Tampa teen accused of being ‘mastermind’ behind Twitter hack • Hacker News Board

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#351

Post by Google234 » Fri, Jul 31, 2020, 9:41 PM UTC

etrabroline wrote: post #233

nordsieck wrote: post #212

Earlier quoted context omitted.

> It's not whether it's bad for someone to commit this crime, it's whether Twitter should be held liable for such poor security practices that a 17 year old can hack them. That is exactly my point. There are tons of crimes that basically anyone can do. If you said instead: people whose houses are set on fire by an arsonist should be liable for poor security, at the very least you'd not be taken very seriously. There…

>There is no duty to avoid being the victim of a crime If you entrust a bank with 10 thousand dollars, and the bank puts your money in a paper bag and leaves it in the lobby, they are going to be held liable if someone walks away with it. Twitter letting teenagers steal people's data is approaching that level of negligence for a mutli-billion dollar company.

The only thing between the inside of a home and the outside is a thin layer of glass. Should we hold home owners responsible for people breaking in and stealing? Lots of things are fragile, we have a laws to act as a deterrent to violations

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#352

Post by Nacraile » Fri, Jul 31, 2020, 9:42 PM UTC

thinkloop wrote: post #341

function_seven wrote: post #166

Earlier quoted context omitted.

Sure, but if they connected to the VPN from their own IP, then that's not going to hide anything.

Is connecting to a VPN through another secure VPN doable/benefit?

Doable, although annoying to configure correctly. Beneficial if you want to obscure your identity from the second VPN server (i.e. Twitter's, in this case, which ought to be logging connections)

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#353

Post by ChrisLomont » Fri, Jul 31, 2020, 9:43 PM UTC

indigochill wrote: post #306

I have an unrealistic idea (more of a thought experiment) that companies should face equal culpability to criminal hackers in attacks. After all, technically the way the hackers use systems /is/ authorized in a sense, even if the method of obtaining authorization is unconventional. Maybe this would get companies to pay more attention to securing their systems. From a certain perspective, Twitter is an accomplice to f…

Should we make homeowners equally criminally liable when burglars break in? Certainly if the homeowner had been less lax or obtained more security, that burglary could have been prevented.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#354

Post by josu » Fri, Jul 31, 2020, 9:44 PM UTC

par wrote: post #126

> Today’s announcement proves that cybercriminals can no longer hide behind perceived global anonymity Anyone know what the loose end was that got these guys busted?

It seems that they mixed the stolen bitcoins with bitcoins that they withdrew from Coinbase. So law enforcement probably knew who they were from day 1. I feel that this is the time it took them to put together a case.

https://twitter.com/ErgoBTC/status/1283561433972846592?s=19

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#355

Post by sneak » Fri, Jul 31, 2020, 9:44 PM UTC

ChrisLomont wrote: post #353

indigochill wrote: post #306

I have an unrealistic idea (more of a thought experiment) that companies should face equal culpability to criminal hackers in attacks. After all, technically the way the hackers use systems /is/ authorized in a sense, even if the method of obtaining authorization is unconventional. Maybe this would get companies to pay more attention to securing their systems. From a certain perspective, Twitter is an accomplice to f…

Should we make homeowners equally criminally liable when burglars break in? Certainly if the homeowner had been less lax or obtained more security, that burglary could have been prevented.

Breaking and entering requires breaking.

Sending packets is peaceful speech.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#356

Post by Nasrudith » Fri, Jul 31, 2020, 9:44 PM UTC

shadowgovt wrote: post #196

ibejoeb wrote: post #147

Earlier quoted context omitted.

Nothing in the complaint (well, for the two others, since his is sealed) says that a state-level actor wasn't involved. Could be the tip of the iceberg. I find it hard to believe that this was prank hacking for about $150,000. You could sell Obama's handle for more, surely.

Personally, I find "it was a prank" extremely easy to believe. It's the simplest answer to the question "Wait, if someone compromised Twitter so badly they could tweet anything from any account, why didn't they try to move the whole stock market or start World War III?" "Because they're young punks and didn't think of that" is a reasonable answer.

Prank hacking would fit with the monetization when combined with statements of "who would be dumb enough" that underestimates stupidity like the whole charge your iPhone in the microwave or Soupy Sales' "send in all of the green paper in your parents wallets" not thinking people would actually do it. Plenty of precedent but easy to see why they would feel no responsibility for anyone mindbogglingly stupid enough to do so.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#357

Post by user5994461 » Fri, Jul 31, 2020, 9:45 PM UTC

Taek wrote: post #337

ggggtez wrote: post #278

Imagine a 17 year old robs a bank and steal 100k from the savings accounts of random people. Or a 17 year old steals a couple of cars from random people off the street... The crime is not breaking into Twitter. The crime is theft. Twitter didn't steal that money, this guy did. Let's not pretend the internet is a magical land without consequences.

> Imagine a 17 year old robs a bank and steal 100k from the savings accounts of random people. I think that's a great comparison. But it's not an armed robbery, it's a break-and-enter where no property gets destroyed. How many felonies does the robber get after being caught? I don't actually know but I'm guessing 1-3? Certainly stealing $100k is a deserving felony. But 30 felonies seems a bit steep.

The guys have a very long history of scams, with $700 000 seized before this twitter thing it seems.

That money is very much destroyed for the people whom it was stolen from.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#358

Post by catacombs » Fri, Jul 31, 2020, 9:46 PM UTC

tibbar wrote: post #286

amrrs wrote: post #268

> Washington DC Field Office Cyber Crimes Unit analyzed the blockchain and de-anonymized bitcoin transactions allowing for the identification of two different hackers. Anyone with Bitcoin Transaction knowledge, what's this de-anonymization of Bitcoins transaction? >Today’s announcement proves that cybercriminals can no longer hide behind perceived global anonymity,” said Thomas Edwards, Special Agent in Charge, U.S.…

Bitcoin transactions take place between addresses, which are hashes of public keys. It's actually better to call bitcoin "pseudonymous", since the addresses are pseudonyms that may or may not be tied to an irl identity. So if you, a hacker, tell someone to submit Bitcoin to an address, that address is only really "anonymous" until you use your private keys to reroute the money to other addresses. As soon as the graph…

> It's very silly to try to cash in on ill-gotten bitcoin...

What's the alternative? Sit on the coins or use them for purchases?

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#359

Post by ChrisLomont » Fri, Jul 31, 2020, 9:47 PM UTC

Taek wrote: post #337

ggggtez wrote: post #278

Imagine a 17 year old robs a bank and steal 100k from the savings accounts of random people. Or a 17 year old steals a couple of cars from random people off the street... The crime is not breaking into Twitter. The crime is theft. Twitter didn't steal that money, this guy did. Let's not pretend the internet is a magical land without consequences.

> Imagine a 17 year old robs a bank and steal 100k from the savings accounts of random people. I think that's a great comparison. But it's not an armed robbery, it's a break-and-enter where no property gets destroyed. How many felonies does the robber get after being caught? I don't actually know but I'm guessing 1-3? Certainly stealing $100k is a deserving felony. But 30 felonies seems a bit steep.

It depends on how many laws with felony consequences each broke.

If a robber hacks a computer (a felony), impersonates law enforcement (a felony), uses that to commit fraud (a felony), then transfers stolen money across state lines (a felony), then tries to launder it (a felony).....

You can see how such things can stack up.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#360

Post by sakisv » Fri, Jul 31, 2020, 9:51 PM UTC

raverbashing wrote: post #307

slg wrote: post #140

Earlier quoted context omitted.

The age of the attacker is irrelevant to Twitter's role in this story. However your underlying point still stands. If we want these types of attacks to stop, we can't just let all these companies off with a public embarrassment being the primary punishment. At a certain point we have to start calling it negligence when companies fall for these attacks and fail to have proper precautions in place to prevent them.

Yes. But at the same time, it's easy to get into "blame the victim" mode Having full blown security could mean nothing is done easily anymore Prosecuting is important

Depends on how you define the victim.

One could argue that the victims in this case are the people whose profiles had been hacked.

As for having full blown security getting in the way of getting stuff done, try replacing "Twitter" with "Equifax", a company that handles arguably more sensitive data and should have the "full blown security" you mentioned.

Did they suffer any tangible consequences?