Hacking your phone to hack your Instagram

Why do people hack Instagram accounts?

In the buzzing underground market for stolen social media and gaming handles, a short, unique username can go for between $500 and $5,000, according to people involved in the trade and a review of listings on a popular marketplace. Several hackers involved in the market claimed that the Instagram account @t, for example, recently sold for around $40,000 worth of Bitcoin.

And how do they hack them?

First, criminals call a cell phone carrier’s tech support number pretending to be their target. They explain to the company’s employee that they “lost” their SIM card, requesting their phone number be transferred, or ported, to a new SIM card that the hackers themselves already own. With a bit of social engineering—perhaps by providing the victim’s Social Security Number or home address (which is often available from one of the many data breaches that have happened in the last few years)—the criminals convince the employee that they really are who they claim to be, at which point the employee ports the phone number to the new SIM card.

From there they can trigger a cascade of password resets, especially on accounts that use texts to mobiles as two factor authentication - like Instagram.

This piece from Motherboard's Lorenzo Franceschi-Bicchierai on SIM hijacking is essential reading, if you're concerned with social media account security.

• Previously: Hackers harvesting Instagram accounts.