How I almost lost my $500,000 Twitter user name @jb… and my startup

Josh Bryant is the co-founder and CEO of Droplr, a collaboration tool for sharing files. He has also worked for Incredible Labs (makers of Donna) and He lives in Bend, Oregon. This post originally appeared on his personal blog.

If you haven’t read it yet, check out Naoki Hiroshima’s account of how he was blackmailed into giving his Twitter account away. I read it on Wednesday, and the story was all too familiar to me. My version also has a few implications that are far worse.

I’m @jb on both Twitter and Instagram. My user name is a very heavy target for these types of attacks. It used to be primarily because of the Jonas Brothers, but of course now it’s all related to Justin Bieber. Because of the marketing power behind Bieber's name, there are thousands of companies or hackers who would love to get their grubby hands on my user name for profit. Like Naoki, I too have been offered inordinate sums of money for my user name, and I get a regular stream of "forgot password" e-mails to my inbox.

Read 11 remaining paragraphs | Comments

Upgrading From OpenX to Revive Adserver Is a Minor Upgrade

We have recently gotten a number of questions about how much disruption upgrading from OpenX to the new Revive Adserver causes and as other undoubtedly have the same questions we wanted to address those for a wider audience. The good news is that the upgrade should be seamless in most instances. While the software has new name – due to ownership of the software being transferred – and a jump in version number from 2.8 to 3.0, the changes so far have been under the hood. This means that you won’t have to make changes to zones, campaigns, banners, ad positions, etc.

Two of the releases of Revive Adserver (3.0.0 and 3.0.2) have fixed security vulnerabilities that could lead to the ad server being hacked, so if you haven’t upgrading yet you should do that as soon as possible. There have also been bug fixes and modernization, including support for PHP 5.4 and 5.5, included in the new versions so far.

If you have previously done an upgrade between versions of OpenX 2.8 then you should find the process to be the same when upgrading to Revive Adserver.

So far the only issue we have run in to with the upgrade is that in one instance the upgrade failed to remove the OpenX Market plugin, which had been deprecated. The failure to remove that caused the admin interface to not work due to a Failed Opening Required error for the file /lib/ox/m2M/xmlrpcexecutor.php. If that occurs you can delete the /www/admin/plugins/oxMarket/ directory allowing access to the admin interface where you can fully remove the plugin and the openXWorkflow plugin, which should also have been removed.

If you are looking for someone to handle the upgrade for you, we can do a one-time upgrade for you or we can handle upgrades on an ongoing basis for you (insuring that you always get security fixes applied within a day of their release).

New Snowden docs show Canadian spies tracked thousands of travelers

According to newly published documents, Canadian spies tracked thousands of travelers online for days after they left an unnamed Canadian airport.

This revelation, gleaned from 2012 slides (PDF) provided by whistleblower Edward Snowden, shows that the Communications Security Establishment Canada (CSEC) conducted a real-world test that began with a “single seed Wi-Fi IP address” from an “international airport” and assembled a “set of user IDs seen on network address over two weeks.”

The technique appears to be related to one outlined by University of California San Diego and Microsoft researchers in a 2010 research paper (PDF).

Read 22 remaining paragraphs | Comments


Picking up the pieces after the @N Twitter account theft

Two days ago, Ars ran a syndicated story by software developer Naoki Hiroshima on how his potentially valuable Twitter handle was stolen (the story originally appeared on Medium). Hiroshima described a painful ordeal wherein an attacker extracted credit card information from his PayPal account, used that information to reset the login credentials for Hiroshima's GoDaddy account, and then modified the domain's MX records (the set of DNS entries that tell everyone else on the Internet where to send that domain's e-mail) away from Hiroshima's servers to their own. The attacker also appeared to have modified a number of other details of Hiroshima's GoDaddy account, making it impossible for Hiroshima to gain access. The attacker then attempted to reset the password to Hiroshima's Twitter account, "@N," but was unsuccessful.

Unable to gain access to the @N account, the attacker then e-mailed Hiroshima and threatened to take action against Hiroshima's website's domains unless he changed his Twitter handle to something else, allowing the attacker to assume the "@N" handle—which he would then presumably sell.

Hiroshima attempted to regain access to his GoDaddy account, but GoDaddy wouldn't restore his access, because Hiroshima no longer appeared to be the legitimate owner of the account. Even involving a GoDaddy executive didn't appear to fix things. A day later, after further threats from the attacker, Hiroshima surrendered the @N handle, and the attacker promptly sent Hiroshima his GoDaddy login credentials. It was a successful hostage exchange, as such things go, but Hiroshima found himself victimized with no apparent recourse other than acceding to the attacker's demands.

Read 57 remaining paragraphs | Comments