An update on our security incident

#1

Post by psanford » Sat, Jul 18, 2020, 3:54 AM UTC

An update on our security incident
blog.twitter.com

Re: An update on our security incident

#2

Post by minimaxir » Sat, Jul 18, 2020, 3:58 AM UTC

This is one hell of a Friday night news dump.

Re: An update on our security incident

#3

Post by txcwpalpha » Sat, Jul 18, 2020, 4:00 AM UTC

>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool.

Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts?

edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be of note than just DMs. I wonder what risks there are to knowing, for example, the past IP addresses and geolocations that VIP politicians access Twitter from? Hopefully they're behind a government VPN.

0: https://help.twitter.com/en/managing-your-account/accessing-...

Re: An update on our security incident

#4

Post by sidcool » Sat, Jul 18, 2020, 4:03 AM UTC

I wish they mentioned what kind of social engineering attack it was. It could be a case study for any such incidents in the future.

P.S. I feel bad for the employees who were manipulated to give away the info.

Re: An update on our security incident

#5

Post by [deleted] » Sat, Jul 18, 2020, 4:08 AM UTC

[deleted]

Re: An update on our security incident

#6

Post by SV_BubbleTime » Sat, Jul 18, 2020, 4:10 AM UTC

So the photos going around showing they have detrending tools might be real?

Is it ethically acceptable that they “curate” what is trending? (Edit: I was actually asking, but apparently got my answer)

Edit: I didn’t believe it when I saw people claiming those pictures were being deleted when posted by to twitter, but verge confirms they’re real. Trends blacklist and search blacklist. Didn’t Jack testify to Congress they do not manipulate trends? https://www.theverge.com/2020/7/15/21326656/twitter-hack-exp...

Re: An update on our security incident

#7

Post by s9w » Sat, Jul 18, 2020, 4:12 AM UTC

SV_BubbleTime wrote: post #6

So the photos going around showing they have detrending tools might be real? Is it ethically acceptable that they “curate” what is trending? (Edit: I was actually asking, but apparently got my answer) Edit: I didn’t believe it when I saw people claiming those pictures were being deleted when posted by to twitter, but verge confirms they’re real. Trends blacklist and search blacklist. Didn’t Jack testify to Congress t…

It's the same as the HN frontpage really

Re: An update on our security incident

#8

Post by SV_BubbleTime » Sat, Jul 18, 2020, 4:13 AM UTC

txcwpalpha wrote: post #3

>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts? edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be o…

From what I saw most of the “famous” accounts are surely run by PR teams. I doubt Obama has touched the Obama account let alone DM’ed Jesse Jackson some Trump memes.

But I guess it’s entirely possible that people put sensitive things in DMs and inexplicably just trusted Twitter with that info.

Re: An update on our security incident

#9

Post by koluna » Sat, Jul 18, 2020, 4:14 AM UTC

> did the attackers see any of my private information? For the vast majority of people, we believe the answer is, no.

This is such a weasel-y answer. “Yes, most of Earth’s population was not affected by this breach” - sure, but those that were affected, how would you be certain that they didn’t have their private information, such as DMs, pulled?

Re: An update on our security incident

#10

Post by txcwpalpha » Sat, Jul 18, 2020, 4:15 AM UTC

SV_BubbleTime wrote: post #8

txcwpalpha wrote: post #3

>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts? edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be o…

From what I saw most of the “famous” accounts are surely run by PR teams. I doubt Obama has touched the Obama account let alone DM’ed Jesse Jackson some Trump memes. But I guess it’s entirely possible that people put sensitive things in DMs and inexplicably just trusted Twitter with that info.

I think it likely varies on the person we're talking about. Is Obama personally tweeting and sending private memes in his DMs? Doubtful. Kanye or Elon Musk? I'd guess yes, actually.