An update on our security incident
blog.twitter.com
An update on our security incident
1–10 of 245 posts
Re: An update on our security incident
#2No employee should have the power to subvert 130 high value accounts in a short time period.
Re: An update on our security incident
#3[deleted]
Re: An update on our security incident
#4[deleted]
Re: An update on our security incident
#5Source (with more details): https://blog.twitter.com/en_us/topics/company/2020/an-update...
> The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all of the employees that were initially targeted had permissions to use account management tools, but the attackers used their credentials to access our internal systems and gain information about our processes. This knowledge then enabled them to target additional employees who did have access to our account support tools. Using the credentials of employees with access to these tools, the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7.
Re: An update on our security incident
#6Source (with more details): https://blog.twitter.com/en_us/topics/company/2020/an-update... > The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all o…
Why are internal employee tools publically accessible? Minimum they should require VPN access, but really go further with Zero Trust.
Re: An update on our security incident
#7[deleted]
Re: An update on our security incident
#8It is inexcusable that Twitter is employing people who are susceptible to social engineering attacks like this. This is simple training and seriousness.
Re: An update on our security incident
#9It is inexcusable that Twitter is employing people who are susceptible to social engineering attacks like this. This is simple training and seriousness.
It just takes one mistake to be spearfished.
Re: An update on our security incident
#10Are account support tools available off premises? I know nothing about security for big companies like Twitter but it seems like tools that enable you to post from any verified user (outside of Trump, someone here once mentioned he had additional account controls) should only be accessible from secure offices regardless of individual credentials.