Live data from Hacker News

Ask HN: How does my Instagram keep getting compromised?

news.ycombinator.com

1–10 of 118 posts

Ask HN: How does my Instagram keep getting compromised?

#1
I was an early Instagram user and got my nickname as my handle and I keep getting either locked out of my account or compromised altogether.

Over the years, hackers have tried a number of things to steal my handle and I can usually tell how they get in. These days, I have no idea. I've been SIM swapped a handful of times. One time a hacker faxed a fake ID to Godaddy to try and swap out my domain to gain control of my email (they were successful).

Now, I will try to log in to my account and will just be locked out. The email I created specifically for Instagram is not recognized, and there is no way to reset my password.

I have two-factor auth on, I don't use the same password anywhere else, I change it regularly, etc.

My current theory is there is some employee at Meta that's ultimately stealing the account. Does anybody have any idea how they're hacking me?

PS: the worst part about all this is in order to get the handle back, I have to pull strings with folks I know at Meta, for a normal user, they would have absolutely no way of regaining access...

[Update] Just got the account back and still have no idea how my email was removed from the account...

[Update 2] Reviewing the security section I see a password reset email was sent to [username]@instagramz.com. No clue how or who changed the account email to that though.

Re: Ask HN: How does my Instagram keep getting compromised?

#2
Have you tried reporting this to Meta’s security team and copying your state’s attorney general? Sounds like the CFAA would apply. You may not win, but making noise may help, and if it’s an insider they might be fired if Meta knows the legal apparatus is notified.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Re: Ask HN: How does my Instagram keep getting compromised?

#4
post #3

> My current theory is there is some employee at Meta that's ultimately stealing the account This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.

Seems like employees can manually escalate accounts into a locked state and my guess is if it remains in that state long enough its easier to claim.

So they frustrate users long enough to eventually give up on constantly reclaiming the account, then they get it for themselves to sell or whatever.

Re: Ask HN: How does my Instagram keep getting compromised?

#5
post #3

> My current theory is there is some employee at Meta that's ultimately stealing the account This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.

wait what? how are they not fired, thats got to be against the "community guidelines" (unless of course its for an advertiser or political organisation. )

Re: Ask HN: How does my Instagram keep getting compromised?

#6
post #3

> My current theory is there is some employee at Meta that's ultimately stealing the account This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.

Interesting, do you have any links to that end?

Re: Ask HN: How does my Instagram keep getting compromised?

#7
post #3

> My current theory is there is some employee at Meta that's ultimately stealing the account This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.

Interesting, do you have any links to that end?

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

Re: Ask HN: How does my Instagram keep getting compromised?

#9
Your situation is apparently common nowadays with OG usernames and can get very dangerous. I had no idea this was a thing until I listened to an episode on Darknet Diaries [0] recently.

In the old days, I remember people going after short domains in the same manner. ICANN ended up adding locking (auth codes) - perhaps IG and other social sites can learn from it.

Be safe!

[0]https://darknetdiaries.com/episode/106/

Re: Ask HN: How does my Instagram keep getting compromised?

#10
post #7

Earlier quoted context omitted.

Interesting, do you have any links to that end?

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

I can understand the company pulling usernames from an automated name squatter... but I wonder if this happens to fully established accounts too?
Post reply on HN