Ask HN: How does my Instagram keep getting compromised?

188 points by china 4 years ago | 112 comments

I was an early Instagram user and got my nickname as my handle and I keep getting either locked out of my account or compromised altogether.

Over the years, hackers have tried a number of things to steal my handle and I can usually tell how they get in. These days, I have no idea. I've been SIM swapped a handful of times. One time a hacker faxed a fake ID to Godaddy to try and swap out my domain to gain control of my email (they were successful).

Now, I will try to log in to my account and will just be locked out. The email I created specifically for Instagram is not recognized, and there is no way to reset my password.

I have two-factor auth on, I don't use the same password anywhere else, I change it regularly, etc.

My current theory is there is some employee at Meta that's ultimately stealing the account. Does anybody have any idea how they're hacking me?

PS: the worst part about all this is in order to get the handle back, I have to pull strings with folks I know at Meta, for a normal user, they would have absolutely no way of regaining access...

[Update] Just got the account back and still have no idea how my email was removed from the account...

[Update 2] Reviewing the security section I see a password reset email was sent to [username]@instagramz.com. No clue how or who changed the account email to that though.

pkrotich 4 years ago |

Your situation is apparently common nowadays with OG usernames and can get very dangerous. I had no idea this was a thing until I listened to an episode on Darknet Diaries [0] recently.

In the old days, I remember people going after short domains in the same manner. ICANN ended up adding locking (auth codes) - perhaps IG and other social sites can learn from it.

Be safe!

[0]https://darknetdiaries.com/episode/106/

heurisko 4 years ago | |

I'm not up-to-date with what OG means. Apparently OG "original gangster" usernames refer to common words such as "@Miracle", that were registered by early adopters.

https://www.nytimes.com/2021/02/04/style/instagram-account-f...

pkrotich 4 years ago | | |

Yes indeed - I thought everyone knew that /s :)

You’ll be amazed how much googling I do when having conversations with friends - I wasn’t born in the West and things like movie references leave me confused af! But I hide it… thank goodness for urban dictionary

emptybottle 4 years ago | | |

Can be simply read as OriGinal

cutthegrass2 4 years ago | | |

Well TIL. I thought it stood for Old Guard meaning "original or long-standing members of a group", but I'll take "original gangster" instead, sounds better :-)

rosndo 4 years ago | | |

OG does not mean “original gangster”, only confused senile journalists believe this. Just read it as “original”, or accept that nobody uses it as an abbreviation anymore.

edoceo 4 years ago | | |

Or that guy @slack on Twitter. Or @gusto on same

ww520 4 years ago | | |

OG is the old gang of people, the original early founders/adopters/users.

gkoberger 4 years ago | |

Here's another podcast episode about it, and I remember it being really really good. They actually befriend a scammer who is pretty open about how it works:

https://gimletmedia.com/shows/reply-all/v4he6k

Apreche 4 years ago | | |

TL;DR: The only methods discussed in this episode are SIM swapping and password guessing. Neither of which are relevant for OP. Unless OP is lying, there must be some other method used.

JSONderulo 4 years ago | |

Halfway through this pod. This is terrifying.

supercoffee 4 years ago | |

Reply All also did an episode about this a few years back.

https://gimletmedia.com/shows/reply-all/v4he6k

tl;dr There's underground marketplaces where shady people buy and sell OG usernames for money, which creates an incentive for shady people to steal them from the original owners.

pkrotich 4 years ago | | |

Perhaps incentives don't line up... but I'm wondering if social media sites like IG should make renting out usernames a thing - obviously there's a market for it. If I'm taking social media hiatus, for example, I wouldn't mind getting paid while away.

boppo1 4 years ago | | |

How is my username made in the last 4 years different from an OG username?

china 4 years ago | |

I'll have to listen!

guiambros 4 years ago | | |

Came here to post the same episode. Strongly recommended; it's eye-opening, and it will give you a good idea of the incentives and the type of people you're dealing with (although you'll see the techniques are the ones you are already know: SIM swapping, social engineering, escalation of personal attacks, etc).

Good luck defending your handle!

iKlsR 4 years ago |

I'd auction and sell it and be done with the headache personally. It's likely one day your meta well will dry up and that will be it, years of back and forth to see the handle gone and promoting crypto eventually or some crap.

tclancy 4 years ago | |

This is what a friend did in the exact same situation. He just moved into the house he built with the dough. Life is weird now.

leftpass 4 years ago | |

Many companies forbid the sale of usernames in their terms of service, so an attempt to auction it off could result in it being revoked. Generally, when sales of usernames do happen, it’s in private so there’s little reason to take action… it’s why there’s no reputable marketplace for usernames.

gaws 4 years ago | |

> I'd auction and sell it

Where could you even do this?

Jamie9912 4 years ago | | |

I believe there's a website called ogusers, I can't personally vouch for it, but I've heard from friends that's what they use

toomuchtodo 4 years ago |

Have you tried reporting this to Meta’s security team and copying your state’s attorney general? Sounds like the CFAA would apply. You may not win, but making noise may help, and if it’s an insider they might be fired if Meta knows the legal apparatus is notified.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

china 4 years ago | |

I haven't yet... so far I have always been able to get it back via a friend at FB.

toomuchtodo 4 years ago | | |

Get on record with law enforcement and state legal reps. Unauthorized authorization is a federal crime, and a paper trail is crucial for seeking recourse.

meatsauce 4 years ago | | |

I'd report it to the FBI, as well.

savolai 4 years ago |

My account seems to have gotten hijacked too. Someone has (apparently) posted something that's against community standards in my profile, as a consequence of which FB has disabled my account and says if I don't appeal in 30 days, the account will be disabled.

The strange thing is when I try to appeal I get this page.

"Security check To confirm your identity, we will text a confirmation code to your phone."

I select my phone number, and receive the right SMS, but it says

"Error Sending SMS Could not send confirmation SMS. Please check the phone number and try again."

So I cannot actually enter the code.

I also have 2FA enabled and this doesn't seem to have been breached.

On deviced that are still logged in I see them telling me I have posted something that is in typical photos grid format, but they don't show me what the photos were. When I press the button to request review, it does nothing.

<https://savolai.net/uncategorized-en/banned-from-facebook-an...>

zemnmez 4 years ago |

I would look at your email forwarding filters. It's common to see compromises with this pattern where the email for your account was compromised and all the email is being forwarded to an attacker.

waschl 4 years ago | |

This! Have seen this personally in multiple friend’s mail accounts. This way it is “surviving” password changes, 2FA changes etc

tpoacher 4 years ago |

Meta just seems to be superhackable with the company not giving a shit these days.

There was another user here the other day who had their heavymetal community page hacked, and facebook's advice page was to "politely ask the new owner to let them back in" [1].

Absolutely ridiculous.

[1] https://news.ycombinator.com/item?id=29706571

theginger 4 years ago |

If you are using the nickname china and have registered it a lot of places, even if you are completely non political and in no way associated with the country China, I can imagine the existence of these accounts outside of the governments control is a risk the government will be willing to spend millions trying to get rid of. I'm not sure you can fight that, at least not by yourself.

FDSGSG 4 years ago |

> My current theory is there is some employee at Meta that's ultimately stealing the account

This happens all the time, there is no recourse. Instagram employees are constantly taking usernames for themselves.

tmp_anon_22 4 years ago | |

Seems like employees can manually escalate accounts into a locked state and my guess is if it remains in that state long enough its easier to claim.

So they frustrate users long enough to eventually give up on constantly reclaiming the account, then they get it for themselves to sell or whatever.

leftpass 4 years ago | |

Not just themselves, often it's stolen to order: there's been a few mainstream stories about this and they often mention that paying off Facebook employees is pretty commonplace because the value of these usernames and the low paid customer service representatives are a recipe for bribery.

rich_sasha 4 years ago | |

Interesting, do you have any links to that end?

FDSGSG 4 years ago | | |

Just my personal observation. I earned around half a million dollars by running an "autoclaimer" that would automatically register Instagram names as they'd become available. I'd regularly see Instagram employees grabbing names from my portfolio for themselves.

hurril 4 years ago | |

Should be easy enough to post a list of stolen accounts someplace public.

KaiserPro 4 years ago | |

wait what? how are they not fired, thats got to be against the "community guidelines" (unless of course its for an advertiser or political organisation. )

jandrese 4 years ago | | |

I assume they aren't emailing Mark Zuckerberg with every account they steal. All it takes is lax internal auditing and a culture where customer service[1] is not valued and this could go on for a very long time.

[1] Ok, this is a little unfair. They do have customer service, but what they don't have is product service, and this guy is just part of the product, not a customer.

docdeek 4 years ago |

If your IG handle is the same as your HN handle, could it be some very motivated people from that country's bureaucracy looking to take that handle for the state?

cronix 4 years ago | |

Likely a phone call is all it would take and Meta would happily hand it over.

cryptoz 4 years ago | | |

Instagram stole @sussexroyal from a real user, and gave it to some entitled "royals" who used the account for like a year before dropping it. So annoying how your handle isn't your handle, it's the company's, and they will steal your handle at a whim.

I never even figured out why the "Royals" wanted specifically @sussexroyal or whatever it was so badly. The Royals can't even be like the rest of us and pick a handle that is available, they have to be like "well no we deserve this one even though someone has it already"

Closi 4 years ago | | |

Assuming that China itself is trying to capture it, and not a rogue state that still wants to use the username for political means.

tgsovlerkhgsel 4 years ago |

> My current theory is there is some employee at Meta that's ultimately stealing the account.

This was my first thought given the e-mail address change. Someone e.g. bribing a support person.

My (uninformed) guess would be that given that you got the account back, this probably got escalated, someone looked at it, fixed it, and hopefully got the criminal support person's access disabled, until the next one gets bribed...

Jerrrry 4 years ago |

>China

You will be forever fucked, as big as Meta/Facebook/Instagram's exploit attack surface is. Microsoft/Office/Xbox is in a similar position as well.

early lucky adopters not employees will always have their accounts poached constantly on every common platform. eventually those who have the names paid for the 'rights,' or defend it communally.

yes, communally - it is a literal racket of cybergangters on every platform leveraging anything from social engineering your doxxed naive grandma into reading a private key to 0-daying your teamviewer to install a common keylogger.

bribing csr's is extremely common, as is sim-swapping (bribing att/verizon csr's), and there are a myriad of attack vectors in between

but of course 94% are just script kiddies using a "turbo"/api-spammer to take the username between other 3rd party transactions. it's a parasitic economy of bottom-feeders and iGangsters.

edm0nd 4 years ago |

You should tie your IG account to a Google Voice number instead of a your cell that way it cant be SIM swapped.

r0fl 4 years ago |

My insta account keeps getting reset password requests every week for years. I’ve had multiple people ask to buy it, then threaten to sue, etc

I’ve tried to contact meta/Instagram about 50 times and not once has anyone emailed me back

How is it this hard to get support? It’s a personal account and I still have it so I don’t really care that much but there must be a way to get a hold of someone isn’t there!?

skyzyx 4 years ago |

This happened to me several years ago. My account got locked out and I had no way to contact a human to get it back.

rootsudo 4 years ago | |

Same, I was going to pen something to instagram legal and such.

JSONderulo 4 years ago |

https://www.nytimes.com/2021/12/13/technology/instagram-hand...

Her Instagram Handle Was ‘Metaverse.’ Last Month, It Vanished.

slater 4 years ago | |

And then she got it back.

whywhywhywhy 4 years ago | | |

Only after bad press.

leeroyjenkins11 4 years ago |

Ok, so I had a similar situation. What it was is that I signed up for insta pre Facebook merger. Then I connected my Facebook account to insta. So my old username password combo were compromised because I re used them when I was a moron when I was younger. So someone gained access via the original Instagram password and username, changes my email. Then I would login via Facebook and have access at the same time. The different geo locations and unusual activity caused my account to be locked periodically. When they unlocked it I logged in quick, changed the email address and password on the account on the Instagram side and enabled 2 factor and haven't had an issue since.

jsnell 4 years ago |

What devices are you using the account on? If it's on a desktop browser, my assumption would be that you've got malware. That allows them to trivially steal the session cookies, steal the passwords the next time you log in, steal any device identification cookies that are used to control not using 2FA on logins from trusted devices / sending new device notifcations, and also hijack your recovery and notification email address.

If you're only using this via the app from a mobile device, then malware is an unlikely explanation though.

(Why are you regularly changing the password anyway? What's the threat model you're trying to guard against?)

china 4 years ago | |

99% of the time I am on an iPhone, the other 1% (which is generally right after I have been hacked) is on a fully updated MacOS install.

jakub_g 4 years ago | | |

Any browser extensions installed?

edm0nd 4 years ago |

instagramz.com is a legit domain owned by Facebook

junon 4 years ago | |

Sure looks like it, nameservers point there. Seems a Facebook\b\b\bMeta employee did this to you OP.

ipaddr 4 years ago | | |

Not necessarily a hacker changing the email to a whitelisted domain that will reject the email probably makes it the safest email address to use.

vogelfrei 4 years ago |

Instagram is severly broken. I have never had an account on there and it has repeatedly happened that I was logged into some random stranger's account as I clicked on some Instagram weblink. I could read all their private conversations, message people in their name, mess with their settings. Their security is so badly broken, I wonder if they can be held criminally liable for it.

gecko39 4 years ago |

I had a two letter name which got hacked. I called in a favor from a friend of a friend at instagram/FB and got it back.. then it happened again and I didn't want to ask the favor again. IIRC they did not yet have 2FA even though I asked for it ( I was assuming it would happen again and it did. )

kasra85 4 years ago |

On top of all security measures, Meta, Google and other big tech that offer Auth-as-a-service need to offer paid service to reclaim an account. I am sure people would be happy to pay to talk to a real human and take back their account.

Jerrrry 4 years ago |

>@instagramz.com

ha....someone stole this domain or hijacked/spoofed an email chain in the password reset api. you should be honored.

>Last updated from Registry RDAP DB: 2021-12-28 06:35:41 UTC

it of course still resolves to instagram.

Cypher 4 years ago |

Plot twist, you are the hacker

ct0 4 years ago | |

This is a honeypot for new hacking ideas, right?

barbazoo 4 years ago |

Someone at Facebook stealing your domain is quite an accusation. Assuming your domain was similar to your username/IG handle, wouldn't it be more likely to be people wanting your "china" domain for spam/malware/propaganda/etc?

china 4 years ago | |

I think the stealing of my domain was a bit of social engineering by a hacker (not somebody at FB).

Now, my account gets taken without any noticeable trace on my end. No security emails, no suspicious login attempts, nada...

andkon 4 years ago | | |

Contra the above dude, I don't think it's all that strange for Facebook employees to profit directly off of their access to these systems. See this article about how employees charge for verifications: https://mashable.com/article/instagram-verification-paid-bla...

praisewhitey 4 years ago | | |

there is a lot of precedent for Meta employees taking usernames. here's another example:

https://news.ycombinator.com/item?id=7598226

klohto 4 years ago | |

Not really. It already happened several times since short usernames go for crazy amounts.

jmnicolas 4 years ago | |

> Someone at Facebook stealing your domain is quite an accusation.

NSA employees do it, why would META employees would be better than the average?

barbazoo 4 years ago | | |

I wouldn't count a NSA employee as "average", I'd assume they have access to tools the "average" doesn't have. Comparing that to someone at Facebook just doesn't make sense.

cronix 4 years ago | |

Publicly pondering a theory is an accusation now?

barbazoo 4 years ago | | |

It read to me like that, yes.