabbing control of our domains/email accounts, hosted by GoDaddy. Subsequently, I enabled a feature that GoDaddy offers. GoDaddy sends a text message that I must respond with. This extra factor is required for all changes, now. People should enable this feature, regardless of where you host your email. It makes it impossible to social engineer your way past a customer service rep.

Re:Multi-factor authentication on GoDaddy

[pspahn]

I use Google Voice as my phone number, you insensitive clod!

Re:Multi-factor authentication on GoDaddy

[wvmarle]

"Hey godaddy, my house burned down with that phone in it, so I can't get to those messages nor or ever, please change it to my new number 1234-4321 so I can receive your messages again."

Re:Multi-factor authentication on GoDaddy

[marcgvky]

For all of the mentally challenged, SMS is a mobile phone protocol, retards.

Re:Multi-factor authentication on GoDaddy

[wvmarle]

And how is it not possible for a mobile phone to burn, or get lost, or otherwise cause you to lose access? It's quite interesting you even thought I was talking about a fixed line. That option never crossed my mind when writing that comment.

Re:Multi-factor authentication on GoDaddy

[Anonymous Coward]

...Subsequently, I enabled a feature that GoDaddy offers. GoDaddy sends a text message that I must respond with. ..

I hate security features that attempt to text to a phone number, usually a cell phone. And will not use them. Besides not everyone uses texting on their cell phone anyway. I want my phone to be a phone, I can text with my tablet, laptop or desktop.

I despise them (cell phone security BS procedures) specifically because I have been burnt by two different cellular phone providers for over $500 of calls that I did not make (one after adding all-I-could-eat text messaging for a high monthly fee).

Mentioning the cell phone providers is not significant, because if you go to RipOff Reports and search for every possible provider, you will see litterally thousands of complaints for each one. Same is true for every Bank in business today, except with the banks, RipOff Reports usually shows 4,000 ~ 10,000 complaints. These complaints are customers stating they are being ripped off by the companies that supposedly care about customer service. More like Customer No Service

Unlike the Better Busines Bureau, where a company can pay money when a member to remove the complaints from the public eye. With RipOff Reports Customers complain, and companies can respond. However the complaints are NEVER removed. Thus you can see the complaint and see if the rip off reported company even bothered trying to satisfy the customer. These large corporations do not bother even trying to make it right!

Seems companies today don't care about customers, they think of you like a mushroom and that you will not churn away from them when they treat you like crap.

Always churn when treated wrongly. Its the only way to be a valued customer, you have to be willing to walk away. Eventually a company will enter the market and earn your business and be worth staying with, let the others whither on their shrinking vine and die. Never do business with a company that has ripped you off, even if they are the only company offering that service. Do without the service. You can not settle here, never ever.

• They (both cellular companies) refused to work with me to reverse the charges even after I offered to prove that the calls on my statement had not been made by me. (I went through a year of statements and had never called those numbers, even though they tried to say I did) Based on reading RipoffReports, this is common for carriers to put charges on a customer's bill and refuse to remove it, they make allot of money. You think they would want to keep a customer over over 3 to 5 years (first time) and 1 1/2 years (second time). Wrong, they just want the money, they do not care about the customer.
• One company tried to tell me I was not paying the fee for a paper copy, sent only a summary copy of the bill and refused to send me an itemized copy of the bill so I could see the calls. (A neighbor working for the company got me a copy of my itemized bill, unofficial)
• Never sign up for more than a 1 year contract, as they screw you over in year two and you will have to pay for another two years or be sent to collections. Get yourself in a position to churn as soon as possible, 1 year contracts MAX. There is a company in New York where you can purchase new handsets for full price, thus never get locked into a multi-year contract. It might seem expensive at first, but having the ability to churn is worth it.
• I ALWAYS pay the $1.00 fee for the paper statement, these two experiences verify how important this is. One provider even told me that I had not been paying that fee, therefore the summary bill that they sent i

Re:Multi-factor authentication on GoDaddy

[konohitowa]

"Hey AT&T. I need a new phone shipped to my current address. Thankfully I'll be keeping the same number."

Re:Multi-factor authentication on GoDaddy

[Anonymous Coward]

Carriers will give you a new SIM for a new phone, with the same phone number. Of course, that too can be a vulnerability.

stand alone email addresses?

[retech]

I'm a strong believer in having individual email addresses for each important login. I don't think I have a single email address that is related to more than 3 logins max. This greatly limits the ability to have a single breech allow someone into the entire kingdom. While this may not be as convenient as having a single pass login.... I'm ok with that. I keep everything in a password wallet (locally, no cloud usage) to have it all organized.

What about @A to @Z \ @N?

[angel'o'sphere]

Should we not all now jump up and try the same for the other one letter handles? As a matter of civil upsetness?

Re:What about @A to @Z \ @N?

[T.E.D.]

As near as I can tell, the only "perk" one gets for having a one-letter twitter ID is relentless attacks from criminals. Why on earth would I want that?

Re:"Social engineering"

[Anonymous Coward]

Just admit it. You are an idiot for not reading the story and then making stupid assumptions about who did what.

Re:"Social engineering"

[Impy the Impiuos Imp]

Go Daddy should be on the hook. How stupid!

"Hi, I need the last 4 of my spcial security number so I can prove I am who I am. I, uuuuh, lost it, so can you tell me it?"

Re:"Social engineering"

[Impy the Impiuos Imp]

Er, Paypal.

Re:

[pspahn]

How do you think whitelisting works bright guy?

Re:"Social engineering"

[carnivore302]

Seems to me Mr Hiroshima was given some time. Why not give godaddy and the fbi a call? See if they can set up a trap for the hacker?

Re:"Social engineering"

[Sarten-X]

Hi, this is $name with account $account, and I had my identity stolen a while ago. They changed all of my account information, and I want to check to see if this account was hacked. What are the last 4 of the SSN on the account?

Of course, the customer support rep wants to be helpful, and the person already knows the other account identifiers... so the idea of fraud never crosses their mind.

Re:comeuppance?

[Rob the Bold]

And how about don't swim with sharks?

If he wasn't a social media (value = what exactly?) then this would never have happened anyway.

Don't get your desirable twitter handle stolen by not having it? I can think of a car analogy for that.

The city in which you were born, your first pet...

[J'raxis]

This is the kind of thing made possible by the absolutely stupid policy of protecting unobtainable information (one's login password) with easily obtainable information (those "secret questions" to reset one's password, such as the city in which one was born, one's first pet, or the last four digits of one's CC or SSN).

If you choose a password that is strong enough, and you're careful enough not to leak it yourself somehow, your password is unobtainable and unguessable. It's as secure as possible. But it requires only a modicum of effort, perhaps a simple public records search, to figure out the answers to most "secret questions" that big companies like GoDaddy use to protect people's passwords. And yet this is how these companies protect your password. And now we see the results.

Sue PayPal and GoDaddy!! And why believe hacker?

[logicnazi]

This was a thing of substantial value and his own willingness to trade it for his custom domains is a compelling argument they too are worth a similar amount.

Thus, if he can prove negligence or some other cause of action against payal or godaddy he should be able to receive at least 50k damages. Personally, I suspect paypal is the better target as various privacy laws may have been violated. Of course a real lawyer would have a better idea of whether he has a case.

------

Frankly, it's hard to see what could have made this trade a worthwhile deal. I mean, either the hacker already had control of his email through a dns change or he didn't. If the hacker didn't what about the trade would make the extortion victim believe the hacker would behave differently if he turned over the domain than if he didn't? I mean he could presumably still decide to be a dick and use his access to delete the data.

And why not simply pretend not to be at his computer? He could have called godaddy and the like to lock down all the domains.

Re:"Social engineering"

[Immerman]

That would be Paypal that gave out the last four digits. And really, that's not at all uncommon - you can usually get that information from just about anyone who's holding your credit card information "Hi, I wanted to confirm which card I have associated with this account. Are the last four digits 1234? No, they're 8462? Ah, that explains it, thank you." Hell, they tend to be listed on every single email receipt sent unencrypted across the internet.

GoDaddy is still on the hook in my eyes though - given the completely unsecure treatment of the last four by pretty much everyone, using it for any sort of authentication purposes is completely asinine.

No need to get different cards

[Sycraft-fu]

You can get a bank that will let you make throwaway cards. Bank of America does. You specify how long in the future ti is to expire and how much its limit is. It'll create a throwaway number for you. It is charged against your regular card, but is a separate number with a separate limit that you can shut down as needed.

Um...

[scubamage]

So, why wouldn't he reach out to one of the 3 letter agencies involved with things like this (namely the FBI)? At the very least with their help he could have pulled in the 3 companies into a conference call, explained what was going on, and gotten this resolved pretty quickly. It's pretty easy to say "Here is the information that was used to open the account, block all recent changes." Or did the hacker somehow get control of his phone too? Am I missing something?

Here is what I don't understand

[Registered Coward v2]

Twitter controls @N. Once he has his domains back and secured twitter should be able to transfer control of #N back to him. It's not lil ether can't reset passwords and registration data. Whomever took it might even have useful info to track them down.

Re:The city in which you were born, your first pet

[femtobyte]

That's why your answer to security questions shouldn't be any weaker than your main password. What was your first pet's name? "e3d0b512214fa". What street did you grow up on? "aa16b70cc9526fe". Store the answers in your own strongly-encrypted password file. Just because they ask for weak identifying info, doesn't mean you have to play along.

Re:"Social engineering"

[Anonymous Coward]

Just admit it. You are an idiot for not reading my comment and then making stupid straw men.

Seriously. Read my comment. It doesn't mention Hiroshima at all, you ignorant piece of trash. But again, he's an idiot too.

Visit Twitter HQ

[Animats]

He's in Pasedena, California. Twitter is in San Francisco. It's a cheap flight. He needs to get a lawyer in SF, and make an appointment with Twitter's general counsel. Bring birth certificate and passport. If Twitter then fails to return the handle, use phrases such as "complicit with extortion".

Re:Visit Twitter HQ

[david_thornley]

There's no evidence Twitter did anything wrong. They may have an account recovery process, but it won't involve a lawyer. It may be possible to get some sort of legal finding that he was acting under duress, and in that case a SF lawyer might be a good idea, but there's no point in starting there.

Re:Visit Twitter HQ

[Animats]

Yes, there's a point in using a lawyer when $50K is involved. You don't just use lawyers for litigation. They're also useful in negotiation. If you put a lawyer on the job, the other side will usually put their lawyer on the job. This totally bypasses the customer service level and makes things happen.

E-mail is the key to the castle.

[wiredlogic]

The lesson here is to always use a unique, e-mail specific password for each e-mail account because they are a gateway to generate password resets for other, less critical accounts that may share passwords for convenience.

Re:E-mail is the key to the castle.

[psithurism]

That is an important fact, but in this case, the lesson is: don't do business with companies that can't deal with social engineering.

The hacker didn't have to guess his passwords and it looks like he didn't even try. The hacker just social engineered paypal and then godaddy to hand over control.

What about the police?

[ConfusedVorlon]

This seems like a clear case of extortion and theft.

At the very least, the police ought to be able to recover the stolen property via Twitter.

How would you like your steak?

[asylumx]

writes at Medium that he had a rare one-letter Twitter username

Well done.

Re:How would you like your steak?

[Anonymous Coward]

\makeatletter
now it's a two-letter username. Not so rare

WOW KUMK story is interesting too

[Anonymous Coward]

"My Twitter profile linked to my website, my website had WHOIS information. I use a very very old address on all my public WHOIS records, but it happens to be the address of my parents, and since I’ve shipped gifts to my parents through Amazon, they had that address on file.

He then called Amazon with what little information he had gained and cried that he had lost his password and didn’t have access to that email address anymore. The representative caved and reset the password over the phone giving him full access to my Amazon account. His plan was to then gain as much information he could with Amazon (last four of credit card numbers, current and previous addresses, etc) and use that as ammunition to do the same thing with Apple. And it worked. He had an email in his gmail inbox with instructions on how to reset my iCloud account."

It's scary that people can use WHOIS to social engineer other information

counter-offer

[Anonymous Coward]

"Sorry, Danica is not available. Please pick any other driver."

Re:"Social engineering"

[Anonymous Coward]

"Hiroshima writes that..."
What an idiot.

My comment did not mention Hiroshima

It doesn't mention Hiroshima at all... But again, he's an idiot too

Really helping your argument. Not sure if troll or just a fool trying to weasel his way around his own stupid statements.

Re:

[Anonymous Coward]

How do you think it works? How is someone whose IP address suddenly changes with no warning supposed to retroactively whitelist that, "bright guy"?

I don't get it...

[bob_super]

Can anyone explain what the finality of stealing @N by force is?

Who's going to follow it, buy it or use it when everyone knows that it was stolen by a hacker?
it's not a Ferrari that you can still drive, it's a bloody account to post links online, controlled by a company who can suspend it at will until an investigation is complete!

Re:I don't get it...

[mythosaz]

Street cred.

Re:Stupid people prevent us from having secure thi

[TCiecka]

This is the truth, some customers are not partial to jumping through hoops for secured access, at all.
For those of us that want the hoops, why don't these companies offer you the ability to opt-out of the 'workaround' security practices?

Rare, one-letter Twitter username

[Boawk]

Wow, that must be rare, there can't be more than about a hundred of those.

Re:Rare, one-letter Twitter username

[hicksw]

...there can't be more than about a hundred of those....

I find your faith in Unicode disturbing. Or UTF-8. Or, whatever

Or do you only use one handful of fingers to count? (26 base 10 = 101 base 5)

Apologies to people whose real character set exceeds 100 glyphs.
--
Let me know when a 3d printer can print replacement printer cartridges.

Re:"Social engineering"

[Joce640k]

Of course, the customer support rep wants to be helpful, and the person already knows the other account identifiers... so the idea of fraud never crosses their mind.

Um, they don't have to make a fraud/non fraud. The policy should be to never give out details. Ever.

Re:"Social engineering"

[Joce640k]

"Hi, I wanted to confirm which card I have associated with this account. Are the last four digits 1234?

"Our policy is to never give out that sort of information on the 'phone. Why don't you log into your account and check?"

Re:comeuppance?

[Anonymous Coward]

Right. If you don't want to get hit by a car then don't leave your home. Otherwise you were just asking for it.

Re:Stupid people prevent us from having secure thi

[Rich0]

This is the truth, some customers are not partial to jumping through hoops for secured access, at all.
For those of us that want the hoops, why don't these companies offer you the ability to opt-out of the 'workaround' security practices?

Because "real" customers would think they want to have the higher level of security, when in reality they still want the lower level of security. If the company offers higher security to them, the customer will accept it, and then the customer will get upset when the company delivers it to them. The customer will then change to a competitor who promises high security but in reality delivers low security, because that is what they really want.

Classic IT mistake - you need to deliver what the customer wants, not what they ask for.

Identifying the Gangster?

[Toad-san]

Wouldn't that be quite trivial, since he wanted the @N handle so badly and all? Surely someone can now identify the new owner of that handle?

And contact their cousin Vinnie in Joisey to go speak to him?

Re:"Social engineering"

[Anonymous Coward]

Not sure if troll

Just ignore him, Anonymous Coward is a known troll.

Re:

[gnapster]

If I can update the IP range, what is to prevent the attacker from doing the same? It's not like my ISP tells me when their servers are going to change my address. I understand, in general, how whitelisting works, but I don't know how it is handled by the registrars who provide this service.

Re:Stupid people prevent us from having secure thi

[mrchaotica]

Except that doesn't help, because you can't run your own domain name registration.

Re:The city in which you were born, your first pet

[i.r.id10t]

While you are at it, hope that the answers are stored with a hash just like a "real" password...

Paypal can do no wrong.

[Anonymous Coward]

No one that accepts Paypal TOS should blame Paypal for any thing. Getting Paypal account means giving Paypal complete access to your bank accounts, card accounts, all without liability to Paypal.
Read the TOS. Paypal can do no wrong.

godaddy two factor

[Anonymous Coward]

http://domainnamewire.com/2013/04/10/go-daddy-two-factor-authentication/

Re:"Social engineering"

[Anonymous Coward]

He's an idiot because he used GoDaddy. It's foolish to have registered a domain there that you consider worth more than a couple hundred dollars. The number of people who've been screwed by hosting at GoDaddy is large and that's hardly a secret.

Re:"Social engineering"

[Anonymous Coward]

No, you're an idiot. Take a look at the first 6 words from your post:

"A problem only concerning the gullible"

Since this is obviously Hiroshima's problem, you are directly implying that Hiroshima was gullible.

That paragraph goes on to say:
"If you're worthless and superficial, of course people will be able to fool you by acting."

Again, implying that Hiroshima was able to be fooled.

Admit it, it was a stupid post by a stupid AC that hadn't even bothered to read the summary properly.

But no surprise, all the AC's are stupid.

Re:Stupid people prevent us from having secure thi

[lostfayth]

This is only an issue of semantics - You don't offer your users a choice of "more" or "less" security, you have something along the lines of the following options:

(*) Allow account recovery if I forget my password (Default)
( ) Do not allow account recovery if I forget my password (This option is more secure, but makes your account unrecoverable if you forget your password!)

In other words, not "less or more" but "standard or more."

Re:"Social engineering"

[Immerman]

In an ideal world that's what should be done. But in a world where everyone else throws around the information willy-nilly? Then it's just poor customer support.

The only endgame that makes sense here is lulz

[Xaedalus]

I asked the same question as you, because @N is valuable only in the context of those who either make a living directly or indirectly due to legal association/ownership of a social media persona. As it is, @N is getting spammed to hell and back because of this notice, and until it gets publically returned back to its rightful owner, it's worthless. When I asked myself why a sane, reasonable, logical and rational person would do this given the expected outcome (which is happening now), the answer is, "because it's for the lulz". Someone wanted to intentionally destroy the value of @N, just to make a point that he/she could, and because it's "for the lulz". Maybe the intent wasn't to resell or own @N, maybe the intent was to show to certain individuals the capability to make that happen, and to be able to sell that capability.

why is this so hard?

[Anonymous Coward]

certainly twitter can work with law enforcement to track this guy down, then return the handle to its correct owner

Re:"Social engineering"

[SpaceLifeForm]

Should not take long. As soon as the new @N tweets, the NSA has the data, and they can pass it on to the FBI. Which is why this entire story is suspect to begin with.

Re:comeuppance?

[Valdrax]

If he wasn't a social media (value = what exactly?) then this would never have happened anyway.

And if she wasn't wearing those clothes, she wouldn't have gotten raped. Clearly, she was asking for it.

Blaming the victim for having something a criminal wanted is about the closest thing you can get in terms of being human scum to being the criminal himself. You should be ashamed of yourself, but you're probably way to smug about how your life choices wouldn't have led to you having anything this guy wanted. Like that somehow makes you superior.

Leaving a trail

[Chewbacon]

A big fucking trail. I mean, I'm no computer forensic investigator, but I believe the new owner of @N did it.

Why is this being looked at like he will get away with it?

Re:"Social engineering"

[houstonbofh]

Should have read the article. He had MANY high profile and high dollar business websites at risk. It was "Give me @N or loose all your websites."

Re: "Social engineering"

[Anonymous Coward]

"Hiroshima writes that a hacker used social engineering with Paypal to get the last four digits of his credit card number over the phone then used that information to gain control of his GoDaddy account."

What an idiot.

Nuke it from orbit. It's the only way to be sure.

Re:"Social engineering"

[houstonbofh]

Does not need to be obscure. SafeNames is well know, and yet has fantastic customer service. They are more expensive than GoDaddy, and for a good reason.

Funny thing about value...

[thevirtualcat]

The person who did this has gone a long way to ensure that @N has minimal resale value. If I was some company that was looking at @N for my online presence, would I want my online presence to be associated with this story in any way, shape or form? No. At least, not until the story dies down. And that could take a while, since people will happily drag it out again when someone sets up shop.

It could be for personal use, but that seems like a lot of trouble to go through for a personal account. Stranger things have happened, though.

How could the police find the attacker?

[clovis]

Beats me how the police would find them.

For one thing, he/she did this all under the name "Naoki Hiroshima".

I don't know for sure, but I'll suppose that the part done through the Internet was from a laptop with a spoofed mac address from some open wireless access point.
As for the part done over the phone, I kind of doubt that it was done from his home phone. Perhaps Google Talk or some other free Internet phone service.

That is all assuming that the attacker's story is true. I would not at all be surprised if it had been done by a PayPal or GoDaddy employee or associate, and all the hacking talk was a red herring.

Re: "Social engineering"

[iamhassi]

Agreed. We need to move to text message confirmation. Google, Facebook and Craigslist all send text messages to your phone before any major changes can be made to your account.

Re: "Social engineering"

[Anonymous Coward]

He's going to sell it to someone else, duh.

not so much

[Anonymous Coward]

While that's a good social engineering thing, it still shouldn't be accepted; the phone support should then say "Ok sir/maam, know let me authenticate your access by asking you a series of security questions"

He shoudl have contacted the FBI immediately

[Anonymous Coward]

And let the websites go.

They would have been returned.

Re:comeuppance?

[guevera]

Pointing out that something the powers that be consider a crime may actually be an act of extra-legal social justice is a perfectly legitamate comment. Sometimes, the 'victim' really did have it coming. In no way is that the same thing as saying rape victims are at fault for dressing sexy. Nor is it necessarily "blaming the victim for having something a criminal wanted"; would you say the same if the victim was the Sheriff of Notingham?

I know almost nothing about the people involved in this case, but if I had to I'd bet that your read on the situation is correct and the commenter you reacted to is an idiot. Still, attacking anyone who questions the rights and wrongs of the situation is kinda dickish.

And your particular phrasing of "having something the criminal wanted" combined with your assumption that the commenter's 'life choices' are the sole cause of his present level of poverty or affluence strongly suggests your a right wing asshat who should be taken out and shot for the good of the nation.

Re:"Social engineering"

[jbmartin6]

given the completely unsecure treatment of credit card and social security numbers by pretty much everyone, using it for any sort of authentication purposes is completely asinine.

I like my version better.

Trekked Off

[Tablizer]

You thank that's bad, Q is giving me hell over Q, literally.

Sending them is stupid...

[Anonymous Coward]

They're among the few unique numbers for the user. Try comparing your card against another person's from the same issuer. You'll quickly see what I mean.

Re:Sending them is stupid...

[Immerman]

So what? For security validation you want something easy to remember and hard for someone else to get their hands on. Duplication is irrelevant, and the L4CC#s are encoding-limited to 10,000 possible values anyway, I guarantee you there's *lots* of duplicates in Amazon's database. The last four digits of your library card number would work just as well. Or the first initials of the last four progenitors in your maternal line.

Or here's a thought - they could use a sequence of garbage alphanumeric characters known only to you and the company you're dealing with. Heck, even the company wouldn't need to know it after the initial setup, they could feed the sequence through a secure hashing algorithm to generate a "fingerprint", and accept any password that generates a matching "fingerprint". Then the only person storing the mystery sequence would be the end user, making third-party social engineering completely impossible. Imagine, we could use such simple, relatively secure technology everywhere, and since the sequence is completely arbitrary you'd have the option of using different sequences in different places, making things far more secure than having everyone who deals with you use the same four digits.

Re:Sending them is stupid...

[radarskiy]

"Or here's a thought - they could use a sequence of garbage alphanumeric characters known only to you and the company you're dealing with. Heck, even the company wouldn't need to know it after the initial setup, they could feed the sequence through a secure hashing algorithm to generate a "fingerprint", and accept any password that generates a matching "fingerprint". Then the only person storing the mystery sequence would be the end user, making third-party social engineering completely impossible. Imagine, we could use such simple, relatively secure technology everywhere, and since the sequence is completely arbitrary you'd have the option of using different sequences in different places, making things far more secure than having everyone who deals with you use the same four digits."

Imagine an automated form, where you could enter an identifier and that alphanumeric string and gain access without even waiting for human intervention!

Re:

[Anonymous Coward]

Really badly when your IP address changes to be outside the range of the whitelist.

He was extorted and robbed...

[Anonymous Coward]

Both Paypal and Godaddy helped his assailant, but your position is that he is owed nothing by these companies.

Good God.

Re:Stupid people prevent us from having secure thi

[Rich0]

Yes, and people will pick 2 and be upset that you held them to their choice, and then leave for your competitors. I didn't say that consumers were rational.

Re:comeuppance?

[Anonymous Coward]

If you didn't have a wife in the first place, it never would have happened. yeah, THIS is why I am single.

Re:The city in which you were born, your first pet

[david_thornley]

The problem with hashing the answers is that they aren't treated the same. Suppose my password is "Correct,horse battery staple". I can be expected to type it the same time every time, because it's a password. If my favorite child stuffed animal was "Lamb Chop", I might be asked that over the phone, or expected to type "Lamb chop" or "LambChop", so, depending on the company, close might have to count.

Re:"Social engineering"

[Wycliffe]

GoDaddy is still on the hook in my eyes though - given the completely unsecure treatment of the last four by pretty much everyone, using it for any sort of authentication purposes is completely asinine.

Lot's of places use the last 4 digits as authentication. Hopefully the same place that uses the last 4 digits aren't the ones handing
it out but that's part of the problem. Every place has their own "hopefully" adequate security but another firm might have a slightly
different authentication method that is also adequate on its own but combined with the 2nd firm there is a huge security hole. Then
there are the completely idiotic ones like "year you graduated" or "favorite color" There are what maybe less than a dozen common
colors and if you know the person's age you can guess the graduation year probably within a couple years. I've been given a list
of a dozen questions that none of them have more than maybe a dozen or so common answers.

Re:"Social engineering"

[radiumsoup]

I'm pretty sure it's the same guy just arguing with himself.

Re:"Social engineering"

[sexconker]

Seems to me Mr Hiroshima was given some time. Why not give godaddy and the fbi a call? See if they can set up a trap for the hacker?

This.
Call up GoDaddy and tell them what's going on. They'll lock shit down, you can provide the full credit card number, photos of your driver's license, etc. to confirm who you are.

how can they use the stolen username

[dsoodak]

Maybe I just don't know enough about how law works in this area, but it seems like everyone now knows that "@N" is stolen. What can the hacker do except post "hey, I'm the anonymous person who stole this account"? Is it legal to buy a stolen Twitter account? Can't he just contact the company and get it back? If regular identity theft worked this way then you'd get police saying "sorry sir, but he has your name, SS, and DOB, so he can now use your identity in any way he wants"

gandi.net good, godaddy bad, and dotster bad

[Anonymous Coward]

While we all know that godaddy will do horrible horrible things like give up access to or control of your domain or other account info there is another company whose just as bad. Dotster failed to follow there very own policies and handed over a domain in my possession to that of another multiple times (the very same domain name!!!!). They kept no track of this info either and at one point there was no way for me to re-gain access had I not printed off (for evidence) an order with the person who defrauded dotster into handing over access. The reason I was able to re-gain access was because I had that persons last 4 digits on the invoice.

Long story short I changed the email address back and then immediately sent a transfer request. Ultimately I was able to transfer it to gandi.net and when the person attempted to get gandi.net to hand the domain over to them they failed. Apparently gandi.net takes security a bit more seriously than dotster.

Invalidate the Handle

[Anonymous Coward]

If this actually happened, I don't see why Twitter can't just at least consider rendering the name permanently invalid. I would think, if nothing else, the terms of service would cover this as an unauthorized transfer of accounts, which is an act that many providers consider a situation where the account can be locked or deleted.

Re:"Social engineering"

[Immerman]

Actually I prefer stuff like the favorite color validation - you can usually say your favorite color is "hgydusafgs" and get at least a little security out of it. If they want your last four card digits, social security number (ick), or other widely shared, institutionally issued number then you're SOL.

GoDaddy admits they were social engineered

[SpaceLifeForm]

Link

Re:comeuppance?

[Valdrax]

Pointing out that something the powers that be consider a crime may actually be an act of extra-legal social justice is a perfectly legitamate comment.

How is it social justice to steal someone's Twitter identity just because it happens to be very short and catchy? Did you not read the post I responded to in which the poster blamed Mr. Hiroshima for "swimming with the sharks" just for being "a social media (value = what exactly?)" That's straight up blaming the victim of theft and extortion for nothing more than being popular in a forum the poster doesn't respect.

And your particular phrasing of "having something the criminal wanted" combined with your assumption that the commenter's 'life choices' are the sole cause of his present level of poverty or affluence strongly suggests your a right wing asshat who should be taken out and shot for the good of the nation.

His life choices for being a social media personality where what was being blamed for him being targeted. Poverty or affluence has nothing to do with this. He just was just an early adopter who got lucky that his first name's initial wasn't taken yet. That was why he was targeted. He had something that someone else wanted and wasn't willing to take the legal road or just accept his right to refuse. There is no justification for extortion for here.

Also, I'm solidly a progressive, but your lunatic off-topic strawmanning here is reminding me once against the only thing worse than arguing politics with an idiot is having one publicly take your side.

Re:Stupid people prevent us from having secure thi

[wvmarle]

Why not? Is there a quota on domain registrars or so?

Re:"Social engineering"

[Anonymous Coward]

"Give me @N or loose all your websites."

I dislike extortion but I really hate extortion from people who don't know the difference between lose and loose. These people should be caught and forced to retake fifth grade English class... and then be sent to jail.

Twitter Problem

[Anonymous Coward]

Which twitter can easily fix. But they won't. Before you go around trashing these companies, keep in mind that federal non-regulation has probably made it pretty to circumvent others verification by using data from other services. This goes back to network solutions transferring sex because of a fraudulent fax. Nothing happened to correct this then, nothing is going to happen now without religious nuts rising up against a mark of the beast.

Americans are about as dumb as they come.

Blame the Victim

[gd2shoe]

The term "blaming the victim" has been dubious since it's very origin. I'll grab text from Wikipedia, because it's handy:

The Negro Family: The Case For National Action (the 1965 Moynihan Report) was written by Assistant Secretary of Labor[1] Daniel Patrick Moynihan, a sociologist and later U.S. Senator. It focused on the deep roots of black poverty in America and concluded controversially that the relative absence of nuclear families (those having both a father and mother present) would greatly hinder further progress toward economic and political equality.

Moynihan argued that the rise in single-mother families was not due to a lack of jobs but rather to a destructive vein in ghetto culture that could be traced back to slavery and Jim Crow discrimination. Though black sociologist E. Franklin Frazier had already introduced the idea in the 1930s, Moynihan's argument defied conventional social-science wisdom. As he wrote later, "The work began in the most orthodox setting, the U.S. Department of Labor, to establish at some level of statistical conciseness what 'everyone knew': that economic conditions determine social conditions. Whereupon, it turned out that what everyone knew was evidently not so."

Moynihan had concluded that ... the uniquely cruel structure of American slavery [had created a pattern which]..., manifested itself in high rates of unwed births, absent fathers, and single mother households in black families. Moynihan then correlated these familial outcomes, which he considered undesirable, to the relatively poorer rates of employment, educational achievement, and financial success found among the black population. Moynihan advocated the implementation of government programs designed to strengthen the black nuclear family.

Ryan objected that Moynihan then located the proximate cause of the plight of black Americans in the prevalence of a family structure in which the father was often sporadically, if at all, present, and the mother was often dependent on government aid to feed, clothe, and provide medical care for her children. Ryan's critique cast the Moynihan theories as attempts to divert responsibility for poverty from social structural factors to the behaviors and cultural patterns of the poor.[8][9]

"We need to help these people understand how not to be poor." "RACIST, He's BLAMING THE VICTIMS!"

Ryan has set minorities back 4 decades. Unwed births among all races are now on the rise, and we see that there really is a strong statistical correlation with ongoing multi-generational poverty. We'd actually be a more integrated society if we'd dealt with this problem years ago. But no. The knee-jerk reaction is to assume that any action a "victim" takes must be their own fault (often false), and to assume that if anyone is in poverty, it must be someone else's fault (also false; sometimes it is, sometimes it isn't). By this twisted and broken logic, one can never suggest that an individual change their own behavior to change their outcome. Any attempt to suggest that minorities adjust their behavior or world-view has been met with vitriolic screams of racism. (In any degree, no matter how small a part of any larger plan.)

The phrase "blaming the victim" is inherently broken, not in concept, but in functional use. It is a poor excuse to make uncomfortable topics off limits, and it always has been.

Re:Stupid people prevent us from having secure thi

[Kalriath]

Well, you need to pay $3,500 to ICANN to apply, $4,000 per year in maintenance, a variable percentage of ICANN's operating expenses once a quarter, have access to at least $70,000 in cash or loans, and have liability insurance in the amount of half a million dollars.

And you'll get rejected if you're just trying to run it for yourself.

So no, you can't run your own domain name registration.

Re:Stupid people prevent us from having secure thi

[wvmarle]

Heavy requirements, making it definitely "can't" as in "not as private person".

Though technically you still can do it - just have to set up a big enough company to fulfil the requirements. Of course it's anything but easy or practical to do for just a few personal domain names.

Re:

[pspahn]

The same way I do when I try to SSH into a server and find out my IP address changed and is no longer whitelisted? I email the host's support and have them add my new IP to the whitelist.

I'm sorry if that's too inconvenient for you.

Re:"Social engineering"

[Wycliffe]

Actually I prefer stuff like the favorite color validation - you can usually say your favorite color is "hgydusafgs" and get at least a little security out of it. If they want your last four card digits, social security number (ick), or other widely shared, institutionally issued number then you're SOL.

Yeah, I agree that this partially solves the problem FOR YOU but not for anyone else who actually follows the rules. You've basically added your
own layer of security on top of theirs and it's technically a violation of the intended purpose of the system. It's possible that your account can be
blocked, banned, deleted, etc... for not following the rules. Even worse, by not following the rules it's highly likely that if someone calls in to try to
unlock your account and are asked what their favorite color is that the response "I think I just typed some random garbage into that field" would
probably be sufficient to get the account unlocked.

Re:"Social engineering"

[Anonymous Coward]

Since this is obviously Hiroshima's problem, you are directly implying that Hiroshima was gullible.

Incorrect. Social engineering is a problem concerning the people who gave away that guy's information. Clearly you don't know how to read.

Again, implying that Hiroshima was able to be fooled.

I never mentioned his name there. I was insulting the people who gave away the information, and absolutely nothing implies otherwise.

Quit making shit up, fool.

Re:Stupid people prevent us from having secure thi

[CodeBuster]

For those interested in higher security and willing to accept responsibility, Google should offer an option (confirmed by entering your password) to turn off account resets and only allow resets to be enabled again by entering the password. They could also use this password generate a private key, not stored by them, to decrypt the email on demand. This would mean that if you lose your password, your account is essentially gone but security would be much improved.

Re:The city in which you were born, your first pet

[J'raxis]

Of course. And using made-up answers is exactly what I do. But the vast majority of people don't think about this. They create a halfway-decent password then protect that password with "New York City" and "Fido."

Re:"Social engineering"

[Anonymous Coward]

namecoin domains are secure in the same way offline computers are secure.

What use is a domain that nobody I have ever know can access without tweaking their dns resolver?

Re:"Social engineering"

[sgtpooki]

it is.. but a lot of people are stupid. I used to work at PayPal, for three years actually, and despite how hard they try to make sure their reps are halfway competent.. some really dumb people with the teenager-working-at-mcdonalds mentality still make it through.

fake purchase

[Anonymous Coward]

Can anyone tell me what that means?

Re:"Social engineering"

[AlterEager]

My comment did not mention Hiroshima, but Hiroshima is an idiot for dealing with companies that are known to be shitty.

What, twitter?

thanks

[Rqzor]

interesting topic..thanks for all the answers - I learned a lot. I found something like than LINK what are you think about ?

Re:thanks

[Anonymous Coward]

This is a link to a website, about which I write in the post above www.app-extensions.com

Making credit card numbers meaningless

[Anonymous Coward]

Another reason to consider interesting ideas to make it useless to steal credit card numbers.

Raiding Facebook for security question answers

[tepples]

Security questions whose answer is probably easy to find from the mark's Facebook profile.

Re:"Social engineering"

[Anonymous Coward]

It's useful to everyone who knows how to tweak a dns resolver today, to everyone who can install a browser add-on tomorrow, and everyone everyone eventually.

My other online name is x1415926@

[FreedomFirstThenPeac]

Yet another reason I avoid cute and meaningful online names (most of the time, I guess I trust Slashdot more than any other forum). Who would go through all this just to steal x1415926@?

Bring in the Feds...

[Anonymous Coward]

Doesn't the FBI have a Cyber Crime Division for exactly this sort of crime?

Re:The city in which you were born, your first pet

[Cro Magnon]

It's slightly better if their pet is "New York" and they grew up in "Fido".

Use KeepassX

[Anonymous Coward]

And pwgen.

One letter is valuable????

[Anonymous Coward]

Holy tweets Batman! I have always had a one letter Twitter account and no one ever offered me anything. Could it be because I only follow others and have never tweeted my first twit? Just for the record my account was hacked once but I caught it immediately and after changing passwords never had a problem with that again.

So... Twitter can't just swap it back?

[Anonymous Coward]

An extorted Twitter handle isn't like extorted cash that may never be found and recovered.
The extortionist may not ever be identified and punished, but it's not like the handle disappeared, never to be seen again. They know where it is and how to recover it.

Easy fix?

[Anonymous Coward]

Ummm... don't use a single credit card for everything?
Sign up for multiple credit card accounts.
Keep your sh*t separate.

Sociopaths and Criminals exist

[jbgeek]

People generally feel safe, but it doesn't mean that they *are* safe.

Good reason to keep your good passwords, look after your cyber security. And being armed and trained isn't a bad idea either. :-)

What's a "custom domain"?

[hobarrera]

Avoid custom domains for your login email address and don't let companies such as PayPal and GoDaddy store your credit card information.

What's a "custom domain"? Or rather, which domains aren't custom?
I think that "Avoid evil companies like paypal and godaddy" are the only real lesson here.

Twitter should respond

[Anonymous Coward]

Twitter should respond by removing access to the @N account (after giving the Feds the info to chase and persecute the hacker-troll)...
Then they could achieve cool points and dev-cred by magnanimously giving access back to it's rightful "owner" Naoki.
Winning.