Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“They wanted my Instagram handle, and somehow they've now got it.”

mastodon.social

Post reply on HN
Print view View original

11–20 of 111 posts

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#11

Post by belltaco »

ZantaWB wrote: post #3

The underground marketplace for desirable social media handles (OG Handles) was explored in this excellent episode of Reply All: The Snapchat Thief [1]. In that story the basic technique was a SIM-swapping attack [2]. Fraudster calls the cell provider, claims to be the victim and that they lost their phone. Cell provider then ports the phone identity over to a new SIM. After that the fraudster just resets the account…

>Cell provider then ports the phone identity over to a new number

Do you mean port the phone number to a new SIM? Because the SMS 2FA will go to the old number. Porting it to a new number won't do anything.

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#12

Post by yardie »

afpx wrote: post #2

Are IG accounts worth something on the black market? I don't doubt a few people would want the "Alex Stevenson-Price" alexprice. But, I'm guessing there are a lot more who want the "Other Famous Alex Prices" alexprice.

My IG handle is pretty desirable and was the title in a film. Every few months I get password reset notifications. I get DMed with offers. I also get occasionnal DMing thinking I'm the handle for the artist.

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#13

Post by idiotsecant »

kjkjadksj wrote: post #6
ZantaWB wrote: post #3

The underground marketplace for desirable social media handles (OG Handles) was explored in this excellent episode of Reply All: The Snapchat Thief [1]. In that story the basic technique was a SIM-swapping attack [2]. Fraudster calls the cell provider, claims to be the victim and that they lost their phone. Cell provider then ports the phone identity over to a new SIM. After that the fraudster just resets the account…

If you can do that with social media accounts then I am sure private corporate logins must have also been breached hand over fist.

Yes and Yes, if corporate logins are using SMS based 2FA, which they absolutely shouldn't be.

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#14

Post by haunter »

WilTimSon wrote: post #10
haunter wrote: post #5

Earlier quoted context omitted.

Yes. I know 4 letter ones (even just random gibberish) are going for ~$50-100. 3 letter ones are $500-1000 at least. So anything which is a dictionary word or a noticeable abbreviation are worth much much more https://files.catbox.moe/5jp5qw.png https://files.catbox.moe/7gdx6k.png

It's so baffling to me, is there any research on whether a short name benefits marketing outreach or anything like that? I'd think a 4 letter gibberish name would put me off, if anything. I get if it's, like, "Mark" for some famous Mark, but if it was "ghfa", what's the point?

>but if it was "ghfa", what's the point?

You build your brand from the bottom up based on that handle alone. Totally possible and your example is actually pretty good, no weird letters either (x,q,y,z)

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#15

Post by ZantaWB »

belltaco wrote: post #11
ZantaWB wrote: post #3

The underground marketplace for desirable social media handles (OG Handles) was explored in this excellent episode of Reply All: The Snapchat Thief [1]. In that story the basic technique was a SIM-swapping attack [2]. Fraudster calls the cell provider, claims to be the victim and that they lost their phone. Cell provider then ports the phone identity over to a new SIM. After that the fraudster just resets the account…

>Cell provider then ports the phone identity over to a new number Do you mean port the phone number to a new SIM? Because the SMS 2FA will go to the old number. Porting it to a new number won't do anything.

I did, thank you. Correcting the original post now.

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#17

Post by hobo_mark »

ZantaWB wrote: post #3

The underground marketplace for desirable social media handles (OG Handles) was explored in this excellent episode of Reply All: The Snapchat Thief [1]. In that story the basic technique was a SIM-swapping attack [2]. Fraudster calls the cell provider, claims to be the victim and that they lost their phone. Cell provider then ports the phone identity over to a new SIM. After that the fraudster just resets the account…

Ok sure, but how do you get the person's phone number in the first place?

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#18

Post by ramesh31 »

Just goes to show that the current state of web security is about analogous to those $5 Master Locks used on gym lockers. Enough to keep honest people honest, but even the slightest bit of intentional attack is all it takes to compromise everything.

Re: “They wanted my Instagram handle, and somehow they've now got it.”

#19

Post by edflsafoiewq »

ZantaWB wrote: post #3

The underground marketplace for desirable social media handles (OG Handles) was explored in this excellent episode of Reply All: The Snapchat Thief [1]. In that story the basic technique was a SIM-swapping attack [2]. Fraudster calls the cell provider, claims to be the victim and that they lost their phone. Cell provider then ports the phone identity over to a new SIM. After that the fraudster just resets the account…

You normally do password reset over email, not SMS right?
Post reply on HN