17 ms·
My friends Instagram was hacked and deep-fake videos posted in less than 6 hours
Today has been wild. I am quite shocked at how quickly the whole thing happened and how difficult it is to report the hacked account to instagram and try recover the account. The docs seem to take you in a loop without ever being able to resolve the problem...
My friends instagram account has only ~2,000 followers, so not even a huge amount, and her email and password was reset about 6pm to a gmail account, and by midnight the account had already posted deep-faked AI videos of her promoting cryptocurrency scams.
The deepfake videos are very realistic too, if I hadn't know her better or know about the hacking it would be very easy to believe it was real...
It's possible they deep-faked her videos ahead of time but it seems like something you'd only spend resources on only if you knew the attack was successful.
And there doesn't seem to be that much news or content online about this happening or it seems very targeted... but for such an account with such a small following it seems like it must be quite widespread problem.
Have you had this happen to someone you know personally and what do you think about how prepared we are to deal with scams this sophisticated or what effect they might have?
- chevman 5y agoThis is AI getting smarter, testing the edges.
- catillac 5y agoNo it’s people stealing accounts and running the images through off the shelf deep fake software to pump whatever the cryptocurrency or NFT flavor of the month nonsense is.
- supernova87a 5y agoCan anyone guess what exactly the hackers want with a particular person's IG? Why don't they just auto/synthetically generate a fake face if they just want to sell or scam something? Is it to exploit the person's friend network?
- mkl 5y agoThey want a large number of followers who trust the person.
- busymom0 5y agoThis news report had a musician guy's IG taken over and deep fake videos of him and his voice telling people to get bitcoins: https://www.youtube.com/watch?v=vqr0oER03SE https://www.youtube.com/watch?v=vqr0oER03SE
- i_hate_pigeons 5y agonot deepfaked but recently some solana sales pitch took over lots of unrelated youtube accounts, it took youtube a good week or so to get them sorted
- Pxtl 5y agoThanks, Bitcoin, for creating cash incentive for most of the worst behavior on the internet. Crypto lockers, pump-and-dump schemes, scams, hacking processing power for mining, burning fuels to power even the most legitimate uses. Cryptocurrency will go down in history as the most regrettable invention since leaded gas.
- busymom0 5y agoThat applies to any and all currencies, not specific to bitcoin. Scammers have existed for centuries.
- dylan604 5y agoIt applies to anything really. This is why we can't have nice things type of comments. Someone comes up with something clever, but the scammers figure out how to use it better than it was targeted originally. Now, it's a bad thing, even though the thing itself is neither good or bad.
- DarylZero 5y agoMany new scam possibilities are specific to cryptocurrencies.
- digitalsushi 5y agodont blame nails on the hammer
- artur_makly 5y agoThis happened to my wife too and her IG profile was used to create a deepfake on onlyfans
- k4runa 5y agoI haven't even thought about them using the content across platforms now that they have the video samples already... but perhaps the followers are more important. You only really hear about celebrity deep-fakes on the news.
- throw__away7391 5y agoHad an account not hacked, but copied pictures (only using bikini pictures), choose a similar username and followed all followers with an invite to a porn site (though I did not follow the link to see, it could not have been more explicit in what was being offered). Instagram "reviewed the report and decided it did not violate their terms of service" and refused to take any further action.
- colejohnson66 5y agoIf they’re reposting one’s own pictures, a DMCA claim would be a good way to solve the issue. It shouldn’t be needed, but Instagram will obey the claim
- dan353hehe 5y agoThis happened to someone I know as well. The only reason they knew about it was some of us saw it and alerted her. Really messed up stuff.
- nix23 5y agoWas the deepfake successful on onlyfans?
- hh3k0 5y agoI, too, would like to know more about his wife's deep-faked onlyfans video.
- bob332 5y agoDelete your social media already
- sova 5y agohacker news is not social and not media? :)
- pixl97 5y agoIs text media in the sense of multi media?
- sova 5y agosmoke signals are also media (as in mediums)
- mahathu 5y agoMoving the goalposts - it's social in the sense that you're interacting with other people, and media, but not social media as the focus is on the content and not on the people who post it
- bmitc 5y agoHacker News doesn't even allow you to delete your account.
- megavthchandu 5y agoVvhnjj
- pkaler 5y agoI've had my account hacked, too. I used to own: https://www.instagram.com/kaler/ https://www.instagram.com/kaler/ Have owned it since Instagram launched and it was connected to my Facebook account which I've had since 2005 or so. There is no hope with contacting Instagram/Facebook support.
- donkarma 5y agoLink doesn't show anything to me, was it deleted?
- sova 5y agoIf you know someone who works there (Kafkaesque absurdity surrounding social-media operators) you can recover an account asking for help politely.
- Sebb767 5y agoAs far as I know, that's actually how these 'high profile' takeovers work. You know someone at Insta and politely ask/silently pay to get your account "back" or take over an "inactive" account.
- sova 5y agoReally? Do you have any evidence to support this claim?
- coolspot 5y agoI know someone who works in a major social network company. They got an email on their personal gmail, asking to help acquire vanity usernames for a reward.
- sova 5y agoWell yeah, but is your friend who works at <social media company> going to risk their position & salary there for some sketchy hook up that's less lucrative?
- busymom0 5y agoCan you contact law enforcement or lawyer to get a take down the account?
- k4runa 5y agoIn an ideal situation I'm sure that could work, but I'm not sure if law enforcement would have any more luck getting hold of instagram help & support in this case. I also don't really know much about deep-fakes yet and if they do fall under some kind of copyright law and how that would work across international borders. I think it's very new problem that might not have a clean solution yet.
- koheripbal 5y agoWhat do you expect a lawyer can do?
- FDSGSG 5y agoWrite a letter, get the account taken down. This is how things work.
- godDLL 5y agoWell, there really isn't anything preventing this from being massively automated. Except for the natural limit of influencers vs. target wallets. Your friend should take this as a complement to her appearance, she's been deemed attractive and trustworthy-looking, after all. That's why her account has been targeted. Contact IG to wipe it, and acquire stronger auth habits, and better backup habits. Nothing else you could do about that, really.
- throw__away7391 5y ago> Your friend should take this as a complement to her appearance Wow, that's a pretty fucked up take.
- godDLL 5y agoThanks. Noted. How would you take it?
- colpabar 5y ago> Your friend should take this as a complement to her appearance, she's been deemed attractive and trustworthy-looking, after all. whew boy, I was not expecting this on this website
- heyitsguay 5y agoReally? Have you not ever seen a comment thread here on a topic involving women?
- ben_w 5y agoI don’t know if this is because I don’t recognise it when it happens (bad) or if it usually gets flagged fast enough that I seldom see it (good), but such a blatant attempt to dismiss a problem by pretending it’s a good thing is not my usual experience here.
- 5y ago
- kevindeasis 5y agoi've been seeing this trend lately. it's not limited to the crypto niche. i've seen other ways they were trying to hijack people's identity to sell whatever thing they're trying to promote edit: also there was an instance in the past where my account got disabled and it took me months to get my account get reactivated again. the first issue is that they have a huge backlog of other people they are assisting. so you need to find a way around that
- vorpalhex 5y ago> the first issue is that they have a huge backlog of other people they are assisting. so you need to find a way around that If that is true, that is a deep cut against their account security.
- ryanlol 5y agoAre you sure it’s a deepfake? A common version of this scam involves extorting the hacked user to record a video in exchange for getting their account back.
- k4runa 5y agoI've been on voice chat with her throughout the day trying to help her fix the problem. So I've seen it happen in real time, from the suspicious login in Nigeria to the deep-fake video that happened later.
- FDSGSG 5y agoIt's so very hard to believe that it would be the notoriously unsophisticated Nigerians¹ pulling off high-end deepfakes. These guys weren't smart enough to use a proxy, but were supposedly smart enough to produce a good deepfake. If this really happened, there must be some easy to use public tool they used. I'd really love to see the video. ¹ There's no way anyone else would log into a stolen account from a Nigerian IP.
- throwaway29303 5y agoMaybe this is related https://therecord.media/how-the-pandemic-pulled-nigerian-university-students-into-cybercrime/ https://therecord.media/how-the-pandemic-pulled-nigerian-uni...
- m00x 5y agoWhy would Nigerians be unsophisticated? Are you assuming someone from Nigeria wouldn't be smart enough to make deepfakes?
- dylan604 5y agoRight? Their prince was the first email scam of note, and probably one of the longest running ones at that. Also, you know VPN/VoIP numbers exist to help mask the identity/location of scammers. Just in case some of that might have slipped the mind of some peeps.
- Wiseacre 5y agoFacebook doesn't seem to care about deepfakes on Instagram since they promote "engagement". I can't say I have too much advice other than to always use strong passwords, don't share passwords across sites, use VPNs on public routers, and stay away from posting videos of yourself on cancerous engagement metric-driven social media.
- k4runa 5y agoI think that is good advice for someone who is more tech-savy and aware of the problem but I'm not sure the rest of the world is as well prepared, or what effect it might have on us or FB/IG reputation and engagement if it's becoming more automated and widespread.
- xwolfi 5y agoDude, when I was 16, 15 years ago, I remember doing a school essay about the risk of social media and saying "social media is not the culprit, it's us being so addicted to this new way of manipulating people around us into thinking we're "social credit"-worthy by uploading everything we can in a never ending race to the vacuum. We'll end up with what we deserve: we'll have traded our ability not to be lab monkeys clicking on buttons for the pleasure of our observers in exchange for the vain pleasure of sticking it to our ex/neighbour/psychotic mom/more beautiful colleague/whomever else insecure jealousy pushed us to addiction. I feel we're just reaping the reward of our vacuity.
- systemvoltage 5y agoCan we also lump Twitter and Tiktok with it? Is it me or there is a double-standard on HN where FB gets all the heat, but others don't.
- Wiseacre 5y agoI brought up Facebook because they own Instagram, but yes this applies to Twitter and TikTok.
- 5y ago
- atum47 5y agoI have two Instagram accounts: one where I post things about me, other where I post things about this sport I practice. I lost the password for the later account, it was a nightmare to recover. The two factor SMS code would never come. When it would come, the app reported an error. I had to battle the app and the web platform for 2 days in order to get my account back. I cannot imagine the kind of hustle it would be if it was stoled.
- dylan604 5y agoI smiled a little bit when you say struggle for a whole 2 days. In one of those "get off my lawn" moments, I remember having to send in letter head printed requests via snail mail to take recourse. At the time, the small biz had never printed anything more formal than an invoice, so there really wasn't a letter head. Some of the work around procedures are just farcial when they are there, yet just down right infuriating when they are not.
- dbavaria 5y agoImagine that, a time where companies had mailing addresses and phone numbers to communicate with real humans.
- hansolosays 5y agoI was doxxed and harassed for my Insta account. Eventually one day it was just taken even though I had 2 factor auth on Insta and email. There is basically no recourse. Oh and it was given to one of mr beasts (from YouTube) helpers…
- echelon 5y agoWhat was your account? Can you prove it?
- hansolosays 5y agoInstagram.com/chucky I have old password reset emails and probably some screen shots somewhere
- echelon 5y agoPlease post this on Medium and submit it to HN. I'd be glad to help this get seen. You were robbed and deserve the handle back. And potentially compensation if an audit trail reveals an inside job.
- aspenmayer 5y agoWas it SMS based 2fa or did you use some other method?
- hansolosays 5y agoSMS 2fac to a google voice account with 2 fac
- jcims 5y agoExample from a news story. After seeing the video, I must admit I’m not sure if I believe the guy or not, which is scary. Edit: Better link from deadmutex below - https://www.youtube.com/watch?v=vqr0oER03SE https://www.youtube.com/watch?v=vqr0oER03SE https://www.wfla.com/8-on-your-side/better-call-behnken/instagram-account-taken-over-by-imposter-who-posted-deepfake-video-of-tampa-man/ https://www.wfla.com/8-on-your-side/better-call-behnken/inst...
- k4runa 5y agoIt's exactly the same situation with my friend. “I just invested $300 into Bitcoin and got $10,000 back. Gotta try it,” except the numbers are higher... but she actually says it in the video too.
- deadmutex 5y agoAnother link, same story: https://www.youtube.com/watch?v=vqr0oER03SE https://www.youtube.com/watch?v=vqr0oER03SE
- lelandfe 5y agoTelling that a major news outlet can't get anything more than a "we're looking into it" response from IG support.
- stjohnswarts 5y agoI mean what if they are looking into it though? Would you prefer a half baked response?
- echelon 5y agoI work really closely on deep fake tech [1] and I'd say I'm relatively current with the state of the art in the literature. This was not deepfaked. The person recorded it themselves and is lying. The video quality is too good. The lighting and movements lack mistakes. It can't be first order model, wav2lip, or any of the relatively new audio to video models. The audio doesn't suffer from spectral noise, and it matches the lip movements close enough to not be TTS. Voice conversion (VC) introduces pitch issues that are readily apparent, and it's incredibly hard to train VC models without a ton of parallel audio data from source and target speakers. This is absolutely a lie (not a deepfake) and I'd bet money on it. [1] I created https://fakeyou.com https://fakeyou.com cartoon and celebrity TTS, real time voice to voice mapping for VTubers, and am currently working on ML blendshapes.
- RandomWorker 5y agoI saw this happen on Facebook as well! Super insane, in this video they took his voice of which there where many recordings on his Facebook to create an add for Facebook. Super scary stuff.
- k4runa 5y agoYeah, the voice was hers but it had a plain background... almost like a white wall which looked different from her other videos, and was about 10s in length.
- frontman1988 5y agoDoesn't gmail alert you if a different Ip is used to login? Seems the Hackers had both her gmail and Instagram passwords(probably common password). Sadly nothing much can be done except contacting instagram.
- k4runa 5y agoSorry if I was unclear, she had a personal email and after changing the instagram login details the account now belonged to a random gmail account, and the phone number changed too.
- olah_1 5y agofrankly, i think this is where decentralized networks can help us. 1. networks where global reach to total strangers is not even possible, or at least is not the default. the vast majority of people only really want to reach their “friends of friends” anyway. this eliminates a lot of would-be hackers from even knowing you exist. 2. accounts that are unhackable because users log in with private keys instead of user/pass that sit on a server. of course losing your private key is a problem, but i would suggest a system of social-account recovery anyway where you can regain access by 3 out of 5 friends approving, for example.
- k4runa 5y agoI do think a "trusted friends" circle would be a better way to deal with these kinds of problems, because I know my friends would be available to help me and easier to reach than customer support.
- dylan604 5y ago>the vast majority of people i think the concept of followers shows that your premise isn't exactly true and people with more followers than just family, friends, and friends of friends is also another clue.
- olah_1 5y ago“friends” in the term “friends of friends” refers to followers
- menodialogues 5y agothats your big idea? i mean you can create a social network that does anything, and your big market killer is "safer login experience?" ... like who the fuck cares.
- analognoise 5y agoIt doesn't matter at all to reality, so it's probably the next Unicorn in SV.
- moyix 5y agoWould you be willing to share one of these videos? Our research group is studying the use and abuse of DeepFakes in the wild and we'd love to be able to do some analysis on this incident. Feel free to shoot me an email at brendandg@nyu.edu
- blondin 5y agodo these people just guess the passwords? how do instagram, fb, twitter, etc. accounts get hacked?
- epolanski 5y agoMy wild guess: most people have the same passwords everywhere. You get hacked on service a, you get hacked on b. Plus the usual phishing.
- fortran77 5y agoThese sorts of scams also add to the perception (which I hold, too) that "Crypto" is a massive scam.
- ngoel36 5y agoWhat do people even use to create deep fakes like this?
- dylan604 5y ago>It's possible they deep-faked her videos ahead of time but it seems like something you'd only spend resources on only if you knew the attack was successful. I wonder if they had a list of account credentials, tested to find ones that worked without changing anything after verifying they were legit, and then once they had the content ready took over the account to ensure the work they had done was live for as long as possible..
- bredren 5y agoThis is a good tack, though the key is the gmail account. Presumably, the perp has multiple scams based on the content of the account. Presuming much of the media creation is automated, they could also have run the process once the gmail account was owned. Testing auth from unexpected locations in advance seems like an easy way to get noticed.
- dylan604 5y agoI'm not reading that they hacked/stole a gmail account. My understanding is that by taking over the account, they updated the associated email address used for contact within Insta. It just so happened that the email used by the attacker was a gmail account. >Testing auth from unexpected locations in advance seems like an easy way to get noticed. How many times we've received emails from online accounts notifying about login attempts? They are usually phishing attempts, but it occurs enough that most people don't believe the legitimate emails.
- lupire 5y agoI've never received a fake email saying that I've logged in to a service from a new location. I use Gmail spam filters.
- aidos 5y agoA friend of a friend went through this a while ago and I was called on to help. Insta was totally taken over and so I made her start going through the linked gmail account because there should be a message in there from insta about the details changes. Nope. You use the same password, don’t you. Yup. So it’s - access insta, change email, phone and password. Access gmail, delete notifications from Instagram, profit. In her case she had about 60k followers. They sent random emails the moment she tried to do a password reset, so they obviously back the email onto an automated random service. The fact the insta even allows changing all of those details in quick succession is one thing. The impossibility of contacting them next is another. Took a few days but they eventually flipped the account back to her with about as little fanfare as taking it away.
- almostdigital 5y agoInstagram is a dumpster fire. I have a 3 letter instagram name and the amount of spam and attacks I get is insane... I get hundreds of password reset emails from instagram daily and constant DMs and follow requests from scammer and bot accounts. I've tried contacting instagram about it several times but they never respond. Had to blackhole emails from security@mail.instagram.com to prevent my mail server filling up.
- roomey 5y agoI got a 4 letter one I never use and the amount of resets per day is crazy. I don't share my daily email with websites but for whatever reason I used it with this Instagram account. It's the only spam I get at this point. 20 email resets per day!! It can't be hard to fix that
- wpietri 5y agoWow. I have an early Twitter handle and they let me turn off password resets without additional information. (I think you have to enter the email under which I've registered before it will send the request.)
- bredren 5y agoHow early? My main is in the first 12,000.
- wpietri 5y agoI just checked and this appears to be for accounts of any vintage. If you go here: https://twitter.com/settings/security https://twitter.com/settings/security Turn on "password reset protect" and it will require "either the phone number or email address associated with your account in order to reset your password". I'm not sure it adds a ton of security, but it definitely cuts down on the password reset emails.
- skunkworker 5y agoI personally know someone with a two letter twitter handle that is a word in the english language, for awhile there they were inundated with password request attempts, but it took knowing someone 1-1 inside of twitter security in order to put additional locks on their account, beyond what any config will show unfortunately.
- brightball 5y agoThey probably accessed the account first, then invested the time in the videos and held off on taking over the account until later. Just speculation though.
- baby 5y agoNow I'm really curious if you could share an example of these deep fakes... with your friend's permission of course. Maybe with a disclaimer: THIS VIDEO IS A DEEPFAKE.
- knownjorbist 5y agoThe best thing you could ever possibly do is to block all facebook products in your household. It's really quite easy these days
- aaron695 5y agoDeep fakes DO NOT EXIST in the wild. The technology does not exist. Even Hollywood struggles. "Roadrunner: A Film About Anthony Bourdain" took 4 companies and months to do voice, AND once you know it's a deep fake you can tell. It's still tinny, but you would not notice without knowing. At best deep fake pictures taken from researchers have been used for profiles in the wild. You can see heaps of hostage videos here - https://www.google.com/search?q=%22I+just+invested%22+site%3Awww.instagram.com https://www.google.com/search?q=%22I+just+invested%22+site%3... which is probably what it is. There's not enough info from this report to check exactly what happened.
- jwilber 5y agoHow do you know it’s a deep fake? The same thing happened to someone I know, but they were basically forced to post the requested videos as ransom. It also happened to a skateboarder, and many people claimed deep fake when it wasn’t. [0] Not saying it’s not, just raising the question. 0: https://www.slapmagazine.com/index.php?topic=119395.0 https://www.slapmagazine.com/index.php?topic=119395.0
- petchaw_ 5y agoThe video was not a deep fake video. Your friend lied to you. The scammer will ask the victim to make the video ahead of time and send to them, and only after that they will take over the account. The account is not really hacked, your friend got social engineered to turn the account over, by switching their email on the account to the scammer's email, and then the scammer would do a password reset. Your friend probably ashamed to fall for that, and said the video is deep fake. It is a wide spread scam, and IG does not take any actions when you report the accounts. I am surprised there is not a class action lawsuit against IG already.
- jazzyjackson 5y agothis reminds me of a paradox in trying to perform bot detection on social media: the closer bots get to being human, you also deal with humans who act like the bots: posting repetitively about the latest crypto scheme for example so tik tok and instagram and even phones themselves apply skin-smoothing filters by default, guess what, that makes it harder to distinguish deepfaked videos from just heavily filtered genuine videos I dont know how to convince people to be less bot-like, but social media is making it easy on these scammers by making beautification filters the norm
- angusturner 5y agoThis is actually quite good for Bitcoin.
- rootsudo 5y agoI made a new instagram account, and it was locked out and blocked within a day and someone stole the name. Nothing to be done. Just wanted to post nice landscape photos of the place I biked too. I logged in, it requested my number and they just cold say "we'll contact you" and nothing.
- beermonster 5y agoInstagram supports FIDO2/webauthn.. if I had an account I wanted protecting on Instagram I'd be using that (with a backup stored somewhere safe of course). You can get a $20 Yubikey Secure Key for that use case.
- lazyeye 5y agoYour surprised it took a while to resolve a problem with big tech? Really?
- ncr100 5y agoRhetorically, who cares about trust anymore? Slightly more specifically, why should any stranger care if the charismatic "with-it" personality says anything in particular? It's all BS, stories, that the world is telling to us. We can be just fine if we keep our heads down, and do what's expected of us. Not Rhetorically: "Trust" has never been guaranteed. It's partly an emotional experience. So as technologists, how shall we pool our tools, to Augment Humanity? Why do we have emotion enhancing technology for everything but trust (rhetorically, because we have many)? Why would we Want Trust? I'd personally love Digitally Signed video, proving mathematically it derives from a Genuine Work from the taking head in the video. Because I trust myself and need solid facts to continue doing so. I need more reliable facts.
- nitn 5y ago>The docs seem to take you in a loop without ever being able to resolve the problem... Yes. Can confirm this, AFAIK there is no email, no form or phone number to get in touch with them.
- phwd 5y agoreposting this from reddit (tried to edit the profanities) as I'm certain this is what happened here. Essentially it's social engineering via a face scan app. You can see an example of a possible scammer here https://www.instagram.com/sashana_walter/ https://www.instagram.com/sashana_walter/ "My friend is into crypto sh$t and he messaged me saying to check out his story (already weird but whatever) and he posted that this lady turned his $500 into $8500. It was a legit video of him speaking, walking down the street. Anyway I messaged the chick and she told me to download this app and I signed up and it made me scan my ID and my face which I thought was wack again but trusted my buddy… So i end up sending this chick $200 in bitcoin like a f%c^in idiot, but then shes trying to say I need to send another $300 to be able to actually ‘process’ and I was like uhhhh nope? Now ‘she’ is trying to get me to do some two factor authentication confirmation code shit to ‘get my payout’. What I think is going on is they got into my friends account and made a deepfake from the face scan and started DMing other people. "
- floor_ 5y agoGPUs have been weaponized to crack passwords, make deep fakes and mine crypto (which is used to launder money and buy illegal goods and services.
- erikdstock 5y agoA foaf had this happen but was scammed into reading a video about how the scam worked for her before they took over her account. Not a deepfake h in her case.
- erikdstock 5y agoThis was about two weeks ago and we did wonder if it was a deep fake at first but when we reached her she said she just fell for the scam because she saw a convincing video from her friend. She said she felt super weird reading the script before she got the money
- JanDietch 5y agoGet in touch with coinwalletrecoup . com to help you recover all your scammed funds. I got in touch with them when i was scammed by Tradestation to be precise, having deposited over $175,000 but still couldn’t withdraw any funds. They kept on telling me to deposit more to reach a certain amount but still couldn’t withdraw then it dawned on me that these people were playing games with my money. Within a week of contact, Coinwalletrecoup . com did the impossible, they recovered everything and also my ROI for the agreed duration of investment. Dont hesitate to contact them if you need any help. They’re the Best out there.
- kaushikk52 5y agoshivangiii__.06
- jayg1107 5y agoThey deepfaked my wife yesterday. No idea where they got the video from but it looks 100% like her with a different voice actor. Its so frustrating that theyre using her likeness for a scam, and theres no way instagram can help. They changed our email and theres no way to recover her acct. We cant even get IG to delete it
- Kamble 5y agoInstagram account hack
- farzher 5y agomy instagram got hacked many years ago. i don't think i leaked any of my information. seems like it was somehow instagram's fault. either way i don't care. don't use it