10 ms·
Ask HN: How does my Instagram keep getting compromised?
I was an early Instagram user and got my nickname as my handle and I keep getting either locked out of my account or compromised altogether.
Over the years, hackers have tried a number of things to steal my handle and I can usually tell how they get in. These days, I have no idea. I've been SIM swapped a handful of times. One time a hacker faxed a fake ID to Godaddy to try and swap out my domain to gain control of my email (they were successful).
Now, I will try to log in to my account and will just be locked out. The email I created specifically for Instagram is not recognized, and there is no way to reset my password.
I have two-factor auth on, I don't use the same password anywhere else, I change it regularly, etc.
My current theory is there is some employee at Meta that's ultimately stealing the account. Does anybody have any idea how they're hacking me?
PS: the worst part about all this is in order to get the handle back, I have to pull strings with folks I know at Meta, for a normal user, they would have absolutely no way of regaining access...
[Update] Just got the account back and still have no idea how my email was removed from the account...
[Update 2] Reviewing the security section I see a password reset email was sent to [username]@instagramz.com. No clue how or who changed the account email to that though.
- GenerocUsername 5y ago
- toomuchtodo 5y agoHave you tried reporting this to Meta’s security team and copying your state’s attorney general? Sounds like the CFAA would apply. You may not win, but making noise may help, and if it’s an insider they might be fired if Meta knows the legal apparatus is notified. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- china 5y agoI haven't yet... so far I have always been able to get it back via a friend at FB.
- toomuchtodo 5y agoGet on record with law enforcement and state legal reps. Unauthorized authorization is a federal crime, and a paper trail is crucial for seeking recourse.
- meatsauce 5y agoI'd report it to the FBI, as well.
- FDSGSG 5y ago> My current theory is there is some employee at Meta that's ultimately stealing the account This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.
- tmp_anon_22 5y agoSeems like employees can manually escalate accounts into a locked state and my guess is if it remains in that state long enough its easier to claim. So they frustrate users long enough to eventually give up on constantly reclaiming the account, then they get it for themselves to sell or whatever.
- KaiserPro 5y agowait what? how are they not fired, thats got to be against the "community guidelines" (unless of course its for an advertiser or political organisation. )
- jandrese 5y agoI assume they aren't emailing Mark Zuckerberg with every account they steal. All it takes is lax internal auditing and a culture where customer service[1] is not valued and this could go on for a very long time. [1] Ok, this is a little unfair. They do have customer service, but what they don't have is product service, and this guy is just part of the product, not a customer.
- rich_sasha 5y agoInteresting, do you have any links to that end?
- FDSGSG 5y agoJust my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.
- skyzyx 5y agoThis happened to me several years ago. My account got locked out and I had no way to contact a human to get it back.
- rootsudo 5y agoSame, I was going to pen something to instagram legal and such.
- pkrotich 5y agoYour situation is apparently common nowadays with OG usernames and can get very dangerous. I had no idea this was a thing until I listened to an episode on Darknet Diaries [0] recently. In the old days, I remember people going after short domains in the same manner. ICANN ended up adding locking (auth codes) - perhaps IG and other social sites can learn from it. Be safe! [0]https://darknetdiaries.com/episode/106/ https://darknetdiaries.com/episode/106/
- china 5y agoI'll have to listen!
- guiambros 5y agoCame here to post the same episode. Strongly recommended; it's eye-opening, and it will give you a good idea of the incentives and the type of people you're dealing with (although you'll see the techniques are the ones you are already know: SIM swapping, social engineering, escalation of personal attacks, etc). Good luck defending your handle!
- gkoberger 5y agoHere's another podcast episode about it, and I remember it being really really good. They actually befriend a scammer who is pretty open about how it works: https://gimletmedia.com/shows/reply-all/v4he6k https://gimletmedia.com/shows/reply-all/v4he6k
- Apreche 5y agoTL;DR: The only methods discussed in this episode are SIM swapping and password guessing. Neither of which are relevant for OP. Unless OP is lying, there must be some other method used.
- supercoffee 5y agoReply All also did an episode about this a few years back. https://gimletmedia.com/shows/reply-all/v4he6k https://gimletmedia.com/shows/reply-all/v4he6k tl;dr There's underground marketplaces where shady people buy and sell OG usernames for money, which creates an incentive for shady people to steal them from the original owners.
- jsnell 5y agoWhat devices are you using the account on? If it's on a desktop browser, my assumption would be that you've got malware. That allows them to trivially steal the session cookies, steal the passwords the next time you log in, steal any device identification cookies that are used to control not using 2FA on logins from trusted devices / sending new device notifcations, and also hijack your recovery and notification email address. If you're only using this via the app from a mobile device, then malware is an unlikely explanation though. (Why are you regularly changing the password anyway? What's the threat model you're trying to guard against?)
- barbazoo 5y agoSomeone at Facebook stealing your domain is quite an accusation. Assuming your domain was similar to your username/IG handle, wouldn't it be more likely to be people wanting your "china" domain for spam/malware/propaganda/etc?
- klohto 5y agoNot really. It already happened several times since short usernames go for crazy amounts.
- china 5y agoI think the stealing of my domain was a bit of social engineering by a hacker (not somebody at FB). Now, my account gets taken without any noticeable trace on my end. No security emails, no suspicious login attempts, nada...
- andkon 5y agoContra the above dude, I don't think it's all that strange for Facebook employees to profit directly off of their access to these systems. See this article about how employees charge for verifications: https://mashable.com/article/instagram-verification-paid-black-market-facebook https://mashable.com/article/instagram-verification-paid-bla...
- praisewhitey 5y agothere is a lot of precedent for Meta employees taking usernames. here's another example: https://news.ycombinator.com/item?id=7598226 https://news.ycombinator.com/item?id=7598226
- cronix 5y agoPublicly pondering a theory is an accusation now?
- barbazoo 5y agoIt read to me like that, yes.
- docdeek 5y agoIf your IG handle is the same as your HN handle, could it be some very motivated people from that country's bureaucracy looking to take that handle for the state?
- cronix 5y agoLikely a phone call is all it would take and Meta would happily hand it over.
- Closi 5y agoAssuming that China itself is trying to capture it, and not a rogue state that still wants to use the username for political means.
- cryptoz 5y agoInstagram stole @sussexroyal from a real user, and gave it to some entitled "royals" who used the account for like a year before dropping it. So annoying how your handle isn't your handle, it's the company's, and they will steal your handle at a whim. I never even figured out why the "Royals" wanted specifically @sussexroyal or whatever it was so badly. The Royals can't even be like the rest of us and pick a handle that is available, they have to be like "well no we deserve this one even though someone has it already"
- AdamJacobMuller 5y ago> So annoying how your handle isn't your handle, it's the companies, and they will steal your handle at a whim. You don't own digital assets in any sense (excepting crypto, which is a whole other set of problems), at best you have a contract with some rights of use.
- adventured 5y ago> You don't own digital assets in any sense One of the largest classes of digital assets are personal files on individual phones and other personal computers. So yes, sometimes you do very clearly own digital assets (and no, a link about one time where some government broke the law and stole someone's files doesn't refute that). Your personal photos on your PC are digital, they're a digital asset, and you do own them. No contract necessary. The same is true for all sorts of other types of personal digital files you might hold as personal property, from spreadsheets to backup email records to pdf files of contracts and on it goes.
- deleted 5y ago[deleted]
- iKlsR 5y agoI'd auction and sell it and be done with the headache personally. It's likely one day your meta well will dry up and that will be it, years of back and forth to see the handle gone and promoting crypto eventually or some crap.
- leftpass 5y agoMany companies forbid the sale of usernames in their terms of service, so an attempt to auction it off could result in it being revoked. Generally, when sales of usernames do happen, it’s in private so there’s little reason to take action… it’s why there’s no reputable marketplace for usernames.
- gaws 5y ago> I'd auction and sell it Where could you even do this?
- tclancy 5y agoThis is what a friend did in the exact same situation. He just moved into the house he built with the dough. Life is weird now.
- gecko39 5y agoI had a two letter name which got hacked. I called in a favor from a friend of a friend at instagram/FB and got it back.. then it happened again and I didn't want to ask the favor again. IIRC they did not yet have 2FA even though I asked for it ( I was assuming it would happen again and it did. )
- theginger 5y agoIf you are using the nickname china and have registered it a lot of places, even if you are completely non political and in no way associated with the country China, I can imagine the existence of these accounts outside of the governments control is a risk the government will be willing to spend millions trying to get rid of. I'm not sure you can fight that, at least not by yourself.
- Cypher 5y agoPlot twist, you are the hacker
- ct0 5y agoThis is a honeypot for new hacking ideas, right?
- grouphugs 5y ago
- JSONderulo 5y agohttps://www.nytimes.com/2021/12/13/technology/instagram-handle-metaverse.html https://www.nytimes.com/2021/12/13/technology/instagram-hand... Her Instagram Handle Was ‘Metaverse.’ Last Month, It Vanished.
- slater 5y agoAnd then she got it back.
- whywhywhywhy 5y agoOnly after bad press.
- edm0nd 5y agoYou should tie your IG account to a Google Voice number instead of a your cell that way it cant be SIM swapped.
- edm0nd 5y agoinstagramz.com is a legit domain owned by Facebook
- leeroyjenkins11 5y agoOk, so I had a similar situation. What it was is that I signed up for insta pre Facebook merger. Then I connected my Facebook account to insta. So my old username password combo were compromised because I re used them when I was a moron when I was younger. So someone gained access via the original Instagram password and username, changes my email. Then I would login via Facebook and have access at the same time. The different geo locations and unusual activity caused my account to be locked periodically. When they unlocked it I logged in quick, changed the email address and password on the account on the Instagram side and enabled 2 factor and haven't had an issue since.
- zemnmez 5y agoI would look at your email forwarding filters. It's common to see compromises with this pattern where the email for your account was compromised and all the email is being forwarded to an attacker.
- waschl 5y agoThis! Have seen this personally in multiple friend’s mail accounts. This way it is “surviving” password changes, 2FA changes etc
- tpoacher 5y agoMeta just seems to be superhackable with the company not giving a shit these days. There was another user here the other day who had their heavymetal community page hacked, and facebook's advice page was to "politely ask the new owner to let them back in" [1]. Absolutely ridiculous. [1] https://news.ycombinator.com/item?id=29706571 https://news.ycombinator.com/item?id=29706571
- savolai 5y agoMy account seems to have gotten hijacked too. Someone has (apparently) posted something that's against community standards in my profile, as a consequence of which FB has disabled my account and says if I don't appeal in 30 days, the account will be disabled. The strange thing is when I try to appeal I get this page. "Security check To confirm your identity, we will text a confirmation code to your phone." I select my phone number, and receive the right SMS, but it says "Error Sending SMS Could not send confirmation SMS. Please check the phone number and try again." So I cannot actually enter the code. I also have 2FA enabled and this doesn't seem to have been breached. On deviced that are still logged in I see them telling me I have posted something that is in typical photos grid format, but they don't show me what the photos were. When I press the button to request review, it does nothing. <https://savolai.net/uncategorized-en/banned-from-facebook-and-instagram-screenshots/ https://savolai.net/uncategorized-en/banned-from-facebook-an...>
- tgsovlerkhgsel 5y ago> My current theory is there is some employee at Meta that's ultimately stealing the account. This was my first thought given the e-mail address change. Someone e.g. bribing a support person. My (uninformed) guess would be that given that you got the account back, this probably got escalated, someone looked at it, fixed it, and hopefully got the criminal support person's access disabled, until the next one gets bribed...
- kasra85 5y agoOn top of all security measures, Meta, Google and other big tech that offer Auth-as-a-service need to offer paid service to reclaim an account. I am sure people would be happy to pay to talk to a real human and take back their account.
- Jerrrry 5y ago>China You will be forever fucked, as big as Meta/Facebook/Instagram's exploit attack surface is. Microsoft/Office/Xbox is in a similar position as well. early lucky adopters not employees will always have their accounts poached constantly on every common platform. eventually those who have the names paid for the 'rights,' or defend it communally. yes, communally - it is a literal racket of cybergangters on every platform leveraging anything from social engineering your doxxed naive grandma into reading a private key to 0-daying your teamviewer to install a common keylogger. bribing csr's is extremely common, as is sim-swapping (bribing att/verizon csr's), and there are a myriad of attack vectors in between but of course 94% are just script kiddies using a "turbo"/api-spammer to take the username between other 3rd party transactions. it's a parasitic economy of bottom-feeders and iGangsters.
- Jerrrry 5y ago>@instagramz.com ha....someone stole this domain or hijacked/spoofed an email chain in the password reset api. you should be honored. >Last updated from Registry RDAP DB: 2021-12-28 06:35:41 UTC it of course still resolves to instagram.
- vogelfrei 5y agoInstagram is severly broken. I have never had an account on there and it has repeatedly happened that I was logged into some random stranger's account as I clicked on some Instagram weblink. I could read all their private conversations, message people in their name, mess with their settings. Their security is so badly broken, I wonder if they can be held criminally liable for it.
- r0fl 5y agoMy insta account keeps getting reset password requests every week for years. I’ve had multiple people ask to buy it, then threaten to sue, etc I’ve tried to contact meta/Instagram about 50 times and not once has anyone emailed me back How is it this hard to get support? It’s a personal account and I still have it so I don’t really care that much but there must be a way to get a hold of someone isn’t there!?