Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter internal panel linked to account hijackings

vice.com

Post reply on HN
Print view View original

41–50 of 477 posts

Re: Twitter internal panel linked to account hijackings

#41

Post by klyrs »

krapp wrote: post #34
gruez wrote: post #2

Anyone have links to more of these images? Also, if you search for the source for one of the images (mentioned in the article), you can find this tweet: https://twitter.com/UnderTheBreach/status/128349929454113177... which says the recent hacks were done through that tool.

I'm starting to think web facing site admin is a bad idea. Assuming that's what this is, I don't know. But I'm surprised it's still a thing.

Is there a better solution? How do you airgap administration of a web facing service?

Re: Twitter internal panel linked to account hijackings

#42

Post by hyperdimension »

EForEndeavour wrote: post #27
viraptor wrote: post #21

Earlier quoted context omitted.

The next time we swing the other way: "Maybe government should embrace popular communication media instead of spending billions on custom IT infrastructure to post a message on a custom page that everyone screenshots and copies to their timeline anyway." (Also if they don't create an "official account", someone else will do it for them)

> (Also if they don't create an "official account", someone else will do it for them) What do you mean? How would anyone not affiliated with a given government agency convince human verifiers at Twitter that they're official?

Well, put it this way: why is Donald Trump listed on Twitter as @realDonaldTrump?

If you don't snatch up your (organization's) name first, someone will surely do so for you.

(Honestly not trying to incite anything by using him as an example; I just hardly use Twitter and he was the first to come to mind.)

Re: Twitter internal panel linked to account hijackings

#43

Post by rvz »

bmarquez wrote: post #19
ycombonator wrote: post #5

“Trends Blacklist” & “Search Blacklist” are interesting buttons. Manipulation much ?

If the screenshot is real, I'm pretty sure that Scott Adams (the cartoonist) has that Search Blacklist button applied to him. I recently tried to search for users with his name, and he wouldn't appear at all (while unverified names with 0 followers would show up). Had to go through DuckDuckGo to find his handle.

A user called '@viennacat921' joined in August 2019 with 0 tweets and is shown in the screenshot. '@b' is pernamently suspended and '@arceus' is protected and locked with all of this being reflected in the admin dashboard.

This leak seems to be legit.

Re: Twitter internal panel linked to account hijackings

#45

Post by macintux »

klyrs wrote: post #41
krapp wrote: post #34

Earlier quoted context omitted.

I'm starting to think web facing site admin is a bad idea. Assuming that's what this is, I don't know. But I'm surprised it's still a thing.

Is there a better solution? How do you airgap administration of a web facing service?

It's painful (although I suppose all airgap solutions are) but remote access protocols like RDP or SSH tunneling to a jump host which has access to the administration portal is one common(?) solution.

Re: Twitter internal panel linked to account hijackings

#46

Post by hsod »

bmarquez wrote: post #31
_mog1 wrote: post #25

Earlier quoted context omitted.

Probably not: https://shadowban.eu/scottadamssays

You're right, thanks for the link. I was surprised because I searched for users with the name "Scott Adams" and it was promoting users with 0 followers and not showing his verified account at all. This was through Tweetbot iOS.

Was this just now? Verified accounts weren’t showing up in search during the hack

Re: Twitter internal panel linked to account hijackings

#47

Post by krapp »

klyrs wrote: post #41
krapp wrote: post #34

Earlier quoted context omitted.

I'm starting to think web facing site admin is a bad idea. Assuming that's what this is, I don't know. But I'm surprised it's still a thing.

Is there a better solution? How do you airgap administration of a web facing service?

I don't know... I've seen a lot of forums that just put a login form in /admin and I just kind of assumed a site like Twitter would use a VPN or ssh or a custom app with its own secret sauce protocol or something... better than I could have whipped up in my PHP monkey days.

Re: Twitter internal panel linked to account hijackings

#48

Post by s5300 »

zmmmmm wrote: post #17

> Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands It's kind of bizarre when you have the highest levels of government doing their critical communication on a free social media service to the point where they are critically dependent on it, then begging for support when things go…

He was probably just trying to diddle some kids via Twitter and wants to be damn sure somebody wasn't able to find that out.

Re: Twitter internal panel linked to account hijackings

#49

Post by scottmf »

101008 wrote: post #40

According to some images, Twitter low level employees can see email address of all accounts (and I guess phone numbers). I know some celebrities have their real email address and phone numbers on those accounts. Isn't that something bad?

How do we know they're low-level? Could you show the image?
Post reply on HN