4 ms·

In my opinion, the hacker who hijacked this guy's Twitter account didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confus

In my opinion, the hacker who hijacked this guy's Twitter account didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention. Just think about it, in just one email he puts the blame on both GoDaddy, for doing phone validation over unsecure criteria (like credit card numbers), and PayPal (for giving out the last digits of the card number to a complete stranger). There might be some truth to it (GoDaddy's phone validation sucks and GoDaddy sucks altogether), but I've read the original HN thread and the majority of comments are directed against GoDaddy or PayPal, rather than the real perpetrator. There are a million ways to hijack someone's account - including but not necessary by exploiting flaws of GoDaddy / PayPal - but I wouldn't trust the hijacker to kindly explain to me how he actually did it.

jader201 13y ago
> didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention. Would the story have gone viral, though, had he just said, "I'm not going to say anything about how I did it."? The story would have just been another "I got hacked" story. If the hacker were really clever enough to fabricate such an elaborate hoax, I think he would have been clever enough to realize the best way to divert attention from the story, would have been to just keep quiet.
- Uchikoma 13y ago
  The argument was, he was deflecting attention away from him towards others - which, as this thread for the parent poster shows, worked.
  - jader201 13y ago
    My argument is, this attention wouldn't even be here had he just kept quiet. I don't think he was clever enough to have foresight that a) this would get this much attention, and b) he would need to deflect said attention by fabricating an elaborate hoax. The guy was simply wanting to brag about what he did in the excitement of him actually pulling it off. I think this is much more believable than him fabricating this story.
    - Uchikoma 13y ago
      After all the prison sentences lately, I'm not sure he wants to brag about himself.
      - jader201 13y ago
        If he were really that concerned about prison sentences, would he have done this to begin with? Not being snarky, that's a real question. I don't know the minds and rationale of hackers. I generally get the impression hackers honestly feel they're invincible, until they get caught. Maybe that's a misperception though.
        lostlogin 13y ago
        That may be an age thing - often they are young males. Entirely conjecture.
    - youknowwhoo 13y ago
      One issue to be thought of is if he tells how he hacked the accounts, it would become difficult for him to hack some other accounts in the future. But I have found out that he has a habit of giving out advice to people. I have done some searching and found out (hopefully) who he is. A simple google search for the email swiped@live.com revealed this link http://mydomaintest.com/index.php?query=getgamesfree.net http://mydomaintest.com/index.php?query=getgamesfree.net with owner douglas A password reset on that account shows the following accounts listed. do * * * @gmail.com do * * * @aim.com A password reset on aim.com for user name douglas(just guessing) also revealed the email d * * * *8@froze.org Searching for the name douglas parmele and 5167, brenda gave a result http://welfare.im/dox/index.php?name=communist http://welfare.im/dox/index.php?name=communist There is a reference of froze.us in the dox. Here you get his hackerforums.net profile http://www.hackforums.net/member.php?action=profile&uid=1399505 http://www.hackforums.net/member.php?action=profile&uid=1399... search for his posts and you see most of them are selling novelty twitter and other accounts http://www.hackforums.net/search.php?action=results&sid=953a269accf32893f3464ded14dc945f http://www.hackforums.net/search.php?action=results&sid=953a... Here he gives out advice on securing accounts. http://www.hackforums.net/showthread.php?tid=3610513 http://www.hackforums.net/showthread.php?tid=3610513 You have to have an account on hackforums.net to view those links.
vrikis 13y ago
I guess we'll never know, but last 4 digits are not difficult to get (they're on every single one of my receipts... and for all we know, this guy could be in close vicinity of him...), and making up that PayPal gave the hacker those 4 digits is a good diversion.
rickyc091 13y ago
I could be wrong, but wasn't there a story a while back where someone explained how they could hack into any apple ID account with a similar process? Didn't linode's servers get hacked and the hacker explained the whole process?
nickler 13y ago
Clearly you've never watched a single Bond movie. The only thing a villain enjoys more than committing a crime, is revealing the intricate plan by which he will get away with it.
prawn 13y ago
GoDaddy have come out and specifically said they were at fault in this case.
- louthy 13y ago
  Link?
  - prawn 13y ago
    "GoDaddy accepts partial responsibility in social engineering attack of @N's customer account" http://thenextweb.com/insider/2014/01/30/godaddy-accepts-partial-responsibility-social-engineering-attack-ns-customer-account/ http://thenextweb.com/insider/2014/01/30/godaddy-accepts-par...

jader201 13y ago

> didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention. Would the story have gone viral, though, had he just said, "I'm not going to say anything about how I did it."? The story would have just been another "I got hacked" story. If the hacker were really clever enough to fabricate such an elaborate hoax, I think he would have been clever enough to realize the best way to divert attention from the story, would have been to just keep quiet.

Uchikoma 13y ago
The argument was, he was deflecting attention away from him towards others - which, as this thread for the parent poster shows, worked.
- jader201 13y ago
  My argument is, this attention wouldn't even be here had he just kept quiet. I don't think he was clever enough to have foresight that a) this would get this much attention, and b) he would need to deflect said attention by fabricating an elaborate hoax. The guy was simply wanting to brag about what he did in the excitement of him actually pulling it off. I think this is much more believable than him fabricating this story.
  - Uchikoma 13y ago
    After all the prison sentences lately, I'm not sure he wants to brag about himself.
    - jader201 13y ago
      If he were really that concerned about prison sentences, would he have done this to begin with? Not being snarky, that's a real question. I don't know the minds and rationale of hackers. I generally get the impression hackers honestly feel they're invincible, until they get caught. Maybe that's a misperception though.
      - lostlogin 13y ago
        That may be an age thing - often they are young males. Entirely conjecture.
  - youknowwhoo 13y ago
    One issue to be thought of is if he tells how he hacked the accounts, it would become difficult for him to hack some other accounts in the future. But I have found out that he has a habit of giving out advice to people. I have done some searching and found out (hopefully) who he is. A simple google search for the email swiped@live.com revealed this link http://mydomaintest.com/index.php?query=getgamesfree.net http://mydomaintest.com/index.php?query=getgamesfree.net with owner douglas A password reset on that account shows the following accounts listed. do * * * @gmail.com do * * * @aim.com A password reset on aim.com for user name douglas(just guessing) also revealed the email d * * * *8@froze.org Searching for the name douglas parmele and 5167, brenda gave a result http://welfare.im/dox/index.php?name=communist http://welfare.im/dox/index.php?name=communist There is a reference of froze.us in the dox. Here you get his hackerforums.net profile http://www.hackforums.net/member.php?action=profile&uid=1399505 http://www.hackforums.net/member.php?action=profile&uid=1399... search for his posts and you see most of them are selling novelty twitter and other accounts http://www.hackforums.net/search.php?action=results&sid=953a269accf32893f3464ded14dc945f http://www.hackforums.net/search.php?action=results&sid=953a... Here he gives out advice on securing accounts. http://www.hackforums.net/showthread.php?tid=3610513 http://www.hackforums.net/showthread.php?tid=3610513 You have to have an account on hackforums.net to view those links.

vrikis 13y ago

I guess we'll never know, but last 4 digits are not difficult to get (they're on every single one of my receipts... and for all we know, this guy could be in close vicinity of him...), and making up that PayPal gave the hacker those 4 digits is a good diversion.

rickyc091 13y ago

I could be wrong, but wasn't there a story a while back where someone explained how they could hack into any apple ID account with a similar process? Didn't linode's servers get hacked and the hacker explained the whole process?

nickler 13y ago

Clearly you've never watched a single Bond movie. The only thing a villain enjoys more than committing a crime, is revealing the intricate plan by which he will get away with it.

prawn 13y ago

GoDaddy have come out and specifically said they were at fault in this case.

louthy 13y ago
Link?
- prawn 13y ago
  "GoDaddy accepts partial responsibility in social engineering attack of @N's customer account" http://thenextweb.com/insider/2014/01/30/godaddy-accepts-partial-responsibility-social-engineering-attack-ns-customer-account/ http://thenextweb.com/insider/2014/01/30/godaddy-accepts-par...