Twitter internal panel linked to account hijackings • Hacker News Board

Re: Twitter internal panel linked to account hijackings

#221

Post by alquemist » Thu, Jul 16, 2020, 5:24 AM UTC

cantrevealname wrote: post #177

> "We used a rep that literally done all the work for us" This is why the privacy and security guarantees of almost all companies, credit bureaus, banks, the IRS, the department of motor vehicles, etc., are worthless. Every customer service rep that works at any of those places -- all 500 or 5000 or 50,000 of them -- can pull up info on anyone at any time. The only thing that prevents that is rules. There are no tech…

Great idea! User accounts are locked by default, and can only be accessed if unlocked, for a limited time period, by the user themselves. For extra security, though more friction, the unlock process generates a time limited access token, provided by the user to the rep, reducing the access surface to just the rep that possesses the token.

Re: Twitter internal panel linked to account hijackings

#222

Post by KingOfCoders » Thu, Jul 16, 2020, 5:28 AM UTC

Why have employees have the ability to do anything with accounts except closing them?

Re: Twitter internal panel linked to account hijackings

#223

Post by unishark » Thu, Jul 16, 2020, 5:28 AM UTC

sillysaurusx wrote: post #140

slg wrote: post #95

Earlier quoted context omitted.

This makes things sound even fishier. I think there has to be something else going on we don't yet know about. The amount of money this scam will actually earn the hacker is tiny compared to the potential of this hack and yet they still have enough money left over to bribe a presumably highly paid Twitter employee? Or maybe the Twitter employee is a low paid person which leads back to a question I raised elsewhere in…

The most reasonable explanation might be that they’re lying to sound cool. Bribery is a thing, but any twitter employee would know that their employment (and future career prospects) would be terminated. On the other hand, $1M in BTC might do the trick. Interesting thought experiment...

Unless the employee helped in a way that they didn't realize could be used for such a hack.

And/or they just thought it couldn't be traced back to them.

Re: Twitter internal panel linked to account hijackings

#224

Post by [deleted] » Thu, Jul 16, 2020, 5:29 AM UTC

CamelCaseName wrote: post #153

I wish they had used unique addresses for each tweet they sent out. It would have been fascinating to see which which account had the best conversion rate.

[deleted]

Re: Twitter internal panel linked to account hijackings

#225

Post by rurban » Thu, Jul 16, 2020, 5:34 AM UTC

Can someone post the content within that walled garden called Twitter? I cannot see that content without being logged in on mobile.

Re: Twitter internal panel linked to account hijackings

#226

Post by [deleted] » Thu, Jul 16, 2020, 5:37 AM UTC

[deleted]

Re: Twitter internal panel linked to account hijackings

#227

Post by ladberg » Thu, Jul 16, 2020, 5:37 AM UTC

iKevinShah wrote: post #208

CamelCaseName wrote: post #153

I wish they had used unique addresses for each tweet they sent out. It would have been fascinating to see which which account had the best conversion rate.

I didnt even know I wanted to know this. My guess is between Jeff and Bill. They're the leading ones who can afford giving twice the money back ;)

Elon Musk can afford it and is the only one known to tweet crazy stuff.

Re: Twitter internal panel linked to account hijackings

#228

Post by solotronics » Thu, Jul 16, 2020, 5:37 AM UTC

ajphdiv wrote: post #193

bb2018 wrote: post #191

Earlier quoted context omitted.

If they wanted to get as much money as possible without being caught what else could they have done? If that was the case they could only deal with bitcoin. Blackmailing with bitcoin may be smarter but maybe they figured that would be investigated more or treated more harshly? They could have released fake financial tweets and shorted the market - but that still would be investigated much faster. I'm sure the 100k or…

Buy shares in a small publicly traded company. Pump/dump shares. One tweet from musk stating he was adding such and such to all Teslas would send the target company through the roof.

US federal agencies actually investigate market activity around big events like 9/11. Very likely to be caught doing that unless you have some way of shuffling money in and out of the market anonymously.

Re: Twitter internal panel linked to account hijackings

#229

Post by zelly » Thu, Jul 16, 2020, 5:37 AM UTC

KingOfCoders wrote: post #222

Why have employees have the ability to do anything with accounts except closing them?

Apparently admins could post only on behalf of bluechecks. I still can't think of a reason why they would need to create posts. Edit maybe, but create? Why? Of course with access to the database anything at all can be done, but this was apparently an explicit feature of the admin dashboard.

Re: Twitter internal panel linked to account hijackings

#230

Post by kerng » Thu, Jul 16, 2020, 5:38 AM UTC

iKevinShah wrote: post #208

CamelCaseName wrote: post #153

I wish they had used unique addresses for each tweet they sent out. It would have been fascinating to see which which account had the best conversion rate.

I didnt even know I wanted to know this. My guess is between Jeff and Bill. They're the leading ones who can afford giving twice the money back ;)

I'd assume one closer to crypto, probably Elon Musk or Coinbase.

Because the audience needs to know how to quickly send BTC.

In addition, it's a running joke on Elon Musk's feed anyway where people constantly to do this using fake accounts of his.

So, maybe some thought today Musk is having it and finally doing it for real! If there is a person to run such a campaign for real, it would be him - so it could even be plausible.