Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k people at Twitter had ability to aid hack of accounts

reuters.com

Post reply on HN
Print view View original

201–210 of 238 posts

Re: More than 1k people at Twitter had ability to aid hack of accounts

#201

Post by SaltyLemonZest »

lopmotr wrote: post #130
SaltyLemonZest wrote: post #80

Earlier quoted context omitted.

The question isn't how you and I can individually avoid being spear phished, but what policies can be implemented across an organization to prevent it. Even the most trusted security teams aren't going to be allowed to summarily fire everyone who fails the test. I also think this is a much stricter standard than you're recognizing. In my company's last spearphishing test, they sent out a link purporting to be a compa…

Just wondering if employees failed the test just by clicking on the link or if they had to actually enter some passwords or confidential information on the fake survey site. I wouldn't think clicking a link then looking at the address bar and seeing the domain name is wrong, then closing the page would be a problem, would it?

We got judged on both. Most security teams in my experience feel that even clicking on the link is a big risk, although I've never read a more detailed explanation of why than "oh there might be a 0-day".

Re: More than 1k people at Twitter had ability to aid hack of accounts

#202

Post by alpb »

Jaruzel wrote: post #136
alpb wrote: post #93

Worth mentioning only 5,000 people work at Twitter.

There are ~330 million active twitter users, which means 330,000 users per employee with access to admin accounts. That ratio is massively high compared to a large corporate (i.e, a global bank). In a typical global bank lets says there are 100,000 employees, with about 25-50 IT people with the rights to admin accounts (from first line support to third line engineers) that's only 2,000-4,000 users per IT admin person…

I am not sure why this bank example keeps coming up. Almost no twitter user tries to contact support like they contact their teller for their bank. It’s really bad that 20% of the company had access to user data. No wonder it was abused in the past. https://www.buzzfeednews.com/article/alexkantrowitz/how-saud...

Re: More than 1k people at Twitter had ability to aid hack of accounts

#203

Post by tuxcanfly »

baaym wrote: post #149
throw737 wrote: post #141

Earlier quoted context omitted.

PGP solved this issue 30 years ago. I can not believe we have this discussion in 2020

I don't tweet much, but when I do I'd love to be able to sign them like I sign my git commits.

We did exactly this for a side project last week:

https://github.com/shabda/tweet-signer

At it's core it's just a spec, so feel free to write your own tools! Suggestions for improving the spec welcome. Please use Github issues

Re: More than 1k people at Twitter had ability to aid hack of accounts

#204

Post by necovek »

koheripbal wrote: post #192
throwaway220720 wrote: post #79

For comparison, at Google in 2011, I was one of ~10 or so engineers that had the ability to view private Gmail or Gplus data (access that was heavily documented and audited). That being said, Google did have to go through it's own public humiliation [1] to put a system like that in place. https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

I almost wonder if government officials should be outright banned from using any private messaging platform that isn't hosted by the government itself. There is just too much power in information.

I believe to an extent they are: Hilary Clinton's hacked email was not the govt provided one, and most of the flack she received was for using personal email for gov stuff at all.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#205

Post by vangelis »

SaltyLemonZest wrote: post #80
miles wrote: post #33

Earlier quoted context omitted.

It's very easy to avoid being spear phished: do not trust any unsolicited message over any medium. Email/text/phone message/popup window purporting to be from your registrar with an urgent call to action? Ignore said call and contact them directly via known good number, email address, URL, etc. EDIT: Voice mimicry scam? Verify via known channel before taking action.

The question isn't how you and I can individually avoid being spear phished, but what policies can be implemented across an organization to prevent it. Even the most trusted security teams aren't going to be allowed to summarily fire everyone who fails the test. I also think this is a much stricter standard than you're recognizing. In my company's last spearphishing test, they sent out a link purporting to be a compa…

Jeez, what's next, seeing how the NOC handles a (fake) hostage situation?

Re: More than 1k people at Twitter had ability to aid hack of accounts

#206

Post by wolco »

caskstrength wrote: post #107
wolco wrote: post #85

Earlier quoted context omitted.

Disable links in emails by default goes a long way.

How would this work? I get emails like "you have been added to gerrit review" and " Redmine issue was updated" several time a day and I need to open these links.

The links become text and you would copy and paste. That's how thunderbird does it.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#207

Post by throwaway220720 »

necovek wrote: post #190
throwaway220720 wrote: post #79

For comparison, at Google in 2011, I was one of ~10 or so engineers that had the ability to view private Gmail or Gplus data (access that was heavily documented and audited). That being said, Google did have to go through it's own public humiliation [1] to put a system like that in place. https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

Don't all engineers working on Gmail theoretically have the same access by conspiring with a code reviewer or two? It ultimately comes down to the person involved and I do not believe anyone can control the human factor.

They can easily build and view their own versions of the gmail stack, but they would not be able to generate auth tokens to decode the private data of accounts they did not have passwords for.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#208

Post by bryan_w »

amf12 wrote: post #193
akersten wrote: post #11

Kind of sensationalist. There's thousands of people that have the ability to drain your bank account right now. Your average call center employee wields immense power. The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools .

> There's thousands of people that have the ability to drain your bank account right now. That's false equivalence. If a bank employee drains my account without authorization, it won't be difficult to prove and get back. But once your data leaks, it's out there.

But a bank employee can leak data as well. Some would say more important data than some tweets

Re: More than 1k people at Twitter had ability to aid hack of accounts

#209

Post by [deleted] »

lopmotr wrote: post #130
SaltyLemonZest wrote: post #80

Earlier quoted context omitted.

The question isn't how you and I can individually avoid being spear phished, but what policies can be implemented across an organization to prevent it. Even the most trusted security teams aren't going to be allowed to summarily fire everyone who fails the test. I also think this is a much stricter standard than you're recognizing. In my company's last spearphishing test, they sent out a link purporting to be a compa…

Just wondering if employees failed the test just by clicking on the link or if they had to actually enter some passwords or confidential information on the fake survey site. I wouldn't think clicking a link then looking at the address bar and seeing the domain name is wrong, then closing the page would be a problem, would it?

[deleted]

Re: More than 1k people at Twitter had ability to aid hack of accounts

#210

Post by jameshart »

Jaruzel wrote: post #132
kanox wrote: post #113

Earlier quoted context omitted.

> If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. Not really, a blue checkmark is just a status symbol.

This is exactly the problem with the blue tick. It's basically meaningless other than as a budge of honour. It's also restricted to large companies and 'public' figures. What I'd like to see is, the Blue Tick being restored to be an actual mark of Verification, and be something that anyone can apply for with the appropriate identification documentation. Additionally, there should then be a toggle switch, where only V…

Do you really think blue check marks are ‘meaningless’? Are you thinking of them in the context of, among your peers who has blue checks and who doesn’t being somewhat arbitrary? Because for sure if you’re part of a professional community that is common - you’ll find academics and journalists and medical professionals and so on all have very random experiences with blue check marks, much like tech does.

But at the same time, in aggregate, blue check marks do provide some degree of legitimacy to accounts - yes, this account is that person you know from outside twitter.

But twitter don’t do a great job of explaining how they verified an account, or even who they verified it to be. As has recently gone viral, twitter gave @sistersofmercy a blue check mark, because they really are the catholic institute of that name - not the band (@tsomofficial doesn’t have a blue check mark ...)

I think there’s the basis of something interesting in ‘verified accounts’ - and for sure they’re flawed - but I don’t think ‘meaningless’ is correct.

Post reply on HN