If a stranger sends a Facebook message encouraging you to change your email address, whether it’s a Twitter handle or an Outlook email address, disregard it. It tells you that your handle or address is one the stranger could not access.
Chances are the attacker-stranger tried to reset your password several times and found he couldn’t accomplish this. Twitter requires the attacker to provide
more information to proceed and the attacker gave up on this route.
Still the attacker may be able to compromise your Facebook account in order to bargain with you. Chances are you won’t realize your Facebook account has been hijacked until I was horrified to learn what had happened until friends began asking you about strange behavior on your Facebook account.
At this point, the attacker gets direct, I would also like to inform you that your Go Daddy domains are in my possession, one fake purchase and they can be repossessed by Go Daddy and never seen again.
Go Daddy may not be helpful and it says something like this:
Unfortunately, Domain Services will not be able to assist you with your change request as you are not the current registrant of the domain name. As the registrar, we can only make this type of change after verifying the consent of the registrant. You may wish to pursue one or more of the following options should you decide
to pursue this matter further:
- Visit http://who.godaddy.com/to locate the Whois record for the domain name and resolve the issue with the registrant directly.
- Go to http://www.icann.org/dndr/udrp/approved-providers.htmto find an ICANN approved arbitration provider.
- Provide the following link to your legal counsel for information on submitting legal documents to GoDaddy: http://www.godaddy.com/agreements/showdoc.aspx?pageid=CIVIL_SUBPOENAGoDaddy now considers this matter closed.
The attacker then goes on to say: “I see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise?”
My claim was refused because I am not the “current registrant.” GoDaddy asked the attacker if it was ok to change account information, while they didn’t bother asking me if it was ok when the attacker did it. I was infuriated that GoDaddy had put the burden on the true owner.
A coworker of mine was able to connect me to a GoDaddy executive. The executive attempted to get the security team involved, but nothing has happened. Perhaps because of the Martin Luther King Jr. holiday.
Then I received this follow-up from the attacker.
From: <swiped@live.com> SOCIAL MEDIA KING
To: <*****@*****.***> Naoki Hiroshima
Date: Mon, 20 Jan 2014 18:50:16 -0800
Subject: …hello
Are you going to swap the handle? the GoDaddy account is ready to go. Password changed and a neutral email is linked to it.
I asked a friend of mine at Twitter what the chances of recovering my Twitter handle were if the attacker took ownership. I concluded that giving up the account right away would be the only way to avoid an irreversible disaster. So I told the attacker: I changed my username for the first time since I registered it in early 2007.
Then without a blushing, the thief writes:
“Thank you very much, your GoDaddy password is: V;Mz,3{;!’g&
if you’d like I can go into detail about how I was able to gain access to your GoDaddy, and how you can secure yourself.”
The attacker quickly took control of my former username and I was able to regain access to my GoDaddy account.
This is not the end of the problem. PayPal and Go Daddy inadvertently helped the attacker. I called PayPal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling PayPal and asking the agent to add a note to your account to not release any details via phone. It’s hard to decide what’s more shocking, the fact that PayPal gave the attacker the last four digits of my credit card number over the phone, or that Go Daddy accepted it as verification.
What to take from this is to act promptly if you think someone is attempting to take your email address, handle or passwords. Stupid companies may give out your personal information (like part of your credit card number) to the wrong person. Some of those companies are still employing the unacceptable practice of verifying you with the last some digits of your credit card.
To avoid this, don’t let companies such as PayPal and GoDaddy store your credit card information. Alert the companies with whom you have accounts and notify them you want no changes without your express permission. Using two-factor authentication helps but doesn’t work in every case. You may be able to trigger security alerts or you may need to change your passwords.
Following are a list of ways scammers get personal information about you:
- Entering online contests
- Filling out social media quizzes and surveys
- Share personal information on Facebook and other social media sites
- Filling out surveys both online and in business establishments
- Not being sure your mail is shredded or otherwise unrecognizable by someone fishing through your trash
- Obituary notices that list relatives and children
- Public records of federal, state and local governments. These include census data, bankruptcies, real property information, tax liens, criminal records occupational and professional licenses.
- Companies collect this information and sell it.
Leave a Reply