See also: https://news.ycombinator.com/item?id=32367719
[deleted]
An incident impacting 5M accounts and private information on Twitter
251–260 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#252See also: https://news.ycombinator.com/item?id=32367719
These make sense if there's discussion there otherwise they are just links to nowhere.
Re: An incident impacting 5M accounts and private information on Twitter
#253I think you will see more of this class of attack. Lots of companies have various 'forgot my username'/'forgot my password'/'trying to sign up for a new account with a new email address but existing phone number'/'add a friend by email or phone' flows. It's very easy to accidentally leak some info that shouldn't be leaked while implementing such a flow, since you are peering into the users database querying by email/…
Yes. The proper way to implement this flow is to ask for the information, and then present the exact same result screen regardless of the actions taken. Any additional information or action should be done exclusively through the contact information you have on record.
And making sure constant time on the response. Otherwise the slower response likely corresponds to a real phone number if the backend synchronously did more actions, such as sending a recovery email. The backend would need to be really slow however in order for a strong enough signal for this to be useful.
Re: An incident impacting 5M accounts and private information on Twitter
#254Re: An incident impacting 5M accounts and private information on Twitter
#255>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
The company entity requires blaming others. It can't blame itself, otherwise stakeholder value is affected. If you want to blame anyone, blame the environment that allows these types of actions by companies, or simply stop using them. BTW, no Twitter account is "ours". If it was, we could download everything (friends and all) and move it somewhere else. Twitter needs to take ownership of all data on their platform -…
> It can't blame itself, otherwise stakeholder value is affected.
One would think dishonestly blaming others for the consequences of their own conduct would also affect stakeholder value.
Re: An incident impacting 5M accounts and private information on Twitter
#256Earlier quoted context omitted.
"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.
Suppose Twitter did all it could to investigate and found no evidence. What would you rather have Twitter say in that case ?
"We assume it was exploited and you should too."
Re: An incident impacting 5M accounts and private information on Twitter
#257> When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. > In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken adv…
Out of curiosity, why is it only 5M and not 500M? You would think the same vulnerability applied to every server, not just one or one cluster, if they are using automated deployments
Re: An incident impacting 5M accounts and private information on Twitter
#258How did you arrive at the 5M figure, I didn't see the number of affected people in their post?
Same, I don't see the number in the article. Was it removed from the official Twitter post?
An older external article[1] about the hack mentions 5.4M accounts.
[1]: https://www.cshub.com/attacks/news/54-million-twitter-accoun...
Re: An incident impacting 5M accounts and private information on Twitter
#259Earlier quoted context omitted.
"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.
I always wonder who "we" refers to in that usage, legally speaking. Does it refer only to a subset of employees / board members who are authorized to speak for the company? Because then even if someone analyzing logs sees something damning, if middle management is trained to stop that knowledge from reaching the top, then those speaking for the company can continue saying "we" didn't know it.
I have 100% seen this happen.
Re: An incident impacting 5M accounts and private information on Twitter
#260Interesting how just throwing the 5M figure in the title changed everything for this post: https://u.ale.sh/some-accounts.png
