So last week I read an interesting tale about social engineering on Medium, a story by a chap named Naoki Hiroshima and his Twitter handle, which was @N.
Yes just one letter, a pretty rare and it seems valuable handle as he had offers of up to $50,000 for it. In the end though, someone decided they would just take it. Although there had been many attempts on the account before, this one was successful.
I had a rare Twitter username, @N. Yep, just one letter. I’ve been offered as much as $50,000 for it. People have tried to steal it. Password reset instructions are a regular sight in my email inbox. As of today, I no longer control @N. I was extorted into giving it up.
While eating lunch on January 20, 2014, I received a text message from PayPal for one-time validation code. Somebody was trying to steal my PayPal account. I ignored it and continued eating.
Later in the day, I checked my email which uses my personal domain name (registered with GoDaddy) through Google Apps. I found the last message I had received was from GoDaddy with the subject “Account Settings Change Confirmation.” There was a good reason why that was the last one.
Unsurprisingly, this cautionary tale involves two of the most hated companies online – PayPal and GoDaddy. GoDaddy has accepted partial responsibility though and has agreed that it needs to address and improve the processes that were abused in this case.
GoDaddy accepts partial responsibility in social engineering attack of @N’s customer account
PayPal however has denied giving out any information to the hacker, as would be expected from them:
PayPal denies providing payment information to hacker who hijacked $50,000 Twitter username
I changed my username @N to @N_is_stolen for the first time since I registered it in early 2007. Goodbye to my problematic username, for now.
It’s hard to decide what’s more shocking, the fact that PayPal gave the attacker the last four digits of my credit card number over the phone, or that GoDaddy accepted it as verification.
With my GoDaddy account restored, I was able to regain access to my email as well. I changed the email address I use at several web services to an @gmail.com address. Using my Google Apps email address with a custom domain feels nice but it has a chance of being stolen if the domain server is compromised. If I were using an @gmail.com email address for my Facebook login, the attacker would not have been able to access my Facebook account.
This whole situation just shows why 2 factor authentication is so important and also that you should really use @gmail.com accounts for important stuff rather than vanity domains registered with shady providers like GoDaddy.
Read the full story on Medium to see all the e-mail exchanges and get the full low down on exactly what happened.
Source: Medium.com