Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

191–200 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#191

Earlier quoted context omitted.

But is that really new? Other than scale and reach (quantitative difference), how is that any different qualitatively from the old grapevine/gossip network? "My dad's co-worker's, girlfriend's uncle works at ... and said..."

“My dad's co-worker's, girlfriend's uncle works at ... and said...” doesn’t reach the whole world instantaneously

It does now.

Re: Who’s behind Wednesday’s epic Twitter hack?

#192
post #167

Earlier quoted context omitted.

I never understood the whole doxing thing... the actions you take in this world are real. You can't take them back. You don't get to be anonymous just because you wish to be or because you frequent hacker sub-cults where doxing is some holy transgression. Bad op sec is bad op sec. Nothing more, nothing less. If Krebs got it wrong, well, he can suffer the consequences of that, too.

The problem is that the named person will also suffer if Krebs got it wrong. Furthermore it isn't uncommon these days for people to overreact and mob up against the person. We have a justice system to deal with this. We shouldn't have thousands of random people on the internet punishing them based on loose evidence.

I guess I just don't think we should plan society around the assumption that the internet will overreact and take justice into its own hands, which is not in fact justice. Why can't we hold people on the internet accountable for harassment?

Re: Who’s behind Wednesday’s epic Twitter hack?

#193

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to t…

It's not one step away from doxxing at all -- in this case Lucky225 is not an unnamed source, that is actually his real legal name per his twitter [1] and the FCC database entry for his ham radio license (not linking that)

[1] https://twitter.com/lucky225/status/1258503072323526657

Re: Who’s behind Wednesday’s epic Twitter hack?

#194

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to t…

It's doxxing. My question is why is that a bad thing in this case? Zero tolerance policies don't make any sense to me.

> In this case?

After the Boston marathon bombing, Redditors thought they found one of the responsible terrorist. He wasn't.

Re: Who’s behind Wednesday’s epic Twitter hack?

#196
post #192

Earlier quoted context omitted.

The problem is that the named person will also suffer if Krebs got it wrong. Furthermore it isn't uncommon these days for people to overreact and mob up against the person. We have a justice system to deal with this. We shouldn't have thousands of random people on the internet punishing them based on loose evidence.

I guess I just don't think we should plan society around the assumption that the internet will overreact and take justice into its own hands, which is not in fact justice. Why can't we hold people on the internet accountable for harassment?

That is an orthogonal concern. We should hold people accountable harassment. But I don't see the need to put someone in a position where they are likely to be harassed. The upsides of putting someones name out there seem tiny and the downsides are obvious, so why do it?

Re: Who’s behind Wednesday’s epic Twitter hack?

#197

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

People keep saying it could have started a war. Excuse me for being naive but come on—really? This is total sensationalism. What party wouldn’t verify something on twitter through diplomatic channels before going to war?

Equity destruction: sure. War: no way.

Re: Who’s behind Wednesday’s epic Twitter hack?

#198
post #187
post #177

Earlier quoted context omitted.

Like a lot of terms doxing can mean different things. Sometimes it means holding people accountable and sometimes it means releasing the home address and workplace of a person misidentified as a wrongdoer by an internet mob. A recent example was the biker misidentified as a man who assaulted a child putting up posters. https://www.bbc.com/news/technology-52978880

And I would hold the people who acted on partial information accountable for their actions. Harassment is wrong regardless of whether you think someone is guilty of something or not. The internet needs to grow up.

Out of curiosity.. “the people who acted on partial information” who you say you would hold accountable. Does that include the people who chose to publicly dox him based upon an incorrect identification?

Re: Who’s behind Wednesday’s epic Twitter hack?

#199

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

People keep saying it could have started a war. Excuse me for being naive but come on—really? This is total sensationalism. What party wouldn’t verify something on twitter through diplomatic channels before going to war? Equity destruction: sure. War: no way.

Donald Trump?

Re: Who’s behind Wednesday’s epic Twitter hack?

#200

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems.

This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

Post reply on HN