Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter internal panel linked to account hijackings

vice.com

Post reply on HN
Print view View original

21–30 of 477 posts

Re: Twitter internal panel linked to account hijackings

#21

Post by viraptor »

zmmmmm wrote: post #17

> Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands It's kind of bizarre when you have the highest levels of government doing their critical communication on a free social media service to the point where they are critically dependent on it, then begging for support when things go…

The next time we swing the other way:

"Maybe government should embrace popular communication media instead of spending billions on custom IT infrastructure to post a message on a custom page that everyone screenshots and copies to their timeline anyway."

(Also if they don't create an "official account", someone else will do it for them)

Re: Twitter internal panel linked to account hijackings

#22

Post by kryogen1c »

542458 wrote: post #20
geerlingguy wrote: post #14

Earlier quoted context omitted.

Some suggested the admin panel can initiate a password reset, and that, coupled with email management would allow account takeover, effectively (without allowing 'tweet as user' functionality).

All the hacked accounts seem to have had the associated email changed. I think the attack goes admin panel -> change email -> reset PW -> tweet bitcoin scams. https://twitter.com/sniko_/status/1283485972286656517

if this were true, youd think itd be trivial to review changelog for two affected users and deactivate the in-common admin account. not sure why this would take hours to solve.

Re: Twitter internal panel linked to account hijackings

#23

Post by freehunter »

zmmmmm wrote: post #17

> Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands It's kind of bizarre when you have the highest levels of government doing their critical communication on a free social media service to the point where they are critically dependent on it, then begging for support when things go…

The FBI is very commonly involved in cyber crimes and the other departments have a role to play as well. Calling the FBI during a major security incident is not unusual at all, I’ve done it a number of times.

Re: Twitter internal panel linked to account hijackings

#25

Post by _mog1 »

bmarquez wrote: post #19
ycombonator wrote: post #5

“Trends Blacklist” & “Search Blacklist” are interesting buttons. Manipulation much ?

If the screenshot is real, I'm pretty sure that Scott Adams (the cartoonist) has that Search Blacklist button applied to him. I recently tried to search for users with his name, and he wouldn't appear at all (while unverified names with 0 followers would show up). Had to go through DuckDuckGo to find his handle.

Probably not: https://shadowban.eu/scottadamssays

Re: Twitter internal panel linked to account hijackings

#26

Post by mzs »

troughway wrote: post #4

It's an admin panel that shows account information and allows for the staff to change details. What is the big deal?

>A little over ten years ago: Twitter settled with the FTC as a result of an internal tools breach. Their internal tooling was available directly over the web and accessed through an employee account protected by the password "happiness"

https://twitter.com/Magoo/status/1283520203679133696

Re: Twitter internal panel linked to account hijackings

#27

Post by EForEndeavour »

viraptor wrote: post #21
zmmmmm wrote: post #17

> Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands It's kind of bizarre when you have the highest levels of government doing their critical communication on a free social media service to the point where they are critically dependent on it, then begging for support when things go…

The next time we swing the other way: "Maybe government should embrace popular communication media instead of spending billions on custom IT infrastructure to post a message on a custom page that everyone screenshots and copies to their timeline anyway." (Also if they don't create an "official account", someone else will do it for them)

> (Also if they don't create an "official account", someone else will do it for them)

What do you mean? How would anyone not affiliated with a given government agency convince human verifiers at Twitter that they're official?

Re: Twitter internal panel linked to account hijackings

#28

Post by root_axis »

viraptor wrote: post #21
zmmmmm wrote: post #17

> Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands It's kind of bizarre when you have the highest levels of government doing their critical communication on a free social media service to the point where they are critically dependent on it, then begging for support when things go…

The next time we swing the other way: "Maybe government should embrace popular communication media instead of spending billions on custom IT infrastructure to post a message on a custom page that everyone screenshots and copies to their timeline anyway." (Also if they don't create an "official account", someone else will do it for them)

Why do you say this? What about "the other way" would make the logic any different?

Re: Twitter internal panel linked to account hijackings

#29

Post by julianlam »

kryogen1c wrote: post #22
542458 wrote: post #20

Earlier quoted context omitted.

All the hacked accounts seem to have had the associated email changed. I think the attack goes admin panel -> change email -> reset PW -> tweet bitcoin scams. https://twitter.com/sniko_/status/1283485972286656517

if this were true, youd think itd be trivial to review changelog for two affected users and deactivate the in-common admin account. not sure why this would take hours to solve.

You're assuming this internal tool was built securely and was feature complete.

My experience with internal tooling in general suggests otherwise.

Re: Twitter internal panel linked to account hijackings

#30

Post by fireattack »

bmarquez wrote: post #19
ycombonator wrote: post #5

“Trends Blacklist” & “Search Blacklist” are interesting buttons. Manipulation much ?

If the screenshot is real, I'm pretty sure that Scott Adams (the cartoonist) has that Search Blacklist button applied to him. I recently tried to search for users with his name, and he wouldn't appear at all (while unverified names with 0 followers would show up). Had to go through DuckDuckGo to find his handle.

Twitter shadow ban certain IDs in search suggestion isn't news, but @scottadamssays doesn't seem to be one of them.
Post reply on HN