Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k people at Twitter had ability to aid hack of accounts

reuters.com

Post reply on HN
Print view View original

221–230 of 238 posts

Re: More than 1k people at Twitter had ability to aid hack of accounts

#221

Post by Thorentis »

jameshart wrote: post #75
laughinghan wrote: post #37

accounts with more than 10,000 followers should at least need two people to change key settings For accounts that could start a war this might be necessary, but for celebrities with >10K followers this sounds expensive and unnecessary to me. To me, it seems like you could instead ensure the admin view of every account has a timestamped log of recent settings changes, including changes done by admins, with a link to t…

‘Two people’ misses the entire problem here. If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. That chain should be documented somewhere - there must be some record in the ‘verified account management’ system that says something to the effect of ‘after we gave this actual verified human this token, this email from this addr…

This is all very true, assuming that was the purpose of the blue check. But it isn't. It's a status symbol that people also see as adding legitimacy to the tweets of an account.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#222

Post by Thorrez »

jameshart wrote: post #180
Thorrez wrote: post #103

Earlier quoted context omitted.

> held pending verification that the blue check mark still applies to the person now in control of that account That sounds to me like it's simply having a 2nd person verify the email change is correct. So your suggestion and the article's suggestion ("should at least need two people to change key settings") seem to be very similar if not the same as each other.

Process can be automated depending on how the account needs to be verified. Might be that say for a brand account it is connected to a domain ownership/verification model, where 1) email address must be in a particular domain, and 2) email must be able to complete a challenge/response process that demonstrates they control the company website - eg some random value is sent to the email address and they have to make i…

I guess that's plausible. But on the other hand Twitter got plenty of red flags with this attack but still struggled to stop it. And is our goal detection or prevention?

Re: More than 1k people at Twitter had ability to aid hack of accounts

#223

Post by madeofpalk »

uallo wrote: post #167
madeofpalk wrote: post #166

Earlier quoted context omitted.

Was it actually suspended, or did they just need you to verify with phone number?

It says "Your account is suspended and is not permitted to send Tweets". Why would they need to verify a phone number? I did not give them one.

In an attempt to reduce sock puppet accounts often used to harass others, Twitter can very quickly "require" you enter a and verify a phone number when you make an account. Unsure what the criteria is.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#224

Post by slaymaker1907 »

akersten wrote: post #11

Kind of sensationalist. There's thousands of people that have the ability to drain your bank account right now. Your average call center employee wields immense power. The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools .

I worked at a bank as an engineer and while some people did have _read_ access on certain databases, anything PII or otherwise highly sensitive would require special approvals and such approval would only be granted in 1 hour intervals. Write access generally required submitting the specific update query for approvals and was highly discouraged.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#225

Post by AmericanChopper »

jameshart wrote: post #188
AmericanChopper wrote: post #172

Earlier quoted context omitted.

There is no such thing as “necessary use” and the GDPR does not specify that an organisation must restrict employee access to personal data to only those whose access is “strictly necessary” (the cookie law contains that phrase, but in a completely different context). The only thing the GDPR says that would apply in this circumstance is this: > processed in a manner that ensures appropriate security of the personal d…

GDPR Article 6 spends a lot of time defining ‘necessary’ use. It says that ‘processing data’ - which is defined very broadly and includes accessing it - is only legal if it is for a ‘necessary purpose’ - either necessary to accomplish contracted work for a customer, comply with the law, or some few other permitted categories. Combined with, as you say, that GDPR also states as a matter of principle data must be “proc…

Necessary in the context of article 6 refers exclusively to processing that can be performed without consent from the subject. For example:

> processing is necessary for compliance with a legal obligation to which the controller is subject

Re: More than 1k people at Twitter had ability to aid hack of accounts

#226

Post by suizi »

anonymfus wrote: post #164
C1sc0cat wrote: post #155

Earlier quoted context omitted.

It would also exclude venerable people which is the problem with the real name idea

We can imagine a system where twitter checks that person is a real unique human but does not use their personal data for anything else.

Like when they used mobile phone numbers given for security purposes for marketing?

Re: More than 1k people at Twitter had ability to aid hack of accounts

#227

Post by necovek »

throwaway220720 wrote: post #207
necovek wrote: post #190

Earlier quoted context omitted.

Don't all engineers working on Gmail theoretically have the same access by conspiring with a code reviewer or two? It ultimately comes down to the person involved and I do not believe anyone can control the human factor.

They can easily build and view their own versions of the gmail stack, but they would not be able to generate auth tokens to decode the private data of accounts they did not have passwords for.

I was more thinking of deploying trojan-code into the production service (as a trivial example, allow a special password to access any account): it can't be practical to vet every production service change through too many people.

You seem to suggest that you are using an encryption key based on the password or oauth token on login, which is great to hear, which stops the simpler forms of trojans like the example above. That makes it much more involved to achieve the same (and login from new computer reports make it harder too), especially undetected (because it has to happen over a short period) but not impossible (thinking of cases like just making a new API endpoint or perusing an existing one to store actual content in an often unlooked at log file/service).

Re: More than 1k people at Twitter had ability to aid hack of accounts

#228

Post by laughinghan »

bigiain wrote: post #104
laughinghan wrote: post #52

Earlier quoted context omitted.

Yeah, response time might be slower in the middle of the night, but a falsified tweet on a celebrity account in the middle of the night is also likely proportionally less damaging. Response time during lunch hour might be slower initially, but after responding to the first compromised account I don't think they'd be any slower. If an admin account is only supposed to be for use by a human employee, it should have a r…

> ... a falsified tweet on a celebrity account ... A Hollywood celebrity? A bay area techbro "celebrity"? Or a Bollywood celebrity? Or a British Royal family celebrity? Or a KPop celebrity? Or a Russian oligarch celebrity? The middle of who's night??? Twitter does exist on the other side of the Bay Bridge you know...

All of those sound like fairly harmless Twitter accounts to lose control of for a few minutes once in a decade?

Re: More than 1k people at Twitter had ability to aid hack of accounts

#229

Post by suizi »

atum47 wrote: post #148

well, I worked on a software house that makes software for industry automation. each user of the software has all their actions logged and time-stamped. if you edit something, give a big discount, granted permission, deleted something... it all goes into a different DB filled with just the logs. why doesn't Twitter have something like this? am I missing something?

If you're banning thousands of people, deleting thousands of tweets and updating thousands of people as routine (customer support), it might take time for someone to review what you're doing.

Re: More than 1k people at Twitter had ability to aid hack of accounts

#230

Post by suizi »

austincheney wrote: post #108

This should be a wake up call. Thank god the malicious messaging was only limited to a tiny Bitcoin scam. Imagine if they had pulled this off on the accounts of national leaders to stir hostilities or violence. What is the recourse for this kind of failure? I suspect there is none. Twitter is shielded from lawsuits for its content. If this is provably negligent behavior and resulted in actual physical harm it are we…

GDPR is "supposed" to hold companies responsible for breaches and bad access controls. This is a different beast than liability protection for content.
Post reply on HN