Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k people at Twitter had ability to aid hack of accounts

reuters.com

Post reply on HN
Print view View original

81–90 of 238 posts

Re: More than 1k people at Twitter had ability to aid hack of accounts

#81

Post by AmericanChopper »

jameshart wrote: post #70
AmericanChopper wrote: post #56

Earlier quoted context omitted.

There are already organisations that have to control employee access to ‘customer’ data very tightly. Law enforcement. Law enforcement agencies have access to large databases full of people along with a huge amount of very sensitive data (both confidential personal data, and stuff like information about ongoing and typically covert investigations). I’ve worked with several of these types of organisations and the ones…

> There are already organisations that have to control employee access to ‘customer’ data very tightly. How about... anybody who has customers in the EU?

The EU doesn’t provide any standards at all relating to information security. It only specifies that security controls must be ‘appropriate’, but no definition or precedent for what that means. Customer service and community moderation staff accessing customer data, or having administrative control over their accounts would certainly not be a violation of EU law.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#82

Post by wolco »

manquer wrote: post #66
laughinghan wrote: post #51

Earlier quoted context omitted.

I actually had a similar idea for fighting SIM swaps—we should be able to ask telecoms "hey, when's the last time this phone number was moved to another device/changed IMEI numbers?" and distrust the number if it's been changed less than 48 hours ago. I've looked but as far as I can tell, such an API does not exist, alas.

The problem is with POTS, you dont have that kind of capability in the protocol, even Caller ID cannot be verified. Most network will trust whatever is being sent. It is like SMTP it was designed in era where security was simply not there.

pgp solved many use-cases.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#83

Post by ladberg »

jbob2000 wrote: post #61
lowdose wrote: post #17

Earlier quoted context omitted.

> there are 3 people that have access to the production databases that hold account info and they aren’t developers, just managers with no clue what to do once they log in. Just for my curiosity is this your observation or is this a company assumption?

Hmm I think it’s just our group, we have a Production support team that holds the keys, and there’s only 3 of them that can access my app. For example, if I want to change an environment variable, I can’t just log into the cloud console or run a cli command. God no. That would be too easy. I have to write a script for this team to run. This script is entered into an authorization app where a few parties “sign off”, a…

Reading this makes me happy! Always good to see people taking security seriously.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#84

Post by spockz »

laughinghan wrote: post #51
ceejayoz wrote: post #40

Earlier quoted context omitted.

I once had to restore my Authy 2FAs from a backup, and didn't have access to the original device. Restoring it took 24 hours, during which I got bombarded with text messages and emails warning me that someone was restoring my backup, and that if it wasn't me, I should immediately click or reply to prevent it from happening. Seems like that might help - a 24 hour waiting period on any significant account changes for v…

I actually had a similar idea for fighting SIM swaps—we should be able to ask telecoms "hey, when's the last time this phone number was moved to another device/changed IMEI numbers?" and distrust the number if it's been changed less than 48 hours ago. I've looked but as far as I can tell, such an API does not exist, alas.

We (NL) do have such a thing where banks get notified of sim swaps or number transfers. They put the number on hold for 2FA pending authorization of that change with a different (Maybe second) means.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#85

Post by wolco »

SaltyLemonZest wrote: post #80
miles wrote: post #33

Earlier quoted context omitted.

It's very easy to avoid being spear phished: do not trust any unsolicited message over any medium. Email/text/phone message/popup window purporting to be from your registrar with an urgent call to action? Ignore said call and contact them directly via known good number, email address, URL, etc. EDIT: Voice mimicry scam? Verify via known channel before taking action.

The question isn't how you and I can individually avoid being spear phished, but what policies can be implemented across an organization to prevent it. Even the most trusted security teams aren't going to be allowed to summarily fire everyone who fails the test. I also think this is a much stricter standard than you're recognizing. In my company's last spearphishing test, they sent out a link purporting to be a compa…

Disable links in emails by default goes a long way.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#90

Post by londons_explore »

laughinghan wrote: post #49
foota wrote: post #39

Earlier quoted context omitted.

I think the long tail was in undoing the actions made by the attackers. Resetting passwords, emails, etc.,.

No, according to The Block, @elonmusk repeatedly tweeted the scam at 4:17pm, 5:19pm, and 5:32pm, a span of 90 minutes, and the final scam tweet was at 6:05pm from @KimKardashian. An hour after @elonmusk's first scam tweet, 7 celebrity or corporate accounts had tweeted the scam, all with the same Bitcoin address. With the two-click system I described, how many compromised admin accounts would you expect the security t…

If your database system doesn't have a complete audit log of all fields (most databases have this capability, but more often than not it's disabled), it's possible that the mere act of reverting account ownership might remove data needed for tracing down what happened.

Sure, it's a sucky position to be in, but I can see why they might have been hesitant to dive right in and start trying to undo damage before understanding what had happened.

Post reply on HN