Twitter internal panel linked to account hijackings • Hacker News Board

Re: Twitter internal panel linked to account hijackings

#71

Post by derision » Thu, Jul 16, 2020, 3:19 AM UTC

slg wrote: post #60

>We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools. I wonder the size of the population of employees that have access to these internal tools. How many people can independently fire off a Tweet from Jeff Bezos or Elon Musk and erase billions from the stock market? How many people can seize the a…

Judging by Trump was one of the few that wasn't hacked, presumably there are some extra controls in place for that account.

Re: Twitter internal panel linked to account hijackings

#72

Post by minimaxir » Thu, Jul 16, 2020, 3:21 AM UTC

jc_811 wrote: post #62

So it was a social engineering attack against employees with high level access. This sentence still doesn’t make sense to me: “ Once we became aware of the incident, we immediately locked down the affected accounts and removed Tweets posted by the attackers.” The accounts were posting for hours after it seemed Twitter became aware what was going on.

> The accounts were posting for hours after it seemed Twitter became aware what was going on.

Oddly, it was just Elon Musk's account that had multiple tweets over a long period of time. The other accounts did just one.

Re: Twitter internal panel linked to account hijackings

#73

Post by tdhz77 » Thu, Jul 16, 2020, 3:21 AM UTC

EForEndeavour wrote: post #27

viraptor wrote: post #21

Earlier quoted context omitted.

The next time we swing the other way: "Maybe government should embrace popular communication media instead of spending billions on custom IT infrastructure to post a message on a custom page that everyone screenshots and copies to their timeline anyway." (Also if they don't create an "official account", someone else will do it for them)

> (Also if they don't create an "official account", someone else will do it for them) What do you mean? How would anyone not affiliated with a given government agency convince human verifiers at Twitter that they're official?

Once a public official leaves office twitter should remove all followers to zero.

Re: Twitter internal panel linked to account hijackings

#74

Post by tdhz77 » Thu, Jul 16, 2020, 3:23 AM UTC

Consultant32452 wrote: post #65

freehunter wrote: post #23

Earlier quoted context omitted.

The FBI is very commonly involved in cyber crimes and the other departments have a role to play as well. Calling the FBI during a major security incident is not unusual at all, I’ve done it a number of times.

In the early days of the internet the FBI was kind enough to call my employer and inform us that we had left open an anonymous FTP server, and it was serving up Disney movies. Those were good times.

FBI warned a non-profit 8 hours before news broke that the US had bombed an Iranian general. Indeed, they saved many lives.

Re: Twitter internal panel linked to account hijackings

#75

Post by blondin » Thu, Jul 16, 2020, 3:24 AM UTC

> social engineering

had that feeling... wonder how much more vulnerable working from home is making us to such things.

also scary that targeted employees with such level of access fell for it. must have been really sophisticated.

Re: Twitter internal panel linked to account hijackings

#76

Post by except » Thu, Jul 16, 2020, 3:24 AM UTC

I find it hard to believe this was a Social Engineering based attack. Elon Musk’s account was accessed multiple times after their tweets being deleted and it seemed to last forever, account by account being taken over.

Re: Twitter internal panel linked to account hijackings

#77

Post by macintux » Thu, Jul 16, 2020, 3:25 AM UTC

marcinzm wrote: post #66

macintux wrote: post #45

Earlier quoted context omitted.

It's painful (although I suppose all airgap solutions are) but remote access protocols like RDP or SSH tunneling to a jump host which has access to the administration portal is one common(?) solution.

That's only safer from attacks that bypass the public admin portal authentication. Any social engineering attack that steals credentials directly won't be impacted.

It’s another layer of defense. Someone has to not only know your credentials but also know how to use them to get to the jump host, and from the jump host know what to do next (although unless it’s ephemeral, there are probably enough bread crumbs to find the proper url).

Re: Twitter internal panel linked to account hijackings

#78

Post by coronadisaster » Thu, Jul 16, 2020, 3:25 AM UTC

siquick wrote: post #67

coronadisaster wrote: post #58

I wonder if Twitter will get sued for this...

Isn't the whole point of Terms of Service to protect against being sued in the event of these kind of instances?

hopefully not enforceable

Re: Twitter internal panel linked to account hijackings

#79

Post by catalogia » Thu, Jul 16, 2020, 3:26 AM UTC

> Once we became aware of the incident, we immediately locked down the affected accounts and removed Tweets posted by the attackers.

This must be some new meaning of the word 'immediately' that I wasn't previously aware of. It took them quite a while to get these accounts locked.

Re: Twitter internal panel linked to account hijackings

#80

Post by harryh » Thu, Jul 16, 2020, 3:27 AM UTC

notwhereyouare wrote: post #69

To me, it seems a little weird they can tweet on behalf of a user. Especially a user with 2FA on their account. Curious as to what types of changes might come out of this going forward

More likely a password reset to take over the account. After that an attacker can just tweet from any standard client.