Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

Post reply on HN
Print view View original

431–440 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#431

Post by spoopyskelly »

ReganLaitila wrote: post #263
xyst wrote: post #200

Earlier quoted context omitted.

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

I would be curious as to who is citing that using a vpn is some "anti-pattern", to what? Not protecting your network accessible assets? If you have the means, certainly use a corporate/smb/personal vpn. It is one layer in a multitude of layers you should be using to protect your network. Its not as if once you achieve vpn access you have no other authz gates to internal applications. Its a "great filter" to help narr…

> I would be curious as to who is citing that using a vpn is some "anti-pattern", to what? Not protecting your network accessible assets?

You can safely ignore anyone that unironically uses "anti-pattern" or "dark-pattern".

Re: Who’s behind Wednesday’s epic Twitter hack?

#432

Post by [deleted] »

mattoxic wrote: post #311
glitchc wrote: post #285

Earlier quoted context omitted.

Oh please. The rest of the world doesn’t take Twitter as seriously as Americans do. And truth be told, Americans shouldn’t take it seriously either. The platform derives power from the audience. Stop giving it your power.

So true. it's a toilet. A few months back I told myself no more, I resigned my account and haven't missed it at all. massive time sink, and utterly pointless. It isn't a conversation, it's yelling at a brick wall, then yelling louder when you don't get an answer.

[deleted]

Re: Who’s behind Wednesday’s epic Twitter hack?

#433

Post by peroporque »

glitchc wrote: post #285
blisseyGo wrote: post #69

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

Oh please. The rest of the world doesn’t take Twitter as seriously as Americans do. And truth be told, Americans shouldn’t take it seriously either. The platform derives power from the audience. Stop giving it your power.

German journalists do. Sadly.

Re: Who’s behind Wednesday’s epic Twitter hack?

#434

Post by peroporque »

silasdavis wrote: post #418
dmitryminkovsky wrote: post #197

Earlier quoted context omitted.

People keep saying it could have started a war. Excuse me for being naive but come on—really? This is total sensationalism. What party wouldn’t verify something on twitter through diplomatic channels before going to war? Equity destruction: sure. War: no way.

It depends how close to war the belligerents are before such tweets. Could a Trump tweet (real or fake) cause a pivotal escalation in a series or escalations leading to war? I think probably yes.

No, that's not how international relations work. Really not.

May be different for internal politics. Since people are often irrational.

Re: Who’s behind Wednesday’s epic Twitter hack?

#435

Post by ceo_tim_crook »

blisseyGo wrote: post #226
brown9-2 wrote: post #113

Earlier quoted context omitted.

Yes it was dangerous, but nothing is “erased” if that market valuation is restored a few minutes later

That's not true. Many people have auto-sell / buy triggers set up when something drops below a value.

there have been flash crashes before one reason why there are circuit breakers

Re: Who’s behind Wednesday’s epic Twitter hack?

#436

Post by roadbeats »

Social media was praised so much for its contribution to conflicts outside western world, like middle east and North Africa. In the beginning of Syrian civil war for example; Twitter was the place where propaganda was streamed and extremists from all over the world would leave homes to join other extremists behading heads somewhere.

Now, we see the potential of social media to be a tool for coordinated attacks against the western world. Just imagine this attack during the protests last month in the same narrative that started civil wars in other parts of the world. When tens of people start shooting and killing eachother, nobody would discuss what triggered the chain of events.

This is a simple test that reveals how fragile is society in contrast to how much attention they pay to Twitter. The worst, the value we get from social media is also unclear. Low quality, unreliable bits of information turned millions to pigeons jumping from there to there and those who own the seeds can control the mass.

Re: Who’s behind Wednesday’s epic Twitter hack?

#437

Post by peroporque »

puranjay wrote: post #427
lostsock wrote: post #279

Earlier quoted context omitted.

Not to mention hijacking other accounts that would plausibly say things along the same lines as "proof" that the statement is real. Even after dozens of high profile accounts were hacked many were still commenting that they didn't think it was possible for it to be a twitter vulnerability, but rather individual accounts being compromised or a 3rd party. If you only tweeted plausible things about war and corroborated…

Considering that they got Obama's account as well, you could very well create a narrative and counter narrative using the POTUS and ex-POTUS accounts. For the sake of fiction, you could have Obama tweet that he is, indeed, taking over, and arresting Trump. Maybe not war, but it could exacerbate the lack of trust across political divides.

What could be dangerous about it is that CNNFOX et al would copy-paste the story without fact checking, inflate it, and make as much money from it as they can.

Re: Who’s behind Wednesday’s epic Twitter hack?

#438

Post by trabant00 »

judge2020 wrote: post #313
peterlk wrote: post #306

Earlier quoted context omitted.

This thread is a bit confusing to me. Have we moved past layered security for some reason? The purpose of a VPN was never supposed to be the authentication layer to internal services. It's just a layer of security that makes it more difficult to carry out some types of attacks; thus increasing security defenses of an organization. Assuming that it has been breached is good practice, but doesn't mean that there's no p…

The issue is that, for any company without thousands of employees (heck, probably even some of these are guilty), the VPN is often the only barrier to the entire network. The BeyondCorp model makes you explicitly specify "John can access support.corp.com but not admin.corp.com", while setting up these explicit checks is the exception for VPN-based access, not the norm (and sometimes it isn't even done right - eg. rel…

> The issue is that, for any company without thousands of employees (heck, probably even some of these are guilty), the VPN is often the only barrier to the entire network.

Sorry, but what? I've worked in multiple small companies where the we where less than 5 system administrators and inside the vpn we had encrypted traffic and ldap auth on everything. It's a few days job for a single person to set everything up this way with open source tools that are extremely well known and documented.

Re: Who’s behind Wednesday’s epic Twitter hack?

#439

Post by kovac »

paulpauper wrote: post #68
TechBro8615 wrote: post #23

This is the most important point: > Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. My understanding is the hackers used the admin panel to change the email addresses of…

>> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consu…

True. Considering the level of access the hackers have gained, a case can be made that the attackers themselves fabricated the content in these user accounts.

Re: Who’s behind Wednesday’s epic Twitter hack?

#440

Post by trabant00 »

peterlk wrote: post #306
greggman3 wrote: post #289

Earlier quoted context omitted.

https://www.beyondcorp.com/ Yes, basically you should consider all networks untrusted including your internal network. You can still have a VPN but it shouldn't be the thing that protects the services inside your corp net because if it is then any breach means the intruder gets access to all your stuff.

This thread is a bit confusing to me. Have we moved past layered security for some reason? The purpose of a VPN was never supposed to be the authentication layer to internal services. It's just a layer of security that makes it more difficult to carry out some types of attacks; thus increasing security defenses of an organization. Assuming that it has been breached is good practice, but doesn't mean that there's no p…

> Have we moved past layered security for some reason?

Yes, yes we (more accurately "they") did. I don't know which schmuck with a blog came up with this idea that VPN is a thing of the past and a lot of people followed suit.

I bet there are IT shops out there that rely solely on VPN and the schmuck worked there, but that's like seeing somebody not lock their door and concluding doors are bad model for security and we should get rid of them.

Post reply on HN