Tampa teen accused of being ‘mastermind’ behind Twitter hack • Hacker News Board

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#321

Post by MiroF » Fri, Jul 31, 2020, 9:14 PM UTC

sna1l wrote: post #301

From the Verge[1] article it seems like there was someone else providing access to the accounts? So was it social engineering or not? > Intriguingly, Sheppard and Fazeli may just be middlemen for the scam — “an unknown individual” with the handle “Kirk#5270” is believed to be the one who got access to Twitter’s internal systems. It’s not clear if the Tampa teen is Kirk#5270, though it sounds like that’s possible. The…

What I heard was that one of the hackers managed to get access to Twitter's internal Slack, and that hacker was the one posing as having a Twitter employee friend. Don't know if that's true though.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#322

Post by ja27 » Fri, Jul 31, 2020, 9:14 PM UTC

korethr wrote: post #17

Interesting to see that he's being charged in Florida, instead of federally. I mean yes, normally, when one commits a crime in a particular area, they're charged in that area. But my understanding is that once stuff crosses state lines, it becomes a federal issue, and this is part of why its usually the FBI that comes knocking.

Anything involving a computer connected to the internet (even firewalled or rarely connected) is considered to be a "protected computer" since it is involved in interstate commerce or communication and thus open to federal charges under 1030 (a).

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#323

Post by pcunite » Fri, Jul 31, 2020, 9:14 PM UTC

nonsapreiche1 wrote: post #121

montenegrohugo wrote: post #27

If this turns out to be true, then we can conclude two things: 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. 2. This also explains why the profit of the hack was 'only' ~$100k. Many speculated about how incredibly valuable such a hack could be and how much more a group could have profited from this hack. Using it for two hours of bitcoin scammi…

never underestimate the intelligence of a teenager!

Imagine what a russian could do.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#324

Post by paulpauper » Fri, Jul 31, 2020, 9:15 PM UTC

ggggtez wrote: post #278

Imagine a 17 year old robs a bank and steal 100k from the savings accounts of random people. Or a 17 year old steals a couple of cars from random people off the street... The crime is not breaking into Twitter. The crime is theft. Twitter didn't steal that money, this guy did. Let's not pretend the internet is a magical land without consequences.

technically he did not take the money but rather ppl gave it to him under a false pretense. It is close enough but one can imagine a jury being harder one someone who stole vs exploited his victim's greed and gullibility.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#325

Post by rodiger » Fri, Jul 31, 2020, 9:16 PM UTC

dhosek wrote: post #292

dumbfoundded wrote: post #284

Earlier quoted context omitted.

Bitcoin is anonymous until you tie it to something that requires a real identity. For most people, it's probably tied to an exchange that has their real identity, credit card info, and maybe bank account info. What they should've done is generate a new wallet with no previous transactions and just used that to buy things.

But wouldn't the purchase transactions be able to be connected to the perpetrators?

Dump it through some mixers and it becomes a lot harder to tell who is who.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#326

Post by rtx » Fri, Jul 31, 2020, 9:16 PM UTC

function_seven wrote: post #290

SpicyLemonZest wrote: post #262

Earlier quoted context omitted.

This isn't the New York Times. I don't think it's reasonable to expect the local news for a mid-sized American city to prioritize implementation of the EU's data rules.

Sure, but it's plenty of time to just remove tracking cookies altogether. Which would have been easier to implement than what they're doing now (geolocating visitors, serving custom messages depending on jurisdiction, etc.) I mean, if my privacy matters to them. I know the online news business is difficult to monetize. Only a handful of major news orgs can put paywalls up and charge subscribers directly. I get that.…

Your privacy matters, only if you pay. I don't click on content site links where I am not a customer.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#327

Post by SahAssar » Fri, Jul 31, 2020, 9:17 PM UTC

wmf wrote: post #318

SahAssar wrote: post #277

Earlier quoted context omitted.

I understand what you are saying, and I'm sorry you are in this situation. But I can also see that because you acted outside of the reach of the legal system then there is less chance of it being able to help you. Sorry if I'm being heartless here but I'd also argue that the funds were not stolen, they were given in a system that provides almost no legal recourse.

Cryptocurrency is not outside of the reach of the legal system. "the United States District Court for the Eastern District of Texas ... ordered Trendon Shavers to pay more than $40 million in disgorgement and prejudgment interest, and a civil penalty of $150,000 related to [Bitcoin scam] BCS&T." https://www.justice.gov/usao-sdny/pr/texas-man-sentenced-ope...

Right, when the person is identifiable and within that jurisdiction. I'm saying that if I pay X bitcoin to someone on the internet for a service I have less change of recourse within the law if I don't get that service (in this case a back payment of x*2). If it was a normal digital/creditcard/whatever transaction it'd be easier to reverse and deal with.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#328

Post by Nasrudith » Fri, Jul 31, 2020, 9:17 PM UTC

nightcracker wrote: post #120

pojntfx wrote: post #99

"Our European visitors are important to us. This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws." nice

Why do all these prompts use doublespeak so blatantly? It's actually insane. "Your privacy matters to us." -> Then why are you asking me to give it up? If my privacy mattered to you you wouldn't even ask to install tracking cookies and gather my data.

It is true though. It matters to them in the same way virginity matters to someone trying to seduce someone. It is an absolute binary status that maintaining gets in the way of what they want.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#329

Post by paulpauper » Fri, Jul 31, 2020, 9:18 PM UTC

wil421 wrote: post #165

ponker wrote: post #137

Earlier quoted context omitted.

What does the 17yo have to do with it? Would it be different for an 18yo?

I believe most states will charge a 17yo as and adult. Not sure what the feds would do.

i could see this possibly be challenged by courts , possibly up to the supreme court

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#330

Post by dane-pgp » Fri, Jul 31, 2020, 9:18 PM UTC

MattGaiser wrote: post #54

gruez wrote: post #46

Earlier quoted context omitted.

does hackerone cover social engineering exploits? I doubt it.

They should. You should get $200 if you can get an employee's password.

I'm wondering what the objection is against this. There might be a conflict of interest in allowing an employee to share a bounty with a friend by giving the friend their password, but the rules of the bounty (and the employment contract) should be able to prevent that scenario.

In theory, any sensitive operation (such as changing the email address of a verified account) could be made to require approval from a second (randomly chosen) employee, and that second employee should see a log of recent actions taken by the first employee. An attacker may still manage to avoid raising suspicion for the first few targets, though.