3 ms·

TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think th

TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think they may have social engineered the recovery with my SSN (it was a randomly generated password). Then they used the recovery provider to buy time by adding 2FA options, I began recovering within a minute. It was impressive how quickly they worked, they tried to compromise 5 other accounts in 3 minutes. Unfortunately for them, all of the accounts they targeted from that point on had 2FA, and they lost access in 15 minutes.

heavyset_go 5y ago
If this happened to me, I'd send a tip to the FBI[1]. [1] https://tips.fbi.gov https://tips.fbi.gov
- netsec_burn 5y ago
  Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.
  - bawolff 5y ago
    Wait a minute... You tried to report to apple. You didn't like the way they "treated" you, so you decided to sell it on black market. The black market person tried to hack you. You then went to the fbi to complain about how your black market buyer treated you? Am i missing something from this story? That seems like a really bad plan.
    - netsec_burn 5y ago
      Yes, this is wrong, both in your timeline and description of the events. I said in my previous comments that the Apple bounty program didn't exist when I began (https://news.ycombinator.com/item?id=28471263 https://news.ycombinator.com/item?id=28471263) so I was forced to consider other buyers in order to get income as a researcher. I never claimed to entertain any black market buyers, nor would I. Zerodium isn't the black market, they sell to government buyers. Government buyers may be concerned with the manner of which their sources collect said zerodays. The black market is Crowdfense, Israeli/Chinese government, et al.
      - deleted 5y ago
        [deleted]
  - boojums 5y ago
    "Dear FBI, please tell your friends at the NSA to knock it off" On a serious note, I'm glad researchers like you exist.

heavyset_go 5y ago

If this happened to me, I'd send a tip to the FBI[1]. [1] https://tips.fbi.gov https://tips.fbi.gov

netsec_burn 5y ago
Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.
- bawolff 5y ago
  Wait a minute... You tried to report to apple. You didn't like the way they "treated" you, so you decided to sell it on black market. The black market person tried to hack you. You then went to the fbi to complain about how your black market buyer treated you? Am i missing something from this story? That seems like a really bad plan.
  - netsec_burn 5y ago
    Yes, this is wrong, both in your timeline and description of the events. I said in my previous comments that the Apple bounty program didn't exist when I began (https://news.ycombinator.com/item?id=28471263 https://news.ycombinator.com/item?id=28471263) so I was forced to consider other buyers in order to get income as a researcher. I never claimed to entertain any black market buyers, nor would I. Zerodium isn't the black market, they sell to government buyers. Government buyers may be concerned with the manner of which their sources collect said zerodays. The black market is Crowdfense, Israeli/Chinese government, et al.
    - deleted 5y ago
      [deleted]
- boojums 5y ago
  "Dear FBI, please tell your friends at the NSA to knock it off" On a serious note, I'm glad researchers like you exist.