Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

cnn.com

Post reply on HN
Print view View original

161–170 of 645 posts

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#161

Post by jonstewart »

mrpopo wrote: post #78
vlan0 wrote: post #36

Eh, you could take out Twitter and insert many other company names and it'll still hold true. And those companies hold so much more sensitive data about you than Twitter. I know of insurance companies that have help desk employees with domain admin access. And all crippling ransomware attacks take advantage lax permissions. This is rampant. How is this a story?

Because people with a lot of money are inflating this story to get back at Twitter. It sounds like a conspiracy, but that's the most plausible explanation I have for why this specific whistleblower gets amplified by the media.

This specific whistleblower also happens to be mudge. It's funny how the initial top comments here don't seem to have any clue about who mudge is.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#162

Post by jonstewart »

markwisde wrote: post #100
elesbao wrote: post #95

By the CNN piece it seems like twitter hired a community figure - which is a common mistake that leads to bad performance evaluation. Public figures are trained on being public figures, they not necessarily are the best folks to build a security organization. OTOH there seems to be some frustration from both sides regarding performance and if it gets public our hackerman will have a rough time being exposed. I don't…

Nobody seems to know how you can build a successful security org

Yeah, like l0pht, @stake, DARPA...

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#163

Post by jdhn »

thesuperbigfrog wrote: post #137

"Twitter has hidden negligent security practices, misled federal regulators about its safety, and failed to properly estimate the number of bots on its platform, according to testimony from the company’s former head of security, the legendary hacker-turned-cybersecurity-expert Peiter “Mudge” Zatko." "Zatko was fired by Twitter in January and claims that this was retaliation for his refusal to stay quiet about the com…

>What might the SEC and shareholders do in response?

If shareholders believe this, they can do a variety of things such as sell the stock (smaller holders), or demand answers from leadership that go beyond "Yeah, we're secure" (bigger holders such as Saudi Arabia).

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#164

Post by alvis »

SilverBirch wrote: post #127

I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices are bad. It's also very difficult to view this in isolation when you have the timeline of (1): Fired in January, nothing happens. (2) Musk makes offer for twitter then reneges. (3) Months before the lawsuit gets decided re-emerges with accusations. What happene…

Looking at @paraga's response over the incidence, I don't see attacking Mudge Zatko's character does any help here. Does he know it can backfire?

https://twitter.com/donie/status/1562069281545900033

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#165

Post by digitallyfree »

strict9 wrote: post #40
kmfrk wrote: post #12

I hate being asked to hand over my phone number for 2FA or similar protections. Or facing the choice between deleting all my DMs or risking them being compromised on account no E2E support. Then again, even if you delete something, there's no knowing what their data retention handling is.

I think it's safe to assume most anything you delete from a web app gets a deleted boolean or timestamp field set and the content persists in the database indefinitely. In my experience I've found it rare that user content is ever actually permanently deleted for various reasons.

Yeah that's how most of them work. On some platforms (e.g. Reddit) if you do a full data request you'll see all your deleted comments as it's still there in the database, just hidden from public view.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#167

Post by purpleblue »

Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my ass, sent out an email requesting everyone reset their passwords, and let me continue working. I learned a good lesson because even though my intentions were good, and it did expose security issues, it was a bit immature and should have been done in a more controlled manner along with the proper clearances.

Mudge knows the implications of "whistleblowing". He has been a security consultant and even testified to Congress. He's not some noob that doesn't understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.

I think Twitter is in real trouble here.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#169

Post by hibikir »

boomboomsubban wrote: post #28

>one or more current employees may be working for a foreign intelligence service. I don't doubt this, but the source is someone with fairly deep ties to the US intelligence services. Why should he be allowed a job and not people with ties to foreign agencies?

I don't believe that what Mudge is saying there is all that well quoted or explained. The argument I've heard him make, in other settings, is that companies that are interesting enough will get job applicants that are really moles for intelligence agencies. This is very difficult to stop, and once your company has enough employees, downright impossible. His recommendation however is not to make it impossible for people with ties to foreign agencies to join the company. Instead, it's to minimize the access than any individual mole might have. This would also apply if you consider US intelligence an attacker!

TLDR; Someone like Twitter, Google or Facebook should have 'some of our employees are malicious and sophisticated' as part of their threat model.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#170

Post by mellavora »

hotpotamus wrote: post #51
vlan0 wrote: post #36

Eh, you could take out Twitter and insert many other company names and it'll still hold true. And those companies hold so much more sensitive data about you than Twitter. I know of insurance companies that have help desk employees with domain admin access. And all crippling ransomware attacks take advantage lax permissions. This is rampant. How is this a story?

Cybersecurity is one of my roles I suppose (small place with an operations team of approximately 2.5), and I have to say that I have no idea what proper security is supposed to mean today; it's very hard for me to tell the marketing from best practice now. It seems like what most products really are is an ass covering service so you can tell your leadership and your customers that you did the right things. Basically…

It is also about governance.

Do you have runbooks for your systems? (describes how to operate the system normally.)

What about playbooks? (how to handle errors)

Have you game-day-ed various failures? How long does it take you to restore everything from backup? What order do you bring your systems up?

What level of monitoring do you have on your systems? Can you spot unusual activity? How quickly?

What sorts of firewalls? Say "system X" is compromised. How far could damage spread from there?

Obscurity won't protect you when cybercrime is a business model.

Post reply on HN