Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

Post reply on HN
Print view View original

211–220 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#211

Post by tomlagier »

dcow wrote: post #185
OisinMoran wrote: post #180

Earlier quoted context omitted.

The actions you take in this world are real yes, but the scale at which the internet enables retribution is unprecedented. If you punch someone in the street maybe three people will beat you up. If you punch someone online, tens of thousands of people might pile on and start kicking.

There's a certain symmetry to that, though. You fuck up on the world stage then you suffer a world of consequences. Anyway, I would sincerely hope people are more mature than to start harassing a dude that some security has-been decided to name as the perpetrator. You're not allow to harass and threaten someone just because they're suspected of being guilty of some crime.

Uhh.. have you ever been on Twitter? That's like half the activity there, people dog piling on others based on circumstantial, if any, evidence of perceived slights or wrongdoing.

Sure, people _shouldn't_, but they overwhelmingly _do_, which has real, tragic consequences. People with platforms must take care or they cause tangible harm to others.

Re: Who’s behind Wednesday’s epic Twitter hack?

#212

Post by coronadisaster »

blisseyGo wrote: post #69

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

maybe you just need to trust Twitter (and others) less...

Re: Who’s behind Wednesday’s epic Twitter hack?

#213

Post by danans »

xyst wrote: post #200
twodave wrote: post #176

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security.

I could be wrong, but I think they mean that access to the internal site should have been behind VPN (whether at the IP network level or via an HTTP proxy) even when accessed over the internal network. That is, the internal network should not be trusted any more than the network at the cafe down the street.

Re: Who’s behind Wednesday’s epic Twitter hack?

#214

Post by monkeywork »

dcow wrote: post #192
kevincox wrote: post #174

Earlier quoted context omitted.

The problem is that the named person will also suffer if Krebs got it wrong. Furthermore it isn't uncommon these days for people to overreact and mob up against the person. We have a justice system to deal with this. We shouldn't have thousands of random people on the internet punishing them based on loose evidence.

I guess I just don't think we should plan society around the assumption that the internet will overreact and take justice into its own hands, which is not in fact justice. Why can't we hold people on the internet accountable for harassment?

because you put ppl at risk without any benefit. you could easily as said I believe I know who did this and I've turned that information over to the authorities.

what does the public or kerp gain by putting it out in public when you dont know.

yes he (kerp) can be held accountable (and should be hit immediately with a defamation lawsuit if hes wrong) but not everyone has the resources to do that.

look at reddit and boston bomber the person they accused killed himself..

Re: Who’s behind Wednesday’s epic Twitter hack?

#215

Post by coderintherye »

pixelface wrote: post #193
christoph wrote: post #54

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to t…

It's not one step away from doxxing at all -- in this case Lucky225 is not an unnamed source, that is actually his real legal name per his twitter [1] and the FCC database entry for his ham radio license (not linking that) [1] https://twitter.com/lucky225/status/1258503072323526657

Well, I think they meant doxxing Joe, but also seems to be doxxing Lucky225 as you noted.

Once you look at Lucky225's Ham then you get an address. Of course, what is somewhat interesting is their listed address actually is located at Colorado's Division of Central Services building, which very interestingly is a way to obtain a confidential mail forwarding address. It says it is only to be used by victims of stalking/violence/harassment but who knows how well that is enforced: https://www.colorado.gov/pacific/dcs/acp-faq

Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed.

Re: Who’s behind Wednesday’s epic Twitter hack?

#216

Post by monkeywork »

dcow wrote: post #187
dmm wrote: post #177

Earlier quoted context omitted.

Like a lot of terms doxing can mean different things. Sometimes it means holding people accountable and sometimes it means releasing the home address and workplace of a person misidentified as a wrongdoer by an internet mob. A recent example was the biker misidentified as a man who assaulted a child putting up posters. https://www.bbc.com/news/technology-52978880

And I would hold the people who acted on partial information accountable for their actions. Harassment is wrong regardless of whether you think someone is guilty of something or not. The internet needs to grow up.

since you think personal privacy is useless and your fine with personal information being out there can I get your real name, address and phone number plz?

Re: Who’s behind Wednesday’s epic Twitter hack?

#217

Post by monkeywork »

dcow wrote: post #185
OisinMoran wrote: post #180

Earlier quoted context omitted.

The actions you take in this world are real yes, but the scale at which the internet enables retribution is unprecedented. If you punch someone in the street maybe three people will beat you up. If you punch someone online, tens of thousands of people might pile on and start kicking.

There's a certain symmetry to that, though. You fuck up on the world stage then you suffer a world of consequences. Anyway, I would sincerely hope people are more mature than to start harassing a dude that some security has-been decided to name as the perpetrator. You're not allow to harass and threaten someone just because they're suspected of being guilty of some crime.

have you ever used the internet??

Re: Who’s behind Wednesday’s epic Twitter hack?

#218

Post by nuclearnice1 »

mc32 wrote: post #210
nuclearnice1 wrote: post #165

Earlier quoted context omitted.

Isn’t most crime journalism the same? Three examples from the front page of the NY post right now. I am having a hard time figuring out how to distinguish this and the OP doxxing. The organizationS fact-checking process? Solidness of the evidence? > Allegations were made against longtime radio broadcaster Larry Michael (retired Wednesday), director of pro personnel Alex Santos (fired last week), assistant director of…

One difference is that these people are being accused by civil authorities --not some "rando" who moonlights as cyberpolice. He's not acting in an official capacity and doesn't have the imprimatur of the state.

I didn’t look closely but the first example I think is a non-state accusation. But interesting line to attempt to draw.

I look at the media as a counter to the power of the state. So I worry about an arrangement where media can’t name people without state approval. But perhaps my view is archaic?

Re: Who’s behind Wednesday’s epic Twitter hack?

#219

Post by iMerNibor »

three_seagrass wrote: post #203
stri8ed wrote: post #71

Earlier quoted context omitted.

I think they could have done a lot better by having Elon tweet out a new product preorder page (limited edition Tesla merch?), which accepts payments in crypto. Really anything other than give me X so I can give you 2X, which has been done to death already. 100k is chump change, historically for this class of scam. Another idea is, hijack customer service request DM's from crypto exchanges, and lead customer to phish…

The traffic burst would be huge for the Tesla tweet. That type of scam introduces more complexity, such as requiring hosting for millions of visitors in an hour, which can leave a traceable trail.

Compromised aws or similar accounts shouldn't be that hard for someone to get hold of at that point though?

You could probably make the whole site fairly convincing with just static files & some js which would be super easy to scale up with just a free cloudflare account or something along those lines

Re: Who’s behind Wednesday’s epic Twitter hack?

#220

Post by kryogen1c »

dmitryminkovsky wrote: post #209
kryogen1c wrote: post #205

Earlier quoted context omitted.

War is perhaps an exaggeration, but if its wrong its wrong quantitatively, not qualitatively. In other words, lives unquestionably hung in the balance. I dont even have a twitter, facebook, instagram, or... anything i think. just you people : )

“Unquestionably” you’ve got to at least give an example. How did lives hang in the balance? I’m not saying the likelihood is 0, it’s best not to be irresponsible like this obviously, but come on, it’s not even 0.5.

> but come on

i will not. affected persons included biden, kanye, obama, musk, bezos, gates and others. this is an audience in the 100's of millions (if not over a billion, i didnt count). do you honestly think theres no possible tweet that directly leads to someone's death, and likely many deaths?

im not sure an outright war is > 50% possible, but i am sure it is > 0.0%

Post reply on HN