'I had a rare Twitter handle... I was extorted into giving it up'
Plus: 'The refusal to release high-res photos is inexplicable'
Quotw This was the week when a developer was blackmailed out of a rare, single-letter Twitter handle by a hacker who claims to have social-engineered their way into his life through GoDaddy and PayPal.
Naoki Hiroshima, once the proud owner of the Twitter account @N, said he was forced to give up the account to a hacker who had gained control of his internet domains and locked him out. In a blog post, Hiroshima wrote:
I had a rare Twitter username, @N. Yep, just one letter. I’ve been offered as much as $50,000 for it. People have tried to steal it. Password reset instructions are a regular sight in my email inbox. As of today, I no longer control @N. I was extorted into giving it up.
The programmer explained that he was contacted by the person controlling his GoDaddy account by email and offered a nefarious exchange: his sites back in return for the Twitter account. The hacker wrote:
I’ve seen you spoke with an accomplice of mine, I would just like to inform you that you were correct, @N was the target. it appears extremely inactive, I would also like to inform you that your GoDaddy domains are in my possession, one fake purchase and they can be repossessed by godaddy and never seen again D:
I see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise? access to @N for about 5minutes while I swap the handle in exchange for your godaddy, and help securing your data?
Hiroshima gave in to the demands rather than losing his websites and the hacker then obligingly explained how he got in:
- I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone)
- I called godaddy and told them I had lost the card but I remembered the last four, the agent then allowed me to try a range of numbers (00-09 in your case) I have not found a way to heighten godaddy account security, however if you’d like me to recommend a more secure registrar i recommend: NameCheap or eNom (not network solutions but enom.com)
Or did he? PayPal claims the hacker is lying:
We have carefully reviewed our records and can confirm that there was a failed attempt made to gain this customer's information by contacting PayPal. PayPal did not divulge any credit card details related to this account. PayPal did not divulge any personal or financial information related to this account.
GoDaddy admits that the hacker got into Hiroshima's account, but claims that:
The hacker was already in possession of a large portion of the customer information needed to access the account at the time he contacted GoDaddy.
It remains to be seen whether Twitter will release the @N handle back to Hiroshima.
Also in security this week, a blogger has been outraged by the fact that Facebook's Android app now requires permission to read texts on people's smartphones. Tony Calileo wrote:
This is just one of a bunch of new permissions the app is requesting for this update, but it's probably the most alarming.
But Facebook is already blaming the Android ecosystem for the permissions. Facebook Android engineer Franci Penov told Redditors that the app needed to read texts for two-factor authentication and for phone confirmation messages when adding numbers to Facebook accounts. He went on:
Unfortunately, the Android permissions system does not allow us to specify that we would like to be able to read only SMS messages from a specific number.
It's also worth noting that we would love to be able to ask only for the permissions we need for the specific features particular users use. For example if you don't use Facebook events or you don't want to see them in your device calendar we would prefer to not request the WRITE_CALENDAR calendar; or if you don't have login approvals and don't add a phone number, we don't ask for READ_SMS. However, Android does not allow permission requests on demand; we have to request all permissions that cover each feature at install time, and the users can only grant or deny all of them and have no control over individual permissions.
In legal news, two ISPs in The Netherlands have managed to overturn a court order forcing them to block access to torrent site The Pirate Bay. The Court of Appeals in the Hague decided that blocking the website hadn't really done much to stop people getting their hands on copyrighted material. Instead, the search for illegal content had actually grown as folks went looking for alternatives. The court said:
The service providers' subscribers in any case mainly use proxies or resort to other torrent sites. The blockade is therefore ineffective.
The anti-piracy group BREIN, which originally applied for the ban in 2012, was none too chuffed at the overturning and is considering taking things to the Supreme Court:
The verdict of the court is negative for the development of the legal online market because it needs protection against illegal competition.
The purpose of the blocking of The Pirate Bay of course is to decrease the infringements via The Pirate Bay. It is contradictory that the court finds that this goal indeed is achieved but then still rejects the blocking because users can go to other sites.
In this week's Twitter-hosted outage outrage, customers of Three weren't best pleased to find themselves cut off from the internet on their mobes, reduced to the archaic communication methods of "calling" and "texting". Despite the data issues, they somehow managed to get on to Twitter to moan about it:
This AM @ThreeUK rolled out their new 0G internet to a few thousand London customers. Thankfully the full roll-out isn't for a few months.— Gregory Oliver (@greg8688) January 29, 2014
Meanwhile, Lloyds Banking Group was the site of the latest crippling bank outage that left thousands of ATMs and cards out of action over the weekend. Folk were left with no way to get money from machines or on their debit cards on Sunday, resulting in the usual slew of red faces at checkouts, petrol pumps and other public places:
Put petrol in then realised my Lloyds card wasn't working. Great service Lloyds! Left me right in it #lloyds— Mark Logan (@logandesigns) January 26, 2014
So embarrassing having your card declined, and then takes 18 minutes on hold to find out that lloyds tsb systems are down!— Jade Hampton (@lissajadeh) January 26, 2014
Also on Twitter, TSB Bank's chief let the world know that it wasn't any kind of update or software glitch in Lloyds' systems. An HP server had gone down in the UK:
@dangerfield_gem Gemma, no truth in this. The issue was caused by a HP Server failing here in the UK. PDP— Paul Pester | (@PaulPester) January 26, 2014
And finally, a man is suing NASA for what he has called the "negligent and bizarre" refusal of the space agency to investigate that weird doughnut-looking thingy that appeared before the Opportunity rover last month.
Rhawn Joseph PhD claims that the thingymabob was doubtless a growing fungus, and therefore an alien life-form, not the bit of stuff thrown out by one of the rover's wheels, as NASA suspects. He said in the suit:
The refusal to take close up photos from various angles, the refusal to take microscopic images of the specimen, the refusal to release high resolution photos, is inexplicable, recklessly negligent, and bizarre.
Any intelligent adult, adolescent, child, chimpanzee, monkey, dog, or rodent with even a modicum of curiosity, would approach, investigate and closely examine a bowl-shaped structure which appears just a few feet in front of them when 12 days earlier they hadn’t noticed it. But not NASA and its rover team who have refused to take even a single close up photo.
The object seemed to have appeared at the wheels of Opportunity in a 12-day period between camera shots taken by Opportunity, but Joseph claims to have spotted the first evidence of its "growth" in the first picture. He reckons the fungus looks kinda dry and rocklike in the second pic because it ran out of water.
He wants Opportunity to take a hundred high-res images of the object and 24 microscopic photos of its interior, to be made public. Oh, and if it is alien life, he wants to be given the naming rights and his name in the first six scientific papers about it.
Joseph's outrage over NASA's nonchalance appears to be somewhat unnecessary, however - the agency already has plans to investigate. The agency said last week that the rover would be probing the object with its microscope and spectrometer to try to find out what it might be. The agency told The Reg:
This is an ongoing legal matter and we are limited in what we can discuss about the filing. However, NASA has been publicly sharing our ongoing research into the rock dubbed 'Pinnacle Island' since we originally released the images from the Mars Exploration Rover Opportunity earlier this month.
As we do with all our scientific research missions, NASA will continue to discuss any new data regarding the rock and other images and information as new data becomes available. ®
Sponsored: Global DDoS threat landscape report