Twitter internal panel linked to account hijackings • Hacker News Board

Re: Twitter internal panel linked to account hijackings

#31

Post by bmarquez » Thu, Jul 16, 2020, 1:47 AM UTC

_mog1 wrote: post #25

bmarquez wrote: post #19

Earlier quoted context omitted.

If the screenshot is real, I'm pretty sure that Scott Adams (the cartoonist) has that Search Blacklist button applied to him. I recently tried to search for users with his name, and he wouldn't appear at all (while unverified names with 0 followers would show up). Had to go through DuckDuckGo to find his handle.

Probably not: https://shadowban.eu/scottadamssays

You're right, thanks for the link.

I was surprised because I searched for users with the name "Scott Adams" and it was promoting users with 0 followers and not showing his verified account at all. This was through Tweetbot iOS.

Re: Twitter internal panel linked to account hijackings

#32

Post by marsrover » Thu, Jul 16, 2020, 1:53 AM UTC

mcphilip wrote: post #15

I’d be surprised if Twitter didn’t have some internal tool like this but I’d expect it to only be accessible over a VPN that few had access to.

This was my first thought as well. It must have been an oversight on someone’s part. Maybe infrastructure changes due to the shift to work remotely made it possible to access.

Re: Twitter internal panel linked to account hijackings

#33

Post by jeffbee » Thu, Jul 16, 2020, 1:54 AM UTC

afrcnc wrote: post #11

Twitter is removing those because it's of their own internal backend, not because they're necessarily connected to the hack. Huge leap from Mboard on this

Why would there be screenshots of Twitter's internal tools flying around on Discord, other than they are related to these hacks?

Re: Twitter internal panel linked to account hijackings

#34

Post by krapp » Thu, Jul 16, 2020, 2:04 AM UTC

gruez wrote: post #2

Anyone have links to more of these images? Also, if you search for the source for one of the images (mentioned in the article), you can find this tweet: https://twitter.com/UnderTheBreach/status/128349929454113177... which says the recent hacks were done through that tool.

I'm starting to think web facing site admin is a bad idea. Assuming that's what this is, I don't know.

But I'm surprised it's still a thing.

Re: Twitter internal panel linked to account hijackings

#35

Post by krapp » Thu, Jul 16, 2020, 2:05 AM UTC

zmmmmm wrote: post #17

> Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands It's kind of bizarre when you have the highest levels of government doing their critical communication on a free social media service to the point where they are critically dependent on it, then begging for support when things go…

>Maybe you shouldn't use a free service that is not under your control or any proper regulatory or quality constraints for your most important messaging to the public then?

But we hate it when governments spend money on things. And no one would trust a word that came from any service the government controlled or regulated.

Re: Twitter internal panel linked to account hijackings

#36

Post by dang » Thu, Jul 16, 2020, 2:06 AM UTC

ycombonator wrote: post #7

ycombonator wrote: post #5

“Trends Blacklist” & “Search Blacklist” are interesting buttons. Manipulation much ?

[flagged]

Please stop posting unsubstantive and/or flamebait comments. It's not what this site is for, it destroys what it is for, and we ban account that do it.

At least the GP comment contained actual information, however little.

Re: Twitter internal panel linked to account hijackings

#37

Post by duskwuff » Thu, Jul 16, 2020, 2:10 AM UTC

cameronbrown wrote: post #12

ycombonator wrote: post #5

“Trends Blacklist” & “Search Blacklist” are interesting buttons. Manipulation much ?

Immoral. Actively overriding what's really trending with what they prefer to trend. Assuming this leak is real.

Practically every "trending" algorithm involves some degree of manual tweaking. Otherwise, they end up prone to identifying uninteresting trends (like the current day of the week, or other time-sensitive trends like "lunch" showing up around local noon), or are easily manipulated by groups of users.

Besides, one of the features of Twitter's Trends is a prose description of what the keyword references -- there's no way that could be generated automatically.

Re: Twitter internal panel linked to account hijackings

#38

Post by viraptor » Thu, Jul 16, 2020, 2:11 AM UTC

EForEndeavour wrote: post #27

viraptor wrote: post #21

Earlier quoted context omitted.

The next time we swing the other way: "Maybe government should embrace popular communication media instead of spending billions on custom IT infrastructure to post a message on a custom page that everyone screenshots and copies to their timeline anyway." (Also if they don't create an "official account", someone else will do it for them)

> (Also if they don't create an "official account", someone else will do it for them) What do you mean? How would anyone not affiliated with a given government agency convince human verifiers at Twitter that they're official?

They don't have to convince any verifier. They don't have to be verified. If there's no official account and you create an account with a reasonable name, reposting every post from the official feed, you can get significant following. A lot of the followers will not care whether it's official or not and may not question an extra information appearing on the feed one day.

Re: Twitter internal panel linked to account hijackings

#39

Post by MAGZine » Thu, Jul 16, 2020, 2:11 AM UTC

542458 wrote: post #20

geerlingguy wrote: post #14

Earlier quoted context omitted.

Some suggested the admin panel can initiate a password reset, and that, coupled with email management would allow account takeover, effectively (without allowing 'tweet as user' functionality).

All the hacked accounts seem to have had the associated email changed. I think the attack goes admin panel -> change email -> reset PW -> tweet bitcoin scams. https://twitter.com/sniko_/status/1283485972286656517

changing emails is a common way to keep account owners out of their accounts. might not have anything to do with the mode of entry.

Re: Twitter internal panel linked to account hijackings

#40

Post by 101008 » Thu, Jul 16, 2020, 2:12 AM UTC

According to some images, Twitter low level employees can see email address of all accounts (and I guess phone numbers). I know some celebrities have their real email address and phone numbers on those accounts. Isn't that something bad?