<http://schema.org/articleBody>
"Naoki Hiroshima is the creator of Cocoyon and a developer for Echofon. This post originally appeared on Naoki's Medium blog\u00A0and has been republished with permission.\r\n\r\n\r\n\r\nUpdate: PayPal has denied\u00A0that its customer service representative divulged credit card information over the phone. GoDaddy has admitted partial responsibility for the incidents. Finally, the @N account itself is actually in someone else's hands, after Twitter made it available after initially deactivating it.\r\n\r\nI had a rare Twitter username, @N. Yep, just one letter. I\u2019ve been offered as much as $50,000 for it. People have tried to steal it. Password reset instructions are a regular sight in my email inbox.\r\n\r\nAs of today, I no longer control @N. I was extorted into giving it up.\r\n\r\nWhile eating lunch on January 20, 2014, I received a text message from PayPal for one-time validation code. Somebody was trying to steal my PayPal account. I ignored it and continued eating.\r\n\r\nLater in the day, I checked my email which uses my personal domain name (registered with GoDaddy) through Google Apps. I found the last message I had received was from GoDaddy with the subject \u201CAccount Settings Change Confirmation.\u201D There was a good reason why that was the last one.\r\nFrom: &amp;amp;lt;support@godaddy.com&amp;amp;gt; GoDaddy\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 12:50:02 -0800\r\nSubject: Account Settings Change Confirmation\r\nDear naoki hiroshima,\r\nYou are receiving this email because the Account Settings were modified for the following Customer Account:\r\nXXXXXXXX\r\nThere will be a brief period before this request takes effect.\r\nIf these modifications were made without your consent, please log in to your account and update your security settings.\r\nIf you are unable to log in to your account or if unauthorized changes have been made to domain names associated with the account, please contact our customer support team for assistance: support@godaddy.com or (480) 505-8877.\r\nPlease note that Accounts are subject to our Universal Terms of Service.\r\nSincerely,\r\nGoDaddy\r\nI tried to log in to my GoDaddy account, but it didn\u2019t work. I called GoDaddy and explained the situation. The representative asked me the last 6 digits of my credit card number as a method of verification.\r\n\r\nThis didn\u2019t work because the credit card information had already been changed by an attacker. In fact, all of my information had been changed. I had no way to prove I was the real owner of the domain name.\r\n\r\nThe GoDaddy representative suggested that I fill out a case report on GoDaddy\u2019s website using my government identification. I did that and was told a response could take up to 48 hours. I expected that this would be sufficient to prove my identity and ownership of the account.\r\nLet The Extortion Begin\r\nMost websites use email as a method of verification. If your email account is compromised, an attacker can easily reset your password on many other websites. By taking control of my domain name at GoDaddy, my attacker was able to control my email.\r\n\r\nI soon realized, based on my previous experiences being attacked, that my coveted Twitter username was the target. Strangely, someone I don\u2019t know sent me a Facebook message encouraging me to change my Twitter email address.\r\n\r\nI assumed this was sent from the attacker but I changed it regardless. The Twitter account email address was now one which the attacker could not access.\r\n\r\nThe attacker tried to reset my Twitter password several times and found he couldn\u2019t receive any of the reset emails because it took time for the change of my domain\u2019s MX record, which controls the email domain server. The attacker opened issue #16134409 at Twitter\u2019s Zendesk support page.\r\nN, Jan 20 01:43 PM:\r\nTwitter username: @n\r\nYour email: *****@*****.***\r\nLast sign in: December\r\nMobile number (optional): n/a\r\nAnything else? (optional): I\u2019m not receiving the password reset to my email, do you think you could manually send me one?\r\nTwitter required the attacker to provide more information to proceed and the attacker gave up on this route.\r\n\r\nI later learned that the attacker had compromised my Facebook account in order to bargain with me. I was horrified to learn what had happened when friends began asking me about strange behavior on my Facebook account.\r\n\r\nI received an email from my attacker at last. The attacker attempted to extort me with the following message.\r\nFrom: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 15:55:43 -0800\r\nSubject: Hello.\r\nI\u2019ve seen you spoke with an accomplice of mine, I would just like to inform you that you were correct, @N was the target. it appears extremely inactive, I would also like to inform you that your GoDaddy domains are in my possession, one fake purchase and they can be repossessed by godaddy and never seen again D:\r\nI see you run quite a few nice websites so I have left those alone for now, all data on the sites has remained intact. Would you be willing to compromise? access to @N for about 5minutes while I swap the handle in exchange for your godaddy, and help securing your data?\r\nShortly thereafter, I received a response from GoDaddy.\r\nFrom: change@godaddy.com\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 17:49:41 -0800\r\nSubject: Update [Incident ID: 21773161]\u200A\u2014\u200AXXXXX.XXX\r\nUnfortunately, Domain Services will not be able to assist you with your change request as you are not the current registrant of the domain name. As the registrar we can only make this type of change after verifying the consent of the registrant. You may wish to pursue one or more of the following options should you decide\r\nto pursue this matter further:\r\n1. Visit\u00A0http://who.godaddy.com/\u00A0to locate the Whois record for the domain name and resolve the issue with the registrant directly.\r\n2. Go to\u00A0http://www.icann.org/dndr/udrp/approved-providers.htm\u00A0to find an ICANN approved arbitration provider.\r\n3. Provide the following link to your legal counsel for information on submitting legal documents to GoDaddy:\u00A0http://www.godaddy.com/agreements/showdoc.aspx?pageid=CIVIL_SUBPOENA\u00A0GoDaddy now considers this matter closed.\r\nMy claim was refused because I am not the \u201Ccurrent registrant.\u201D GoDaddy asked the attacker if it was ok to change account information, while they didn\u2019t bother asking me if it was ok when the attacker did it. I was infuriated that GoDaddy had put the burden on the true owner.\r\n\r\nA coworker of mine was able to connect me to a GoDaddy executive. The executive attempted to get the security team involved, but nothing has happened. Perhaps because of the Martin Luther King Jr. holiday.\r\n\r\nThen I received this follow-up from the attacker.\r\nFrom: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 18:50:16 -0800\r\nSubject: \u2026hello\r\nAre you going to swap the handle? the godaddy account is ready to go. Password changed and a neutral email is linked to it.\r\nI asked a friend of mine at Twitter what the chances of recovering the Twitter account were if the attacker took ownership. I remembered\u00A0what had happened to @mat\u00A0and concluded that giving up the account right away would be the only way to avoid an irreversible disaster. So I told the attacker:\r\nFrom: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nTo: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nDate: Mon, 20 Jan 2014 19:41:17 -0800\r\nSubject: Re: \u2026hello\r\nI released @N. Take it right away.\r\nI changed my username @N to @N_is_stolen for the first time since I registered it in early 2007. Goodbye to my problematic username, for now.\r\n\r\nI received this response.\r\nFrom: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 19:44:02 -0800\r\nSubject: RE: \u2026hello\r\nThank you very much, your godaddy password is: V;Mz,3{;!\u2019g&amp;amp;amp;\r\nif you\u2019d like I can go into detail about how I was able to gain access to your godaddy, and how you can secure yourself\r\nThe attacker quickly took control of the username and I regained access to my GoDaddy account.\r\nPayPal and GoDaddy Facilitated The Attack\r\nI asked the attacker how my GoDaddy account was compromised and received this response:\r\nFrom: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 19:53:52 -0800\r\nSubject: RE: \u2026hello\r\n- I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone)\r\n- I called godaddy and told them I had lost the card but I remembered the last four, the agent then allowed me to try a range of numbers (00-09 in your case) I have not found a way to heighten godaddy account security, however if you\u2019d like me to\r\nrecommend a more secure registrar i recommend: NameCheap or eNom (not network solutions but enom.com)\r\nIt\u2019s hard to decide what\u2019s more shocking, the fact that PayPal gave the attacker the last four digits of my credit card number over the phone, or that GoDaddy accepted it as verification. When asked about this, the attacker responded with this message:\r\nFrom: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 20:00:31 -0800\r\nSubject: RE: \u2026hello\r\nYes paypal told me them over the phone (I was acting as an employee) and godaddy let me \u201Cguess\u201D for the first two digits of the card\r\nBut guessing 2 digits correctly isn\u2019t that easy, right?\r\nFrom: &amp;amp;lt;swiped@live.com&amp;amp;gt; SOCIAL MEDIA KING\r\nTo: &amp;amp;lt;*****@*****.***&amp;amp;gt; Naoki Hiroshima\r\nDate: Mon, 20 Jan 2014 20:09:21 -0800\r\nSubject: RE: \u2026hello\r\nI got it in the first call, most agents will just keep trying until they get it\r\nHe was lucky that he only had to guess two numbers and was able to do it in a single call. The thing is, GoDaddy allowed him to keep trying until he nailed it. Insane. Sounds like I was dealing with a wannabe Kevin Mitnick\u2014it\u2019s as though companies have yet to learn from his Mitnick\u2019s exploits circa 1995.\r\nAvoid Custom Domains for Your Login Email Address\r\nWith my GoDaddy account restored, I was able to regain access to my email as well. I changed the email address I use at several web services to an @gmail.com address. Using my Google Apps email address with a custom domain feels nice but it has a chance of being stolen if the domain server is compromised. If I were using an @gmail.com email address for my Facebook login, the attacker would not have been able to access my Facebook account.\r\n\r\nIf you are using your Google Apps email address to log into various websites, I strongly suggest you stop doing so. Use an @gmail.com for logins. You can use the nicer custom domain email for messaging purposes, I still do.\r\n\r\nIn addition, I also strongly suggest you to use a longer TTL for the MX record, just in case. It was 1 hour TTL in my case and that\u2019s why I didn\u2019t have enough time to keep receiving emails to the compromised domain after losing the DNS control. If it was a week-long TTL for example, I would have had a greater chance to recover the stolen accounts.\r\n\r\nUsing two-factor authentication is a must. It\u2019s probably what prevented the attacker from logging into my PayPal account. Though this situation illustrates that even two-factor authentication doesn\u2019t help for everything.\r\nConclusion\r\nStupid companies may give out your personal information (like part of your credit card number) to the wrong person. Some of those companies are still employing the unacceptable practice of verifying you with the last some digits of your credit card.\r\n\r\nTo avoid their imprudence from destroying your digital life, don\u2019t let companies such as PayPal and GoDaddy store your credit card information. I just removed mine. I\u2019ll also be leaving GoDaddy and PayPal as soon as possible.\r\n\r\nEditor's Note: The Next Web has reached out to GoDaddy, PayPal, and Twitter for comment.\r\n\r\n-- PayPal says it did not release any credit card, personal or financial information for the account in question.\r\n\r\n-- A Twitter spokesperson\u00A0tells us: &amp;quot;While we don't comment on individual accounts, we are investigating the report.&amp;quot;\r\n\r\n-- GoDaddy Chief Information Security Officer Todd Redfoot provided the following statement:\r\nOur review of the situation reveals that the hacker was already in possession of a large portion of the customer information needed to access the account at the time he contacted GoDaddy. The hacker then socially engineered an employee to provide the remaining information needed to access the customer account. The customer has since regained full access to his GoDaddy account, and we are working with industry partners to help restore services from other providers. We are making necessary changes to employee training to ensure we continue to provide industry-leading security to our customers and stay ahead of evolving hacker techniques.\r\nDon't miss:\u00A0How to stop giving a f@$% what people think\r\n\r\nAnd:\u00A0Four months ago I completely quit lying. Here\u2019s how it dramatically and positively transformed my life."^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/socialmedia/2014/01/29/lost-50000-twitter-username/?_escaped_fragment_=tKs76>