Tampa teen accused of being ‘mastermind’ behind Twitter hack • Hacker News Board

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#511

Post by ibejoeb » Sat, Aug 01, 2020, 1:28 AM UTC

paulpauper wrote: post #296

ibejoeb wrote: post #147

Earlier quoted context omitted.

Nothing in the complaint (well, for the two others, since his is sealed) says that a state-level actor wasn't involved. Could be the tip of the iceberg. I find it hard to believe that this was prank hacking for about $150,000. You could sell Obama's handle for more, surely.

yeah cuz a trillion dollar state entity is so strapped for cash it needs to steal 150k of bitcoin too, drawing attention to the scheme.

Well, of course that wouldn't be the move. The move would be to coerce the naive but capable hackers into doing this, and once the payload was delivered, burn them. I don't know what happened, but it's kinda a waste of a huge position, so I don't think it's that far-fetched.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#512

Post by cutemonster » Sat, Aug 01, 2020, 1:36 AM UTC

hnuser123456 wrote: post #253

justchilly wrote: post #249

Earlier quoted context omitted.

Would that apply to criminals of all ages, based on their intelligence / mental maturity? Plenty of incarcerated 18+ adults with less brainpower than this guy were deemed responsible for their actions.

So what do you think is an appropriate sentence for him?

Paying back x2 to the ones that got scammed.

And forcing Twitter to pay part of it, for their lousy "security".

Plus three months working in a shelter for homeless people

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#513

Post by syshum » Sat, Aug 01, 2020, 1:37 AM UTC

montenegrohugo wrote: post #27

If this turns out to be true, then we can conclude two things: 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. 2. This also explains why the profit of the hack was 'only' ~$100k. Many speculated about how incredibly valuable such a hack could be and how much more a group could have profited from this hack. Using it for two hours of bitcoin scammi…

I would add 3. People need to stop using "Trust > instead of self hosting because they have teams of security "experts" and will have far better security than you ever could on your own"

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#514

Post by MisterPea » Sat, Aug 01, 2020, 1:39 AM UTC

refurb wrote: post #493

7786655 wrote: post #304

Earlier quoted context omitted.

If you were responsible for securing my stuff, and you put a cheap lock on your door protecting my stuff, and someone breaks in and steals all my stuff, then yes, you should be held liable for your poor security practices.

But that's not actually the law, is it? You could certainly bring a civil lawsuit (and so could Twitter users), but I haven't committed a crime.

True, but I think this case opens up doors on regulation of tech companies for security, or at least new laws for security negligence. The power that Twitter has due to its highest-profile users is immense, however, this hack made them look incredibly stupid.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#515

Post by ribosometronome » Sat, Aug 01, 2020, 1:40 AM UTC

saghm wrote: post #508

rschneid wrote: post #395

Earlier quoted context omitted.

Twitter is a platform used widely by some of the most powerful people in the world and in the US government. As a result, there is plenty of justification and precedent for said gov't to regulate their security practices and procedures. To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http. Now, I don't think the government is prepared to do this proa…

> To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http This is probably off-topic, but companies shouldn't even be sending the passwords over HTTPS; passwords should be hashed client-side and then the hash should be sent to the server (preferably over HTTPS).

Wouldn't that allow for a compromised database to leak the information a nefarious user needs to log into accounts? Compared to needing to find a collision if a database of hashes leaked?

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#516

Post by tempestn » Sat, Aug 01, 2020, 1:41 AM UTC

robbiep wrote: post #402

Kaveren wrote: post #381

Earlier quoted context omitted.

you cannot start world war 3 or become a billionaire through some tweets, this is not a movie.

I feel like it would have been relatively trivial to make decent 7-9 figures depending on your initial leverage just by manipulating some key accounts. Ie: short Tesla, musks account says solar roof delays, firmware error has started bricking cars, self driving is 10 years away, delivery numbers going to fall well short Trump (surprised they didn’t hit that) - no new stimulus for unemployed, CORPORATE WELFARE MUST ST…

Even setting up your trades in advance, there's no way you're going to make a billion dollars doing that kind of thing without being noticed. Millions, maybe (although maybe not), but certainly not hundreds of millions. Unless you already have hundreds of millions to work with, but then you're probably not a 17-year-old hacker.

Best case he'd probably have a few tens of thousands in capital, and he gets one shot at it. In order to get the kind of leverage needed, he'd need to use short term options and/or move penny stocks. Either one of those would paint a giant target on him.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#517

Post by mmmmmk » Sat, Aug 01, 2020, 1:44 AM UTC

Where's Kirk?

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#518

Post by manquer » Sat, Aug 01, 2020, 1:45 AM UTC

transitionnel wrote: post #497

manquer wrote: post #419

Earlier quoted context omitted.

the study says 29% gave the password without chocolate as well . Some where given chocolate before and after , nowhere it says chocolate was offered as payment for sharing the password. Small gifts could have been inducement to establish relationship and trust not the same as a bribe as you characterises it I find it hard to believe 25 /40 % plus people readily share their password to total strangers , without knowin…

What kind of mindset would lead to this behavior?? Maybe it doesn't matter. It feels -to me- like simply being exposed to people who say things like: " What ?-- no, that's not good" while remaining professional, respectful, and humorous, is a vaccine against not wanting to seem jerky, yet staying secure.

Perhaps it did not come out as I hoped, if it was offensive I appolgize

The premise that integrity of most people is bribed by few bars of candy was offensive to me I hope it is to you as well. The sensationalist headline basically claimed that, the abstract was a very different statement.

I am tired of studies that are constantly being cited these days: readers, journalists and even the principals invariably sensationalize the headlines.

It is a losing battle to get anyone to critically analyse information presented to them, sooner or later you are going to snap. Whether it is alternate medicine, creationism, or conspiracy theories there is a real damage out there everyday , few people ( Jon Stewart? ) are articulate despite being frustrated and are able to civil engage in discussion.

Even if the study actually claimed what the headline said, the bar to peer reviewed respected research in much of psychology and social sciences seems so low that just getting some correlation between two parameters is good enough. Raw data is rarely shared, and statistical methods used are superficially understood and discussed, half the analysis's are just putting data into a tool like SPSS with the whatever defaults IBM puts in these days. There is not much scope for replication of a finding, a core principle of the scientific method.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#519

Post by hindsightbias » Sat, Aug 01, 2020, 1:46 AM UTC

nickff wrote: post #183

slg wrote: post #140

Earlier quoted context omitted.

The age of the attacker is irrelevant to Twitter's role in this story. However your underlying point still stands. If we want these types of attacks to stop, we can't just let all these companies off with a public embarrassment being the primary punishment. At a certain point we have to start calling it negligence when companies fall for these attacks and fail to have proper precautions in place to prevent them.

From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.

A criminal mastermind would leave a stick behind to infect those investigating.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#520

Post by syspec » Sat, Aug 01, 2020, 1:47 AM UTC

> According to federal agents, Sheppard was found out partly because he used a personal driver’s license to verify himself with the Binance and Coinbase cryptocurrency exchanges, and his accounts were found to have sent and received some of the scammed bitcoin. Fazeli also used a driver’s license to verify with Coinbase, where accounts controlled by “Rolex” allegedly received payments in exchange for stolen Twitter usernames.

That is such a simple mistake to make, wow.