Twitter right now: https://twitter.com/i/status/1283517347894980610
Hackers take over prominent Twitter accounts in simultaneous attack
271–280 of 1001 posts
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#272Earlier quoted context omitted.
> Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down! Is Twitter really using GitHub internally (even self-hosted)?
Is there even a self hosted Github? AFAIK there is no public offering of the sort.
[deleted]
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#273With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!
It "feels" like an insider attack (simultaneous compromise of lots of high value accounts) but I agree, it will make for a fascinating post mortem if one is produced.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#274I'm flabbergasted they haven't just hit the panic button and shut everything down. Unless, perhaps, they can't.
the anti-chaos monkey will just self heal the system, heh heh heh heh heh
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#275Earlier quoted context omitted.
> Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down! Is Twitter really using GitHub internally (even self-hosted)?
Is there even a self hosted Github? AFAIK there is no public offering of the sort.
github enterprise i believe can be onprem
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#276Watch this turns out to be a JS dependency tree problem from some library that was compromised months ago in some NPM module, used in the twitter web interface.
I love this theory, but at the same time, I feel that it's unlikely. Without knowing how their back-end is put together, that'd be like... trying to smuggle in a robot into an office building to break into a safe that's inside without knowing the floor plan, what kind of knobs are on the doors, etc.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#277With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!
Twitter almost certainly self-hosts GitHub, no?
Don't know, but current corporate dogma is to not host anything, including using third party auth provider which is like giving away their customer list.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#278Just imagine if Trump’s account were hacked to indicate that the US is launching a missile towards North Korea. Or maybe a message to encourage some kind of armed uprising in the US.
Hacking the right Twitter account could easily have massive life-and-death consequences. Isn’t that terrifying?
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#279Earlier quoted context omitted.
> Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down! Is Twitter really using GitHub internally (even self-hosted)?
Is there even a self hosted Github? AFAIK there is no public offering of the sort.
There's (was?) an on-premises enterprise version.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#280Looks like hackers got approx 60K. Anybody know how that compares to bug bounties at Twitter?