An incident impacting 5M accounts and private information on Twitter • Hacker News Board

Re: An incident impacting 5M accounts and private information on Twitter

#41

Post by RL_Quine » Tue, Aug 09, 2022, 5:20 PM UTC

WaitWaitWha wrote: post #27

londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

In the USA. They range from 4 (St. Helena) to 13 (Austria), I believe.

It's typically smaller though, not every phone number is allocated and many are in sequential groups. Some are special cased, you don't need to search any number matching `****555***` in north america for example, which cuts down on the search space quite a bit.

Re: An incident impacting 5M accounts and private information on Twitter

#42

Post by yunohn » Tue, Aug 09, 2022, 5:21 PM UTC

davchana wrote: post #34

colechristensen wrote: post #14

Earlier quoted context omitted.

>countries where a phone number has an annual fee of hundreds of dollars. Is this a thing? I've never heard of it. Where?

In India, its not expensive at all, but every sim card is available only after you provide a copy of your national id card aka Aadhar Card.

But as the OP mentioned, you need to maintain a paid plan and activity on the SIM to keep your number from expiring. It’s neither indefinite nor free.

Re: An incident impacting 5M accounts and private information on Twitter

#43

Post by Kukumber » Tue, Aug 09, 2022, 5:22 PM UTC

Whoever wants to get rid of anonymity on the internet will have to solve problems like this first

Until then :middle_finger:

Re: An incident impacting 5M accounts and private information on Twitter

#44

Post by RL_Quine » Tue, Aug 09, 2022, 5:22 PM UTC

HowardStark wrote: post #39

RL_Quine wrote: post #37

Earlier quoted context omitted.

If you know the right providers it's about $2/month for a non-VOIP, physical SIM to receive SMS for this sort of garbage.

Would be super interested in hearing more about where you could find such a deal _with a physical SIM_. Seems far too good to be true.

Many "IOT" providers give physical numbers for almost no cost, and they provide physical SIM cards for the service. The aren't VOIP so aren't blocked by twilio, etc for use with Twitter and other services.

Re: An incident impacting 5M accounts and private information on Twitter

#45

Post by bink » Tue, Aug 09, 2022, 5:23 PM UTC

londons_explore wrote: post #4

bink wrote: post #2

> When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. > In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken adv…

Probably the latter - all companies operating in the EU have had short (ie. 30 days) retention policies on anything user-identifiable (ie. http logs) for a while now. But if they didn't keep sufficient logs, they should have alerted the users back then, not now.

AFAIK there is an exception for security purposes. They could be hashing or "anonymizing" the IPs and keep the data longer.

Re: An incident impacting 5M accounts and private information on Twitter

#46

Post by CommanderData » Tue, Aug 09, 2022, 5:24 PM UTC

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

Twitter would actively block one time numbers. This seems like a lie.

I tried to use onoff numbers with Twitter on multiple occasions but failed to receive anything. They are being very misleading here.

Re: An incident impacting 5M accounts and private information on Twitter

#47

Post by RL_Quine » Tue, Aug 09, 2022, 5:24 PM UTC

627467 wrote: post #21

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

Agreed but, in what jurisdiction does Twitter require phone numbers?

All of them. You don't need to provide one on sign up, but your account will be soft banned typically in a couple of hours until you provide one. So it's a requirement that they aren't forthcoming about.

Re: An incident impacting 5M accounts and private information on Twitter

#48

Post by hunter2_ » Tue, Aug 09, 2022, 5:24 PM UTC

RL_Quine wrote: post #38

hunter2_ wrote: post #31

Earlier quoted context omitted.

Rate limiting should be used to mitigate this, although I suppose a botnet could overcome that to some extent proportional to the size of the botnet. And for anyone who didn't read TFA, this incident goes well beyond leaking what phone numbers use the product, it leaked the usernames associated with each as well.

Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.

I guess I was thinking more like "limiting the number of attempts" than "limiting the number of attempts over time" -- take time out of the equation (but then NAT causes trouble). But even so, you're right: as the threat landscape approaches the size of the result set, it breaks down no matter what.

Re: An incident impacting 5M accounts and private information on Twitter

#49

Post by 6stringmerc » Tue, Aug 09, 2022, 5:25 PM UTC

kordlessagain wrote: post #9

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

The company entity requires blaming others. It can't blame itself, otherwise stakeholder value is affected. If you want to blame anyone, blame the environment that allows these types of actions by companies, or simply stop using them. BTW, no Twitter account is "ours". If it was, we could download everything (friends and all) and move it somewhere else. Twitter needs to take ownership of all data on their platform -…

These are cogent points and I completely agree not admitting fault seems the playbook for publicly traded companies.

It’s unfolding in real-time with Tyler Technologies and we’ll have to see how it plays out. Intelligent institutional investors are poring money into a company that is responsible for leaking millions of intended to be confidential CRIMINAL RECORDS and is trying to blame JudyRecords for finding their mistake.

Again it goes to show we don’t really own anything that turns digital, and no safeguards are guaranteed. The only recourse is legal action, which is, IMHO going to bankrupt Tyler r force numerous spin offs to pay the class action results from the CA State Bar…and potentially hundreds more.[0]

The environment is one of no consequences when hiding behind a corporate banner, for most intents and purposes. Choose who you work for wisely.

[0] www.JudyRecords.com

Re: An incident impacting 5M accounts and private information on Twitter

#50

Post by kevinh » Tue, Aug 09, 2022, 5:26 PM UTC

627467 wrote: post #21

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

Agreed but, in what jurisdiction does Twitter require phone numbers?

A year or so ago, I created an account and followed ten or so people (no tweets at that time). When I went to log in the next day, it wouldn't let me log in until I attached a phone number. As I understand it, that was a relatively common occurrence.