Twitter internal panel linked to account hijackings • Hacker News Board

Re: Twitter internal panel linked to account hijackings

#51

Post by [deleted] » Thu, Jul 16, 2020, 2:51 AM UTC

[deleted]

Re: Twitter internal panel linked to account hijackings

#52

Post by EE84M3i » Thu, Jul 16, 2020, 2:55 AM UTC

mcphilip wrote: post #15

I’d be surprised if Twitter didn’t have some internal tool like this but I’d expect it to only be accessible over a VPN that few had access to.

I don't know about twitter, but a lot of companies are trying to drop VPNs entirely going no-vpn/boyond-corp/"zero trust", so it's not terribly surprising to me.

Re: Twitter internal panel linked to account hijackings

#53

Post by throwaway69123 » Thu, Jul 16, 2020, 2:59 AM UTC

Didnt @jack testify before congress that twitter didnt blacklist accounts?

Re: Twitter internal panel linked to account hijackings

#54

Post by dilandau » Thu, Jul 16, 2020, 3:01 AM UTC

Didn't Twitter say that they don't shadow-ban? [1] From a leaked screenshot of the panel, though, it appears they have a search/trend blacklist.

1: https://www.washingtonexaminer.com/business/jack-dorseys-per...

EDIT: thanks for the downvotes, twitter.

Re: Twitter internal panel linked to account hijackings

#55

Post by dilandau » Thu, Jul 16, 2020, 3:02 AM UTC

throwaway69123 wrote: post #53

Didnt @jack testify before congress that twitter didnt blacklist accounts?

Yes. I just posted asking basically the same thing:

https://www.washingtonexaminer.com/business/jack-dorseys-per...

Re: Twitter internal panel linked to account hijackings

#56

Post by tomc1985 » Thu, Jul 16, 2020, 3:03 AM UTC

klyrs wrote: post #41

krapp wrote: post #34

Earlier quoted context omitted.

I'm starting to think web facing site admin is a bad idea. Assuming that's what this is, I don't know. But I'm surprised it's still a thing.

Is there a better solution? How do you airgap administration of a web facing service?

It's quite common to restrict connections to whitelisted IPs

Re: Twitter internal panel linked to account hijackings

#57

Post by 101008 » Thu, Jul 16, 2020, 3:07 AM UTC

scottmf wrote: post #49

101008 wrote: post #40

According to some images, Twitter low level employees can see email address of all accounts (and I guess phone numbers). I know some celebrities have their real email address and phone numbers on those accounts. Isn't that something bad?

How do we know they're low-level? Could you show the image?

In this thread some people shared screenshots of the dashboards. I said low-level because some reports said that the hacker paid 2k to the employee to have access. I dont think a high-level employee would sell the credentials for that amount of money.

Although I could be wrong if the reports are wrong too.

Re: Twitter internal panel linked to account hijackings

#58

Post by coronadisaster » Thu, Jul 16, 2020, 3:09 AM UTC

I wonder if Twitter will get sued for this...

Re: Twitter internal panel linked to account hijackings

#59

Post by hannasanarion » Thu, Jul 16, 2020, 3:09 AM UTC

throwaway69123 wrote: post #53

Didnt @jack testify before congress that twitter didnt blacklist accounts?

What does that have to do with this?

Re: Twitter internal panel linked to account hijackings

#60

Post by slg » Thu, Jul 16, 2020, 3:10 AM UTC

>We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

I wonder the size of the population of employees that have access to these internal tools. How many people can independently fire off a Tweet from Jeff Bezos or Elon Musk and erase billions from the stock market? How many people can seize the account of Joe Biden (or presumably Donald Trump) and cause a huge international incident?