211–220 of 308 posts
Earlier quoted context omitted.
I could imagine a teenage hacker downloading his friend's or enemy's DMs. People the hacker knows in real life may be more interesting for him.
Why do we assume it's a young person doing the hacking?
Earlier quoted context omitted.
>none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them…
This is by far the most eyebrow-raising part of the update. To take over such a large number of verified accounts and then run a download on only eight non-verified ones seems almost impossible to have been anything other than targeted. The original idea that the bitcoin scam was a diversion starts to look more plausible in this light, but in the absence of any information about the downloaded accounts, there’s reall…
It seems like a sophisticated attacker running a targeted attack such as a government agency would presumably have avoided doing anything noticeable like the public tweets in the hope of being able to avoid detection and target additional people in the future.
Was this linked to the coming changes of the new API? https://blog.twitter.com/developer/en_us/topics/tools/2020/i...
Earlier quoted context omitted.
> There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0] [0]: https://twitter.com/TwitterSupport/status/128433914877449830...
>none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them…
The only reason someone wouldn't do this is if they didn't want the heat and if they didn't want the heat they wouldn't have hijacked high profile accounts to begin with.
>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts? edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be o…
Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. And there's no big reason to think that the exfiltration of privat…
To me the really irresponsible bit is that they kept the service up knowing full well there was a live attack in progress and they had not yet found a way to stop it. The Big Red Button has a place and the time to use it was last week. Given the prominence of the accounts that were compromised there isn't a shadow of doubt that shutting it down was the only responsible course of action. The world will continue to spi…
They disabled the account that were identified to be compromised. That isn’t enough?
Also, disabling everything would have likely been only a very short term solution - just enough to tide you over until you understand roughly what's going on, likely less than an hour.
How many people saw the tweets and transferred bitcoins during the period in which twitter likely could have turned off everthing, but not yet blocked access to the respective accounts? Likely very few, but perhaps not 0. Whether in retrospect that makes twitters choice to stay online reasonable depends a little on how much you think twitter just got lucky that the scope of the attack was small, or that you think they knew what they were doing.
Earlier quoted context omitted.
>none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them…
Why has no one considered the possibility that Twitter is lying about this part? The only reason someone wouldn't do this is if they didn't want the heat and if they didn't want the heat they wouldn't have hijacked high profile accounts to begin with.
They say it but downplay it very much.
Obviously this means the attackers had access to DMs.
Earlier quoted context omitted.
This is by far the most eyebrow-raising part of the update. To take over such a large number of verified accounts and then run a download on only eight non-verified ones seems almost impossible to have been anything other than targeted. The original idea that the bitcoin scam was a diversion starts to look more plausible in this light, but in the absence of any information about the downloaded accounts, there’s reall…
It's also possible that the attackers were unsophisticated and they downloaded data for real-life acquaintances for emotional reasons. It seems like a sophisticated attacker running a targeted attack such as a government agency would presumably have avoided doing anything noticeable like the public tweets in the hope of being able to avoid detection and target additional people in the future.