Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

Post reply on HN
Print view View original

501–510 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#501

Post by bonestamp2 »

hvidgaard wrote: post #368
xyst wrote: post #200

Earlier quoted context omitted.

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

The rhetoric of this statement is far more of an "anti-pattern" than VPN will ever be. If VPN is your only line of defense, then it's not secure at all - not because of VPN, but because of poor security practices in general. VPN and IP restrictions in general is a very good tool to limit the attack surface. That does not mean that Karen from accounting should be able to log into the production environment servers.

Exactly. We have application level authentication on top of various network level security policies. Karen from accounting can't even see servers that she doesn't need, and anything she does need has additional authentication requirements. Even if someone mistakenly gave her access to something at one of these layers, she would need that same mistake at multiple layers to actually get in.

Re: Who’s behind Wednesday’s epic Twitter hack?

#502

Post by heresie-dabord »

50ckpuppet wrote: post #479
amatecha wrote: post #79

Earlier quoted context omitted.

It's almost as if web services that let people post whatever they want at any time, vulnerable to whatever security flaws may be present, shouldn't be used as a reliable source for up-to-the-minute information about literally anything important at all.

bingo, except america is a nation of jittery anxious monkeys pumped full of unregulated oxycontin and anti-depressants.

This is unfair. You are talking about a nation of 330 million people.

But it is fair to say that there is no sane channel of information. The channels of public discourse in the US, once controlled by a few "loyal, patriotic" corporate owners fed by advertising revenue, are now channels controlled by unprincipled corporatism that supports a two-party system of untalented puppets.

And the un-talent pool is bigger than ever.

Re: Who’s behind Wednesday’s epic Twitter hack?

#503

Post by ransom1538 »

galacticaactual wrote: post #329
ransom1538 wrote: post #278

Twitter: function adminPanelShow() { if ( !isInOurVPN() ) throw logSecurityBreach(); if ( !isLoggedIn() ) throw logSecurityBreach(); slackSecurityChannel("AdminPanel Access: " + userName); ... }

Do you know how account takeovers work?

You work in security. Sad.

Re: Who’s behind Wednesday’s epic Twitter hack?

#504

Post by TheKarateKid »

mansion7 wrote: post #141
djmetzle wrote: post #94

Earlier quoted context omitted.

This. We've entered a world where the lowest common denominator of information is being used as primary source for current events. That's asinine.

That's partially because the sources formally seen as primary, at least in the US, have started to be viewed as biased and unreliable. This is largely through their own actions. Examples are legion, but a recent one is debacle at NYT over an op-ed. The news-consuming public was able to view the shenanigans of NYT reporters and staffers, which would formerly been done being the scenes. Many eyes were opened, and I'm c…

It's also because these "credible" mainstream media sources started reporting non-credible information as factual. Much of this inaccurate information originates from Twitter.

If 200 people on Twitter are angry at politician X over something trivial, we are served a news headline of Person X accused of Y - Public calls for resignation.

An anonymous person on social media recently made a claim of sexual assault against Justin Bieber with no evidence whatsoever, and the media reports it as Justin Bieber accused of sexual assault. He was fortunate to immediately whip out numerous receipts countering the claims, but what if he couldn't? We would still be reading headlines about this baseless accusation.

Re: Who’s behind Wednesday’s epic Twitter hack?

#505

Post by ubercow13 »

viklove wrote: post #496
magnio wrote: post #477

Earlier quoted context omitted.

250 million non-US users to 4.3 billion Internet users (excluding the US) is about 5.8%. Compared that to 23% in the US. Twitter is very US-centric.

If Twitter is 20% American users, how can that be considered "US-centric?" The vast majority of Twitter's users are not in the US...

Because the conversation was about Americans taking Twitter too seriously, not Twitter's discourse being dominated by Americans. The relevant metric seems to be the percentage of each population using twitter.

Re: Who’s behind Wednesday’s epic Twitter hack?

#506

Post by crispyambulance »

A4ET8a8uTh0 wrote: post #484
crispyambulance wrote: post #471

Earlier quoted context omitted.

> This twitter hack could have literally destroyed economies, started a war [...etc.] Woah, slow your roll man, it takes a lot to start a war. And temporary glitches in the market are just that-- temporary glitches. If someone loses their shirt over that they deserve it. It's not hackers which are the true danger, "legit" people abusing media (whatever it may be) are the threat, a good example would be the Stable Gen…

I don't want to be glib about this, but I will say that it takes a lot to stop a war once it starts, but starting it.. humans have not been known to be most rational actors[1]. 1. https://www.history.com/news/6-wars-fought-for-ridiculous-re...

I expect those are all "last straw" incidents. If it were not for one another would have ignited the war instead.

We are very far from a stray remark triggering a war unless either/both sides are already heavily primed and itching for one in the first place.

Re: Who’s behind Wednesday’s epic Twitter hack?

#507

Post by crispyambulance »

6510 wrote: post #473
crispyambulance wrote: post #472

Earlier quoted context omitted.

> War seems very possible. No. While there may be a "last straw" event that precipitates the war, it take a lot of build up to lead to it. A salty remark on twitter that is rapidly taken-back?? I don't think so.

Just tell the truth, there is no way to rollback.

The platform may not allow a "rollback" but for the kinds of things we're considering there are multiple channels of communication.

Re: Who’s behind Wednesday’s epic Twitter hack?

#508

Post by crispyambulance »

lifeformed wrote: post #260
dmitryminkovsky wrote: post #197

Earlier quoted context omitted.

People keep saying it could have started a war. Excuse me for being naive but come on—really? This is total sensationalism. What party wouldn’t verify something on twitter through diplomatic channels before going to war? Equity destruction: sure. War: no way.

Here's how I think it could be done: Get Trump's account, and tweet something like, "I've ordered a NUCLEAR STRIKE on China! The missiles are already in the air. The DEEP STATE is trying to take me out. They will try to silence me and delete these tweets and use deep fakes to say this was a hoax! The storm is here, Q is real, it's time to take up arms and kill democrats." Then continue tweeting escalating things over…

  >Get Trump's account...
At this point he's said so many batshit crazy things, I think people are over it.

Tweets from Stable Genius are now just grist for a media-industrial complex of outrage.

Re: Who’s behind Wednesday’s epic Twitter hack?

#509

Post by woko »

belval wrote: post #290
the_duke wrote: post #126

Earlier quoted context omitted.

> Do you really think someone like elon musk will pay a bitcoin ransom A somewhat odd blog post by Jeff Bezos about blackmail from last year is quite interesting in this context. [1] [1] https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146...

They grossly overestimated their leverage in that story though. Anything illegal might've been actually good for black mail purposes, but dick pics? As if someone would actually look for that or even take a business decision based on that.

Dick pics are what lead a candidate for Paris Mayor election to resign this year. It is a powerful item against some people.

Re: Who’s behind Wednesday’s epic Twitter hack?

#510

Post by stopshills »

VectorLock wrote: post #353
stopshills wrote: post #159

Funny that Krebs refers to Lucky225 as a longtime friend of Adrian Lamo. I thought it was very well-known that Lucky225 made that story up as a cover to hide the fact that he gained control of Adrian Lamo’s @6 Twitter via a SIM swap hack himself, and also took control of Lamo’s Facebook in order to hijack ownership of the 2600 Magazine group on Facebook.

Is your assertion that Lucky and Adrian and no relationship and he had no right to assume stewardship of his online accounts after his demise?

Yes. I know Lucky and I knew Adrian. If Adrian wanted Lucky to assume control of his accounts I’ll eat a hat.
Post reply on HN