Hacker News Reader

Comment by lipanski | Hacker News Reader

In my opinion, the hacker who hijacked this guy's Twitter account didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention. Just think about it, in just one email he puts the blame on both GoDaddy, for doing phone validation over unsecure criteria (like credit card numbers), and PayPal (for giving out the last digits of the card number to a complete stranger). There might be some truth to it (GoDaddy's phone validation sucks and GoDaddy sucks altogether), but I've read the original HN thread and the majority of comments are directed against GoDaddy or PayPal, rather than the real perpetrator. There are a million ways to hijack someone's account - including but not necessary by exploiting flaws of GoDaddy / PayPal - but I wouldn't trust the hijacker to kindly explain to me how he actually did it.

View on HN

> didn't have had ANY interest in explaining how he got to it, besides creating a hoax to confuse and divert attention.

Would the story have gone viral, though, had he just said, "I'm not going to say anything about how I did it."? The story would have just been another "I got hacked" story.

If the hacker were really clever enough to fabricate such an elaborate hoax, I think he would have been clever enough to realize the best way to divert attention from the story, would have been to just keep quiet.

The argument was, he was deflecting attention away from him towards others - which, as this thread for the parent poster shows, worked.

My argument is, this attention wouldn't even be here had he just kept quiet.

I don't think he was clever enough to have foresight that a) this would get this much attention, and b) he would need to deflect said attention by fabricating an elaborate hoax.

The guy was simply wanting to brag about what he did in the excitement of him actually pulling it off. I think this is much more believable than him fabricating this story.

After all the prison sentences lately, I'm not sure he wants to brag about himself.

If he were really that concerned about prison sentences, would he have done this to begin with?

Not being snarky, that's a real question. I don't know the minds and rationale of hackers.

I generally get the impression hackers honestly feel they're invincible, until they get caught. Maybe that's a misperception though.

That may be an age thing - often they are young males. Entirely conjecture.

One issue to be thought of is if he tells how he hacked the accounts, it would become difficult for him to hack some other accounts in the future. But I have found out that he has a habit of giving out advice to people. I have done some searching and found out (hopefully) who he is.

A simple google search for the email swiped@live.com revealed this link http://mydomaintest.com/index.php?query=getgamesfree.net with owner douglas

A password reset on that account shows the following accounts listed. do * * * @gmail.com do * * * @aim.com

A password reset on aim.com for user name douglas(just guessing) also revealed the email d * * * *8@froze.org

Searching for the name douglas parmele and 5167, brenda gave a result http://welfare.im/dox/index.php?name=communist

There is a reference of froze.us in the dox.

Here you get his hackerforums.net profile http://www.hackforums.net/member.php?action=profile&uid=1399...

search for his posts and you see most of them are selling novelty twitter and other accounts

http://www.hackforums.net/search.php?action=results&sid=953a...

Here he gives out advice on securing accounts. http://www.hackforums.net/showthread.php?tid=3610513

You have to have an account on hackforums.net to view those links.

I could be wrong, but wasn't there a story a while back where someone explained how they could hack into any apple ID account with a similar process? Didn't linode's servers get hacked and the hacker explained the whole process?

I guess we'll never know, but last 4 digits are not difficult to get (they're on every single one of my receipts... and for all we know, this guy could be in close vicinity of him...), and making up that PayPal gave the hacker those 4 digits is a good diversion.

Clearly you've never watched a single Bond movie. The only thing a villain enjoys more than committing a crime, is revealing the intricate plan by which he will get away with it.

GoDaddy have come out and specifically said they were at fault in this case.

Link?

"GoDaddy accepts partial responsibility in social engineering attack of @N's customer account"

http://thenextweb.com/insider/2014/01/30/godaddy-accepts-par...

Reply on news.ycombinator.com