Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k people at Twitter had ability to aid hack of accounts

reuters.com

Post reply on HN
Print view View original

61–70 of 238 posts

Re: More than 1k people at Twitter had ability to aid hack of accounts

#61

Post by jbob2000 »

lowdose wrote: post #17
jbob2000 wrote: post #12

I now understand why the bank I work for creates the separation of duties; the person who builds the system has no access to it, and the person with access has no idea how it works. As a developer, it frustrates the shit of out me because I can’t deploy fixes quickly or easily diagnose issues. But yep, there are 3 people that have access to the production databases that hold account info and they aren’t developers, j…

> there are 3 people that have access to the production databases that hold account info and they aren’t developers, just managers with no clue what to do once they log in. Just for my curiosity is this your observation or is this a company assumption?

Hmm I think it’s just our group, we have a Production support team that holds the keys, and there’s only 3 of them that can access my app.

For example, if I want to change an environment variable, I can’t just log into the cloud console or run a cli command. God no. That would be too easy. I have to write a script for this team to run. This script is entered into an authorization app where a few parties “sign off”, at which point the prod support team can log in to the authorization app and click Deploy. This app then runs my deployment script against our app container to update the env variable.

Accessing and doing DB work follows a similar process.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#63

Post by MattGaiser »

dguido wrote: post #15
akersten wrote: post #11

Kind of sensationalist. There's thousands of people that have the ability to drain your bank account right now. Your average call center employee wields immense power. The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools .

It's not sensationalist when you realize it directly contradicts Twitter's prior statements from just last year about it: > Twitter, in a statement, said it is aware that "bad actors" will try to undermine its service and that the company "limits access to sensitive account information to a limited group of trained and vetted employees." https://www.npr.org/2019/11/06/777098293/2-former-twitter-em... 1,000 people, in…

Banks make the same promise that it is a "limited group of trained and vetted employees."

In an organization as large as Twitter or a bank, that still means thousands of people. You are seeing 1000 as large because you are forgetting the scale on which they operate.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#64

Post by manquer »

sloshnmosh wrote: post #47

Ha! Did you see in that article that the head of cyber security for AT&T added his two cents in shaming Twitter? AT&T was just in the news recently where employees were accepting bribes that allowed criminals to swap SIMs steal bitcoins from AT&T customers. Unbelievable.

Not just bitcoins, SIM swapping is how @jack twitter account got comprised as well.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#65

Post by shakna »

yuliyp wrote: post #55
laughinghan wrote: post #51

Earlier quoted context omitted.

I actually had a similar idea for fighting SIM swaps—we should be able to ask telecoms "hey, when's the last time this phone number was moved to another device/changed IMEI numbers?" and distrust the number if it's been changed less than 48 hours ago. I've looked but as far as I can tell, such an API does not exist, alas.

Something like Require-Recipient-Valid-Since from SMTP? That would be neat. Does SMS have the necessary protocol flexibility to allow that to be added?

The User Data Header of SMS [0] isn't very flexible, and quite constrained - both it and the message needs to fit inside a 140 byte payload.

There are a handful of bytes reserved for a future purpose, which could be used for something like this, but you're limiting how large the message can be, likely significantly.

[0] https://en.wikipedia.org/wiki/User_Data_Header

Re: More than 1k people at Twitter had ability to aid hack of accounts

#66

Post by manquer »

laughinghan wrote: post #51
ceejayoz wrote: post #40

Earlier quoted context omitted.

I once had to restore my Authy 2FAs from a backup, and didn't have access to the original device. Restoring it took 24 hours, during which I got bombarded with text messages and emails warning me that someone was restoring my backup, and that if it wasn't me, I should immediately click or reply to prevent it from happening. Seems like that might help - a 24 hour waiting period on any significant account changes for v…

I actually had a similar idea for fighting SIM swaps—we should be able to ask telecoms "hey, when's the last time this phone number was moved to another device/changed IMEI numbers?" and distrust the number if it's been changed less than 48 hours ago. I've looked but as far as I can tell, such an API does not exist, alas.

The problem is with POTS, you dont have that kind of capability in the protocol, even Caller ID cannot be verified. Most network will trust whatever is being sent. It is like SMTP it was designed in era where security was simply not there.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#67

Post by bawolff »

TwoBit wrote: post #36
hombre_fatal wrote: post #8

Earlier quoted context omitted.

Can we do without the condescending "Uh" and "Um" on HN? An audit trail would tell you who was social-engineered, but it wouldn't have prevented the attack in the same way Wikipedia's revision history doesn't keep you from vandalizing it.

It wouldn't even necessarily tell you who was social-engineered. My understanding of this case was that CS tool credentials were posted globally in their Slack.

In fairness, i don't think its a real audit trail if the tool doesn't have an effective per-user password.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#68

Post by onetimemanytime »

sloshnmosh wrote: post #47

Ha! Did you see in that article that the head of cyber security for AT&T added his two cents in shaming Twitter? AT&T was just in the news recently where employees were accepting bribes that allowed criminals to swap SIMs steal bitcoins from AT&T customers. Unbelievable.

Thousands of employees, each with their own financial problems and dreams...you're bound to find a taker. Money moves mountains

Re: More than 1k people at Twitter had ability to aid hack of accounts

#69

Post by hn_throwaway_99 »

onetimemanytime wrote: post #68
sloshnmosh wrote: post #47

Ha! Did you see in that article that the head of cyber security for AT&T added his two cents in shaming Twitter? AT&T was just in the news recently where employees were accepting bribes that allowed criminals to swap SIMs steal bitcoins from AT&T customers. Unbelievable.

Thousands of employees, each with their own financial problems and dreams...you're bound to find a taker. Money moves mountains

Which is why once your company is big enough, you should need 2 employees who are unfamiliar to each other to sign off on high value operations.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#70

Post by jameshart »

AmericanChopper wrote: post #56
laughinghan wrote: post #37

accounts with more than 10,000 followers should at least need two people to change key settings For accounts that could start a war this might be necessary, but for celebrities with >10K followers this sounds expensive and unnecessary to me. To me, it seems like you could instead ensure the admin view of every account has a timestamped log of recent settings changes, including changes done by admins, with a link to t…

There are already organisations that have to control employee access to ‘customer’ data very tightly. Law enforcement. Law enforcement agencies have access to large databases full of people along with a huge amount of very sensitive data (both confidential personal data, and stuff like information about ongoing and typically covert investigations). I’ve worked with several of these types of organisations and the ones…

> There are already organisations that have to control employee access to ‘customer’ data very tightly.

How about... anybody who has customers in the EU?

Post reply on HN