Hacker News Reader

Comment by concinds | Hacker News Reader

> There have been attempts to hack me 2 days after requesting a quote from some buyers

How did you protect yourself against those?

Also, as a security researcher, are there alternatives you'd recommend more? Would Linux/Windows be more secure?

TOTP two factor authentication protected me. They attacked my recovery email to go for my primary, at the time my recovery provider didn't offer 2FA. I think they may have social engineered the recovery with my SSN (it was a randomly generated password). Then they used the recovery provider to buy time by adding 2FA options, I began recovering within a minute. It was impressive how quickly they worked, they tried to compromise 5 other accounts in 3 minutes. Unfortunately for them, all of the accounts they targeted from that point on had 2FA, and they lost access in 15 minutes.

If this happened to me, I'd send a tip to the FBI[1].

[1] https://tips.fbi.gov

Already done, with as much relevant information as I could compile. I hope they find who is attacking security researchers. If I had to guess, the motivation may be for the zerodays I have.

Wait a minute...

You tried to report to apple. You didn't like the way they "treated" you, so you decided to sell it on black market. The black market person tried to hack you. You then went to the fbi to complain about how your black market buyer treated you?

Am i missing something from this story? That seems like a really bad plan.

Yes, this is wrong, both in your timeline and description of the events. I said in my previous comments that the Apple bounty program didn't exist when I began (https://news.ycombinator.com/item?id=28471263) so I was forced to consider other buyers in order to get income as a researcher. I never claimed to entertain any black market buyers, nor would I. Zerodium isn't the black market, they sell to government buyers. Government buyers may be concerned with the manner of which their sources collect said zerodays. The black market is Crowdfense, Israeli/Chinese government, et al.

"Dear FBI, please tell your friends at the NSA to knock it off"

On a serious note, I'm glad researchers like you exist.

Reply on news.ycombinator.com