Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

Post reply on HN
Print view View original

451–460 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#451

Post by dna_polymerase »

xyst wrote: post #200
twodave wrote: post #176

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

> is considered an anti-pattern now in terms of security.

By whom? It's another layer of security, nobody claimed it should be the sole defense.

Re: Who’s behind Wednesday’s epic Twitter hack?

#452

Post by roadbeats »

creato wrote: post #446
roadbeats wrote: post #436

Social media was praised so much for its contribution to conflicts outside western world, like middle east and North Africa. In the beginning of Syrian civil war for example; Twitter was the place where propaganda was streamed and extremists from all over the world would leave homes to join other extremists behading heads somewhere. Now, we see the potential of social media to be a tool for coordinated attacks agains…

The less conspiratorial take on this is that social media simply exacerbates and foments conflict, period. Maybe some of these involved significant coordinated propaganda efforts, but I doubt they all did. The mistake the western world made was thinking that this social media generated conflict was a result of some coherent "positive" motivation, when perhaps it was simply blind social media outrage that coincided wi…

I don't get how you see conspiracy in my comment. Was I claiming that social media is an actor in conflicts?

Re: Who’s behind Wednesday’s epic Twitter hack?

#453

Post by dgellow »

peroporque wrote: post #433
glitchc wrote: post #285

Earlier quoted context omitted.

Oh please. The rest of the world doesn’t take Twitter as seriously as Americans do. And truth be told, Americans shouldn’t take it seriously either. The platform derives power from the audience. Stop giving it your power.

German journalists do. Sadly.

French journalists too.

It would be interesting to know what percentage of journalists/new people, are active on Twitter. I would expect them to be over represented given the amount of reports based or citing tweets, but I don’t know.

Re: Who’s behind Wednesday’s epic Twitter hack?

#454

Post by DonHopkins »

Juliate wrote: post #405
fredoliveira wrote: post #396

Earlier quoted context omitted.

Consider your biases. 80% of twitter users are outside the US [0], [1]. [0]: https://www.statista.com/statistics/274565/monthly-active-in... [1]: https://www.omnicoreagency.com/twitter-statistics/

Speaking of biases, English-speaking twitter is a powervul vector bringing US biases (whatever they are) through the world. I have to regularly stop and check that "ha, yes, that's a very USA-centric take on things and does not represent reality outside of it".

Just like Hollywood.

Re: Who’s behind Wednesday’s epic Twitter hack?

#455

Post by DonHopkins »

mirimir wrote: post #376
lifeformed wrote: post #260

Earlier quoted context omitted.

Here's how I think it could be done: Get Trump's account, and tweet something like, "I've ordered a NUCLEAR STRIKE on China! The missiles are already in the air. The DEEP STATE is trying to take me out. They will try to silence me and delete these tweets and use deep fakes to say this was a hoax! The storm is here, Q is real, it's time to take up arms and kill democrats." Then continue tweeting escalating things over…

That already happened, back in 1984. President Reagan was joking during a sound check, and said the following: > My fellow Americans, I'm pleased to tell you today that I've signed legislation that will outlaw Russia forever. We begin bombing in five minutes.

https://en.wikipedia.org/wiki/We_begin_bombing_in_five_minut...

>Reactions

>Soviet

>By August 14, the recording of Reagan's joke had become world news. On August 15, someone who the National Security Agency described to US Representative Michael D. Barnes as "a wayward operator in the Soviet Far Eastern command" sent a coded message from Vladivostok that said, in part, "We now embark on military action against the U.S. forces." Japanese and US intelligence decoded the message and raised the alert state in that part of the world; Soviet naval vessels in the North Pacific, on the other hand, contacted Vladivostok in confusion. The US never saw any evidence of Soviet attack preparations, and the alert status as promulgated by Vladivostok was canceled within 30 minutes.[3]

>Initially, on August 13, the deputy minister of Soviet foreign affairs (Valentin Kamenev) told reporters, "I have nothing to say."[5] By the next day, though, President Reagan's leaked comments were denounced by the Soviet government, Pravda, Izvestia, and TASS as "unprecedentedly hostile," as evidence of the United States' insincerity at trying to improve Soviet Union–United States relations, and as abuse of the office of the president. "Western diplomats" described the Soviet response as over-the-top, suggesting it was an effort to give themselves more collateral at the negotiating table with the US.[7] US officials were compelled to mollify the Soviet Union and assure the United States' Cold War adversary that "Reagan’s offhand remark did not reflect White House policies or U.S. military intentions."[8]

http://www.msnbc.com/transcripts/rachel-maddow-show/2016-12-...

https://www.theguardian.com/world/2014/aug/14/ronald-reagan-...

https://www.politico.com/story/2010/08/reagan-jokes-about-bo...

Audio and news coverage:

https://www.youtube.com/watch?v=CFCABnWlN8E

Bonzo Goes To Washington - B-B-B Bombing In 5 Minutes (Jerry Harrison, Bootsy Collins)

https://www.youtube.com/watch?v=0k4TNtUZnM4

https://en.wikipedia.org/wiki/Five_Minutes_(Bonzo_Goes_to_Wa...

Re: Who’s behind Wednesday’s epic Twitter hack?

#456

Post by jacquesm »

christoph wrote: post #54

I don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to t…

100% right. Krebs is useful but an attention whore and an asshole to boot. He couldn't resist the temptation. All he should have done is share his findings with investigators but hey: clicks and the mortgage > ethics.

Re: Who’s behind Wednesday’s epic Twitter hack?

#457

Post by jacquesm »

spir wrote: post #152
jhardy54 wrote: post #112

Earlier quoted context omitted.

I don't think that's been reported anywhere, could you link to an archive or something?

I couldn't find any screenshots, archive.org link, or browser history for the tweet I saw. So, unfortunately I have no evidence that the scam tweets started before Wednesday. We'll see what Twitter finds.

Twitter is not incentivized to find anything and make it public if that makes matters look even worse than they already are.

Re: Who’s behind Wednesday’s epic Twitter hack?

#458

Post by otabdeveloper4 »

peterlk wrote: post #306
greggman3 wrote: post #289

Earlier quoted context omitted.

https://www.beyondcorp.com/ Yes, basically you should consider all networks untrusted including your internal network. You can still have a VPN but it shouldn't be the thing that protects the services inside your corp net because if it is then any breach means the intruder gets access to all your stuff.

This thread is a bit confusing to me. Have we moved past layered security for some reason? The purpose of a VPN was never supposed to be the authentication layer to internal services. It's just a layer of security that makes it more difficult to carry out some types of attacks; thus increasing security defenses of an organization. Assuming that it has been breached is good practice, but doesn't mean that there's no p…

Security in 2020 is basically "if you can't be 100% guaranteed secure, then don't bother securing anything".

Re: Who’s behind Wednesday’s epic Twitter hack?

#459

Post by williamtwild »

krenzo wrote: post #258
mc32 wrote: post #158

Earlier quoted context omitted.

Apparently the "fallout" was an exaggeration that Orson went along with because it gave him more publicity. From the Wikipedia: >"The supposed panic was so tiny as to be practically immeasurable on the night of the broadcast. ... Radio had siphoned off advertising revenue from print during the Depression, badly damaging the newspaper industry. So the papers seized the opportunity presented by Welles’ program to discr…

I loved to ask my grandmother about this because she recalled listening to the original broadcast. She said the station would take commercial breaks to interrupt the story, and they reminded listeners it was a fictitious broadcast when taking these breaks. She didn't believe that anyone could be fooled by it, at least not to the extent that was reported.

Oh how times don't really change.

Re: Who’s behind Wednesday’s epic Twitter hack?

#460

Post by [deleted] »

glitchc wrote: post #285
blisseyGo wrote: post #69

I think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies,…

Oh please. The rest of the world doesn’t take Twitter as seriously as Americans do. And truth be told, Americans shouldn’t take it seriously either. The platform derives power from the audience. Stop giving it your power.

[deleted]
Post reply on HN