AirBnB accounts hacked..............

As news spread internationally that AirBnB account holders in the North America and as far as Europe have had their profiles compromised by hackers there was no jitters at first. Since then it has been confirmed by email after I inquired, reports had surfaced that American customers have found their profiles compromised, they have also notified the codenamed ‘Pink Crab’ outfit for LGBT guests located in Portland in order to either delete the original one or simply set up new profiles and reengage, the verification process for current and newly approaching clients or inquiries is crucial so as not to have the ‘wrong crowd’.

Access to the verification badges of users is also troubling and why oh why was not a two or three step verification system in place. The ‘Pink Crab’ was originally a private outfit that relied on word of mouth between prior or repeat guests who spread the word even as they do cater to non LGBT clientele. The place hosted as well workshops often times with very higher than market prices; a criticism I have had of them after DJing there at a LGBTQ event almost fifteen years ago and two times since and hosting a book fair when I was more active in the book industry. I also have witnessed one re-commitment ceremony there when a lesbian couple who resided in New York wanted to do so back home very privately. The staff was a bit taken aback at the time as they never saw the sealing of vows by a same gender couple but have seen parties and so on.

Management says they want to keep the arrangement ultra private similarly to the Bubbles Bar even as stiff competition, slowly developing job markets in the US and fickle Canadian visitors’ numbers and refugee crisis intertwined with European economic challenges abound. Many ‘secret’ spaces have to be as in this case at the Crab literally and metaphorically crawl out of the sand hole more openly whilst engage disruptive technologies change traditions almost overnight. Other previously unknown guest houses have been getting bolder and clearly state via AirBnB that they accept LGBT guests and offer a secure environment by way of security companies for guests, much larger hotels are popping up all over the place which only adds more competition to smaller properties. A chaperone may be assigned (subject to the option if selected in booking) or armed guided tours are conducted as well. Some are concerned that if such hackings are not properly addressed by AirBnB soon trust might be lost, the entity seems to be moving slow on the hacking and based on their Facebook page the complaints were already coming in for some time now. 

Airbnb today announced a new set of mandatory security measures, including multi-factor authentication, it’s implementing to prevent account takeovers. Now, for the first time, Airbnb will require both hosts and guests logging in from new devices to verify their identity with a second account, either via SMS or email. A vast majority of other social and communication apps use multi-factor 

authentication, including Facebook, Google, and Twitter, making Airbnb a bit of an outlier to have gone so long before enabling it by default.

AIRBNB IS LATE TO THE MULTI-FACTOR PARTY say some lol

meanwhile:

Nate Blecharczyk

Chief Strategy Officer / co-founder 

said among other things that, Trust is the fundamental currency of the sharing economy — it’s at the very heart of our Airbnb community. As our global community continues to grow, we remain vigilant of the ways bad actors are looking to take advantage of this trust. Online scammers in particular are constantly adapting and refining their attacks.

One fraudulent tactic that is receiving increased attention is called an account takeover, or ATO for short. I want to take some time to explain to you how seriously we take this threat and to explain what we are doing here at Airbnb to confront it.

An ATO occurs when a bad actor gets access to a user’s account by stealing their password, usually through one of the following methods:

Password dumps. You’ve probably heard about high-profile security breaches of personal information at a number of different companies over the last few years. When these breaches occur, bad actors often download massive lists of usernames and passwords that they sell on the black market. Scammers then use the usernames and passwords they’ve purchased to see if they are a match for any number of other accounts, as many people tend to use the same password across platforms. Thus, this could in turn put your Airbnb account information at risk, despite the fact that our platform was not compromised.

Phishing. Bad actors will email or SMS you a link that asks you to enter your account credentials into a website that looks like one you know and use — but is actually malicious. They then record the information you provide and can use it to access your account.

Malware. If your computer is compromised by malicious software, it can capture your keystrokes and record your usernames and passwords. Once a bad actor has collected your password this way, they can maliciously access your account.

Historically, we’ve defended against account takeovers by using a machine learning model that predicts the probability that each login or action on Airbnb is being performed by the true account owner. If the model predicts a high risk that the account has been taken over, we would require the user to provide an additional confirmation.

The model is trained by observing hundreds of millions of historical login events that have been labeled as “good” or “bad”. The model then evaluates hundreds of signals simultaneously to determine the risk level, looking for various patterns such as:

Login from an unexpected country

Login from an unexpected IP address, computer, or phone

An unexpectedly high number of logins from a particular IP address

Our model is effective at stopping most account takeovers, but unfortunately there have been some incidents where hosts and guests have suffered. This is not acceptable to us, therefore we’re working around the clock to do everything we can to improve our detection and prevention methods. While the machine learning approach is common for online platforms, the nature of Airbnb’s product and the critical importance of trust within and among our community requires an even higher bar for security.

Effective today, we have launched new defenses to further prevent bad actors from taking over an Airbnb account, including:

Multi-factor authentication. We’re requiring additional verification whenever a user logs in from a new device, such as a computer, phone, or tablet — as is often the case for other services such as online banking. When you sign up for Airbnb, we’ll remember the device you used and allow you to log in from that device, as long as you have the password. Any new device you use, however, will require an additional verification even if you have the password. This defense is typically referred to as multi-factor authentication. We’ll confirm that you are the true account owner by sending a one-time unique confirmation code to your account phone number or email. Once you’ve entered that code on our site through your new device, you won’t have to do it again on that machine.

Improving account alerts. We’ve added SMS in addition to email to the ways in which we alert you, as well as expanded the range of changes we’ll proactively notify you about. We do this in order to let you know these changes have taken place — and so that you can take action to recover your account in the event you were not the one who made those changes.

Fortunately, the vast majority of our hosts and guests never have to deal with account takeovers or any other scam. While the enhancements we’re announcing today will add yet another layer of security to our users’ accounts, we always want our community to continue to be vigilant and exercise good security practices. We outline some recommended practices around strong passwords, safe payments and other measures on our site here.

The company says that one of the most common security breaches suffers is when a scammer or other bad actor takes control of someone’s account by obtaining the password. Normally, this would mean access to someone’s email or the ability to purchase stuff on their behalf. But in the case of Airbnb, it could mean giving a stranger access to private details about your home and the ability to rent it out to others. That arguably raises the stakes when it comes to account security.

Airbnb says it already uses predictive models, trained using machine learning techniques, that look for uncharacteristic behavior to flag. For instance, if the account is seeing an abnormal number of login attempts or a login from a foreign country, Airbnb’s system might ask for an additional confirmation that the person logged in is truly the host. Unfortunately, the company says this isn’t enough and both guests and hosts have suffered lost funds and fraudulent bookings as a result.

It is becoming all too easy these days to hack unto sites or phones and with the AirBnB business model allowing profiles to be more open even as persons are using fake or unverified identity photos, one impacted individual an American said the hacker had a photo of Bruce Willis when it was abundantly clear is was not the celebrity. 

The ability to change one’s personal information on the platform has also come into question, when a user over twenty hours can switch names, upload photos and or location is still too close a period for someone who is supposed to be an honest client. With allegations of an active hacking community in Russia for example especially before and after the United States elections has only sought to raise speculations that the hack is Russian based.

Media reports carried the discovery of the hacking:

Airbnb is improving the security of its app and website after a BBC investigation found people’s homes had been burgled by scammers using stolen accounts.

The BBC spoke to three people who were targeted after they advertised their properties on the accommodation-booking service.

The scammers hijacked accounts with verified badges and changed some of personal details to pull off the thefts.

Airbnb said it had already been working on the changes – which include sending text warnings if profiles are altered – when the crimes were brought to its attention.

"Unfortunately there have been some incidents where hosts and guests have suffered," said Nate Blecharczyk, co-founder of Airbnb.

"This is not acceptable to us, therefore we’re working around the clock to do everything we can to improve our detection and prevention methods."

The Bubbles Bar outfit in south west Jamaica has not been impacted as the client is wide enough to carry word of mouth via social media platforms albeit in private groups but they still do engage via AirBnB. Many US interests are searching for smaller residencies as the newer millennials with disposable incomes while doing the five star properties also want a more earthy experience on the ground while having the basics such as internet access and other meeting or mini-conference space. Bubbles bar after some convincing hosted a webinar which went pretty well, the boss does not like working in the day for the most part. There is a rumour as well that an all female guest house as well in eastern Jamaica that occasionally host lymes and such with a tightly knit crew and they occasionally engage AirBnB as well while repeatedly using a new name at every cycle.

Keeping my fingers crossed I hope that AirBnB can strengthen their security since they are the trusted outfits; newer rivals are not there yet. Given the ease of hacking it is incumbent for the ABnB folks to be far more stronger on the security front.

Peace & tolerance

H