Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#81

Post by TeMPOraL »

syshum wrote: post #28
teknopurge wrote: post #4

It's not a hack when an employee holds the door open and gives use of an admin management tool to a third party. Likewise, it's not a bitcoin scam when bitcoin is the method of transfer, just like it's not a US-dollar scam every other time dollars are used in theft.

We have devalued the term hacking to the point were just opening cmd on windows is "hacking" now

That's not us, that's tech support scammers.

Opening a CMD and executing an "echo YOU HAVE VIRUSES", or repeatedly executing TREE command, are used in practice to bait people into paying for "malware removal" and "anti-hacker protection".

Re: Who’s behind Wednesday’s epic Twitter hack?

#82

Post by untog »

blisseyGo wrote: post #69

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

Well, it was just a Bitcoin scam... it had the potential to be huge like the AP hack but the hackers didn't use the exploit to its full potential. Why, I have no idea. Imagine if a raft of prominent blue ticked accounts started tweeting about a disaster. The market would have tanked.

Re: Who’s behind Wednesday’s epic Twitter hack?

#83

Post by Qw3r7 »

christoph wrote: post #54

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to t…

He might just be inferring what he believes rather than an out right allegation. You are right though, I would consider this to be doxxing.

Re: Who’s behind Wednesday’s epic Twitter hack?

#84

Post by paxys »

Tempest1981 wrote: post #62
paxys wrote: post #58

It's bizarre to me that someone pulled off an account takeover of this magnitude and the end result was random people being scammed out of ~$100K in Bitcoin (that too allegedly). A single well-crafted Tweet from one of these accounts is probably worth more. Heck Twitter would have paid that much or more just in bug bounties for reporting this.

see this, from earlier: https://news.ycombinator.com/item?id=23860584 "No, you couldn't have made more money than the Twitter hacker" https://fortenf.org/e/security/2020/07/15/twitter-hack.html

I don't buy the stock market argument. People open short positions worth more than $100K every day, especially against companies like Tesla. There would be nothing suspicious about a few such trades.

But really, my point is that pulling off a sophisticated exploit involving major celebrities, politicians and CEOs, social engineering/bribery, internal access at a top company etc. doesn't really seem worth the risk if at the end it nets you $100K.

Re: Who’s behind Wednesday’s epic Twitter hack?

#85

Post by yjftsjthsd-h »

christoph wrote: post #54

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to t…

> It feels a very, very small step away from doxxing to me.

What small step is that? Looks like a textbook case of doxxing to me.

Re: Who’s behind Wednesday’s epic Twitter hack?

#86

Post by wgerard »

danso wrote: post #73
thinkloop wrote: post #52

Earlier quoted context omitted.

Obama and Biden are part of it

Neither Obama nor Biden nor Bloomberg are "active government officials". They have no power to conduct U.S. government business, thus an intrusion on their private social media accounts is not going to be an obvious or immediate threat to the security of the U.S. government.

Former presidents are still privy to a lot of information (e.g. they receive national security briefings still). Hacking their technology accounts is absolutely a threat to the security of the US govt, and is one reason the Secret Service specifically monitors their technology usage.

I'd bet a lot of money the inclusion of people like Obama and Biden all but guaranteed the FBI/NSA get involved now, or at the very least the Secret Service.

Re: Who’s behind Wednesday’s epic Twitter hack?

#87

Post by ex3ndr »

kerng wrote: post #61
gwittel wrote: post #48

It will be interesting to see how the access was gained. I wonder how well this administrative system was protected. Did they have basic controls like: 1) Accessible via corporate VPN only (requiring 2fa) 2) Admin panel protected by 2fa plus necessary authentication+authorization controls 3) Audit trails Short of cooperative access (device handover), I could only see an outsider gaining access to the system due to po…

Many startups and hip companies don't do VPNs anymore - unfortunately they also dont do Zero Trust (which would require machine certs for everything and be enforced) - so stuff is often available over Internet with password auth + maybe MFA. Attacker who gets hold of cookie or bearer token wins. And the best part, support personnel often doesnt have MFA, because its outsourced to countries where smart phones with Aut…

I don't see any issue with auth without VPN if TLS is terminated by owner

Re: Who’s behind Wednesday’s epic Twitter hack?

#88

Post by yjftsjthsd-h »

untog wrote: post #78
paulpauper wrote: post #68

Earlier quoted context omitted.

>> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consu…

> Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating? Maybe? I mean I certainly don't dismiss the idea out of hand. The one strong counter-argument I can think of is that very few things would actually embarrass Musk at this point.

Yeah, Musk specifically doesn't feel likely to care, perhaps if we assume someone else, who is less, shall we say, favorable to controversy?

Re: Who’s behind Wednesday’s epic Twitter hack?

#89

Post by WrtCdEvrydy »

paulpauper wrote: post #49
Avicebron wrote: post #41

Earlier quoted context omitted.

I think this is a good solution, but maybe not viable. Going past Crypto this could apply to so many issues needed to be reviewed on YouTube. But at that scale, the human cost is something YouTube refuses to pay.

it would be a stopgap measure until the algos are refined to filter out the videos without the need for human intervention. YouTube is being sued by Brad Garlinghouse for not taking action fast enough. My guess is my $10/hour solution is cheaper than $1000/hour lawyers.

Those lawyers already spent the money writing a ToS that says they're not liable for shit.

Re: Who’s behind Wednesday’s epic Twitter hack?

#90

Post by WrtCdEvrydy »

danso wrote: post #77
paulpauper wrote: post #56

Earlier quoted context omitted.

it is possible trump account had a special measure in place to override the email reset to make it hack-proof.

What about Reps. Nancy Pelosi or AOC, both of whom are extremely visible and active politicians, and who draw similar kinds of ire as Obama/Biden?

They're active in the Politics game...
Post reply on HN