Who’s behind Wednesday’s epic Twitter hack? • Hacker News Board

Re: Who’s behind Wednesday’s epic Twitter hack?

#391

Post by cbzoiav » Fri, Jul 17, 2020, 8:39 AM UTC

glitchc wrote: post #285

blisseyGo wrote: post #69

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

Oh please. The rest of the world doesn’t take Twitter as seriously as Americans do. And truth be told, Americans shouldn’t take it seriously either. The platform derives power from the audience. Stop giving it your power.

Financial markets do. Where acting faster than your competition is essential you don't have a lot of choice.

As for the blackmail and war starting you probably couldn't do much with public tweets (nobody is going to go to war over a tweet without fact checking it) but access to private messages is an entirely different story.

Re: Who’s behind Wednesday’s epic Twitter hack?

#392

Post by kochthesecond » Fri, Jul 17, 2020, 8:40 AM UTC

xyst wrote: post #200

twodave wrote: post #176

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

VPN gives a little extra layer against vulnerabilities in any packages your internal services depend on.

Re: Who’s behind Wednesday’s epic Twitter hack?

#393

Post by blauditore » Fri, Jul 17, 2020, 8:40 AM UTC

twodave wrote: post #176

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

Using VPN as a layer of security is basically like 2FA, where the second factor are credentials to enter the VPN. Wouldn't it be easier to just have any other additional factor, like a physical security key, or some (additional) authenticator mobile app?

Re: Who’s behind Wednesday’s epic Twitter hack?

#394

Post by midasz » Fri, Jul 17, 2020, 8:40 AM UTC

raxxorrax wrote: post #336

kleiba wrote: post #199

Earlier quoted context omitted.

Donald Trump?

He is one of the more peaceful presidents. This is ridiculous, there is ample room for criticism against Trump. This wouldn't fit at all. I guess you can blame him on Turkeys reaction in Syria, his staunch anti-Iranian policies that made talks more difficult. But the criticism of him starting random wars comes from an emotional corner beyond reality in my opinion.

He's just seen (at least by the ROTW) as very unstable and prone to lashing out. He might not order a war but his inability to govern with rationality and diplomacy does give credence to the side effect of relations worsening to the point of armed conflict.

Re: Who’s behind Wednesday’s epic Twitter hack?

#395

Post by cbzoiav » Fri, Jul 17, 2020, 8:41 AM UTC

kevingadd wrote: post #382

ycombobreaker wrote: post #354

Earlier quoted context omitted.

That market value was recovered in 5 minutes. It sucks for anyone with stop orders, or anyone who got a margin call; but to say it could start wars is really not giving any credit to the humans in the loop.

Given that Donald Trump basically does policy-making in the open on Twitter these days and foreign countries now treat his account that way, there's an argument to be made that a false tweet on his account could at least push us in the direction of a war. Thankfully, his account is under special 'lock and key' protection, so a regular CS rep can't hijack it.

Additional protection should probably be automatically applied to any account with more than N followers!

Re: Who’s behind Wednesday’s epic Twitter hack?

#396

Post by fredoliveira » Fri, Jul 17, 2020, 8:42 AM UTC

cjohansson wrote: post #383

glitchc wrote: post #285

Earlier quoted context omitted.

Oh please. The rest of the world doesn’t take Twitter as seriously as Americans do. And truth be told, Americans shouldn’t take it seriously either. The platform derives power from the audience. Stop giving it your power.

This is true I think. Twitter is mostly a US thing

Consider your biases. 80% of twitter users are outside the US [0], [1].

[0]: https://www.statista.com/statistics/274565/monthly-active-in... [1]: https://www.omnicoreagency.com/twitter-statistics/

Re: Who’s behind Wednesday’s epic Twitter hack?

#397

Post by cbzoiav » Fri, Jul 17, 2020, 8:43 AM UTC

dmitryminkovsky wrote: post #234

blisseyGo wrote: post #229

Earlier quoted context omitted.

This hack simply proved that a lot bigger things are possible. They could have (maybe they did) read private messages which could simply be used for blackmail. A top defense official getting blackmailed is pretty easy step to escalation to broken diplomacy.

Blackmail yes, totally possible. I’m specifically addressing war though.

A top defence official or the president private messaging someone could contain information able to break diplomatic relations. Obtaining information required to blackmail one could trigger a minor incident which escalates.

Its highly unlikely but far from impossible.

Re: Who’s behind Wednesday’s epic Twitter hack?

#398

Post by fredoliveira » Fri, Jul 17, 2020, 8:44 AM UTC

Cogito wrote: post #343

psadri wrote: post #316

Earlier quoted context omitted.

Important accounts should require 2fa for posting anything.

many of the affected accounts had 2fa.

GP was saying "to post anything", not only to authenticate.

Re: Who’s behind Wednesday’s epic Twitter hack?

#399

Post by [deleted] » Fri, Jul 17, 2020, 8:46 AM UTC

ZachPruckowski wrote: post #161

brown9-2 wrote: post #113

Earlier quoted context omitted.

Yes it was dangerous, but nothing is “erased” if that market valuation is restored a few minutes later

In the aggregate sense, it eventually netted out. But a lot of people who sold when it looked like prices were collapsing sure got a pretty decent chunk of their bank accounts "erased".

[deleted]

Re: Who’s behind Wednesday’s epic Twitter hack?

#400

Post by donkeyd » Fri, Jul 17, 2020, 8:49 AM UTC

flatiron wrote: post #117

paulpauper wrote: post #68

Earlier quoted context omitted.

>> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consu…

My guess was frantic copy pasta. Since the reset password emails went to both him and the OG twitter user. Plus wouldn’t you need an API key per user and set that all up? I think that takes more time than spamming a tweet.

You don't need API's if you just use the web interface. Headless chrome would be a seriously easy way to automate this without having to mess with API keys.