Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'I want your Instagram account': a deadly campaign over coveted handles

businessinsider.com

Post reply on HN
Print view View original

131–140 of 164 posts

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#131

Post by prepend »

wonderbore wrote: post #79
prepend wrote: post #50

Earlier quoted context omitted.

The article mentions Instagram DMs. I don’t think those could be spoofed. Law enforcement would have to care and Instagram would need to get a subpoena, but they should be able to provide a lot of info on the account that sent the message (geoip, behavior, etc).

I think not many PDs would invest resources trying to avoid some private person’s username from being stolen. I’d be upset if it happened to me but I doubt anyone else would care.

I think the harassment would be what gets investigated. Especially including swatting.

It seems like once law enforcement engaged it was quick since they arrested 3 days after someone died from a swat. But getting law enforcement to be interested is the problem.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#132

Post by ols »

I have a short instagram handle.

In 2016 someone figured out how to successfully repeatedly reset the password without my knowledge (via support maybe?). But since my e-mail was not compromised they didn't manage to change the password (or I was quick enough to set it again before they executed some second step of their scheme). I upgraded the security measures to 2FA and some insanely long password and it ceased.

Since November 2020 I am subjected to a brute-force attack - someone is trying to log in and I am getting an email notification about it each time. In the beginning it was once every five (!) minutes, later every 15 minutes. It went like this for over a year, now it seems to be throttled with emails arriving once every few days.

I am suprised that for such a long time Instagram didn't implement anything to counter such activities.

But luckily, no pizzas yet.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#133

Post by ols »

hrrsn wrote: post #75
cyberferret wrote: post #57

Wow. I have a 6 letter Instagram account handle that actually matches a popular (Western) name and initial out there. So far I get about one fairly polite request per month via DM to sell my handle to them, which I always decline, but lately I am seeing a rise in the number of 'password reset' emails I am getting from Instagram. It's gone from about one per week to sometimes 2 or 3 per day. That fact, plus the storie…

Similar boat here - 3 character handle (my initials), and a constant flood of password resets. I used to get a lot of offers to purchase, the highest being $20k, but those seem to have stopped lately.

I am in the same situation. Sometimes I wonder if I should have responded to a bit higher offer sent by someone who possibly was a super wealthy Saudi kid (I am talking racing-lambos-in-the-desert-rich kind).

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#134

Post by m000 »

fortran77 wrote: post #55
hx2a wrote: post #26

Earlier quoted context omitted.

> Nowadays the closest I've gotten to this is the people who keep using my Gmail address as their own email address. I find this behavior rather bizarre and don't know what it achieves. I have this problem also! I thought it was rare. In my case I think the person is very bad with computers and doesn't know what their email address is. I've gotten emails from their bank, cell phone, and even online dating. I tried ma…

my gmail is my @gmail.com It's not a super-common lastname, but there are probably several hundred people with it in the US. I get all sorts of email for people whose address is some variant of it, like @gmail.com. I've gotten plane tickets, paypal payments, cancer diagnoses, Bar Mitzvah and Wedding invitations, college transcripts, all sorts of personal information. In many cases, I don't think it's the fault of the…

A misdirected email is usually easy to handle. I have no problem responding to people telling them that they hit the wrong mailbox. The real problem is people using your email to register with services that provide no viable way for you to completely deregister from them.

Someone registered their brand new truck to my email address. I started getting a ton of automated email regarding the truck. The manufacturer didn't offer any options whatsoever to disentangle myself from that account. I even filled their support form and asked them to phone call the owner and sort it out. The only thing that did work was installing their app and honking the (parked) car horn from the other side of the world. A couple of days later, the account was magically deactivated and spam stopped.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#135

Post by yieldcrv »

ols wrote: post #132

I have a short instagram handle. In 2016 someone figured out how to successfully repeatedly reset the password without my knowledge (via support maybe?). But since my e-mail was not compromised they didn't manage to change the password (or I was quick enough to set it again before they executed some second step of their scheme). I upgraded the security measures to 2FA and some insanely long password and it ceased. Si…

Time to filter that email notification

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#136

Post by bilekas »

ols wrote: post #132

I have a short instagram handle. In 2016 someone figured out how to successfully repeatedly reset the password without my knowledge (via support maybe?). But since my e-mail was not compromised they didn't manage to change the password (or I was quick enough to set it again before they executed some second step of their scheme). I upgraded the security measures to 2FA and some insanely long password and it ceased. Si…

You would think there would be some account-based flag for that.. Even something insane like 10 reset requests within 2 hours.

This should be standard stuff really!

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#137

Post by IG_Semmelweiss »

m000 wrote: post #134
fortran77 wrote: post #55

Earlier quoted context omitted.

my gmail is my @gmail.com It's not a super-common lastname, but there are probably several hundred people with it in the US. I get all sorts of email for people whose address is some variant of it, like @gmail.com. I've gotten plane tickets, paypal payments, cancer diagnoses, Bar Mitzvah and Wedding invitations, college transcripts, all sorts of personal information. In many cases, I don't think it's the fault of the…

A misdirected email is usually easy to handle. I have no problem responding to people telling them that they hit the wrong mailbox. The real problem is people using your email to register with services that provide no viable way for you to completely deregister from them. Someone registered their brand new truck to my email address. I started getting a ton of automated email regarding the truck. The manufacturer didn…

when a 30k piece of equipment becomes a 30k broken (or liability!!) piece of machinery and that is public info, things change fast!

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#138

Post by yieldcrv »

This article brushes over it, but the underground economy of account selling and promotions is quite expansive, and inherently involves Meta's own platform, Meta should get getting into the brokering business of these, be the escrow, be the reseller.

There are people that professionally grow accounts, while the regular users do the same for a little dopamine kick with little efficacy and the most 'heretical' thing they'll do is buy disengaged followers. But it has much greater efficacy to just get an already professionally grown account and rebrand it based on the audience that found the account. I've made a lot from rebranding accounts for marketing strategies. I've lost a bit trying to buy from unscrupulous sellers. Apparently we violated the Terms of Service, oh no.

Meta could definitely support this behavior and amplify it. They need to re-educate consumers about not coveting followers, but just the content. Currently, people think how you got followers is important. But its not.

Re: 'I want your Instagram account': a deadly campaign over coveted handles

#140

Post by fortran77 »

bee_rider wrote: post #100
fortran77 wrote: post #55

Earlier quoted context omitted.

my gmail is my @gmail.com It's not a super-common lastname, but there are probably several hundred people with it in the US. I get all sorts of email for people whose address is some variant of it, like @gmail.com. I've gotten plane tickets, paypal payments, cancer diagnoses, Bar Mitzvah and Wedding invitations, college transcripts, all sorts of personal information. In many cases, I don't think it's the fault of the…

Surely some of those are legitimate mistakes, but also I think things like the cancer diagnosis are probably designed to get you to respond. This proves that there's a human to spam/phish at that address. I've also gotten "we're here at the airport, are you coming to pick us up?"

That's why I don't respond to any of them.
Post reply on HN