News By James Plafke Jan. 29, 2014 2:43 pm
Back in the old days of America Online when the general public wasn’t too familiar with the internet, phishing — posing as an official and asking for a user’s login information — was as effective as it has ever been. The success rate of old-school phishing is why many online services now include a disclaimer that says an employee will never ask for your password. Unfortunately for Naoki Hiroshima, the owner of the extremely rare one-letter Twitter account @N, high-profile companies don’t always listen to their own advice. Through a simple phishing scam perpetrated on Paypal and GoDaddy, one “hacker” was able to obtain all the information necessary to extort the Twitter account from Hiroshima.
First, the phisher posed as a Paypal employee, and was able to obtain the last four digits of Hiroshima’s credit card over the phone. While just those four numbers alone can’t do much harm — which is why they’re rarely ever obscured when you place an order — the phisher was able to use those four numbers to pose as Hiroshima to GoDaddy, and then gain access to Hiroshima’s domains. From there, the phisher had access to Hiroshima’s email account, which in turn provided access to his Facebook. Hiroshima realized what was going on, and managed to change his email before the Twitter account was stolen.
At this point, though, the phisher already had enough leverage, and used the GoDaddy and Facebook accounts to extort the Twitter account from Hiroshima via email. The phisher was at least true to his word, and returned the other accounts to Hiroshima, who then promptly removed all of the saved information on the accounts to prevent this from happening again.
Hiroshima said he’d be leaving both GoDaddy and Paypal as soon as he can, since the companies should not have divulged the information so willingly and with such little verification. Hiroshima claims that the rare @N account was once offered to be purchased for $50,000, so hopefully news of the events will reach Twitter, and the company will help Hiroshima regain the account. For now, though, there is no word if Twitter is on the case.
More...
First, the phisher posed as a Paypal employee, and was able to obtain the last four digits of Hiroshima’s credit card over the phone. While just those four numbers alone can’t do much harm — which is why they’re rarely ever obscured when you place an order — the phisher was able to use those four numbers to pose as Hiroshima to GoDaddy, and then gain access to Hiroshima’s domains. From there, the phisher had access to Hiroshima’s email account, which in turn provided access to his Facebook. Hiroshima realized what was going on, and managed to change his email before the Twitter account was stolen.
At this point, though, the phisher already had enough leverage, and used the GoDaddy and Facebook accounts to extort the Twitter account from Hiroshima via email. The phisher was at least true to his word, and returned the other accounts to Hiroshima, who then promptly removed all of the saved information on the accounts to prevent this from happening again.
Hiroshima said he’d be leaving both GoDaddy and Paypal as soon as he can, since the companies should not have divulged the information so willingly and with such little verification. Hiroshima claims that the rare @N account was once offered to be purchased for $50,000, so hopefully news of the events will reach Twitter, and the company will help Hiroshima regain the account. For now, though, there is no word if Twitter is on the case.
More...
