Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who’s behind Wednesday’s epic Twitter hack?

krebsonsecurity.com

Post reply on HN
Print view View original

361–370 of 536 posts

Re: Who’s behind Wednesday’s epic Twitter hack?

#361

Post by remarkEon »

mongol wrote: post #318
IAmGraydon wrote: post #288

Earlier quoted context omitted.

Well let’s see...since all countries with ICBMs also have technology in place to detect or verify via satellite a nuclear launch, absolutely nothing would happen. If a real launch had taken place, they would have known about it far before they heard about a post on Twitter. The alarmism here on HN is really disappointing. This is the kind of foolishness usually reserved for Reddit.

I think plenty could have happened. Compare with the false nuclear attack alarm in Hawaii the other year. Panic can cause all kinds of unforseeable consequences.

Right, but I think the point is that panic is the only real danger this hack could've caused. That's important in it's own right, but hacking twitter is not going to cause nuclear war. DoD has a ... tentative relationship with social media. They are not making strategic deployment decisions based off of tweets (thank God).

Re: Who’s behind Wednesday’s epic Twitter hack?

#362

Post by Reimersholme »

IAmGraydon wrote: post #280
todd3834 wrote: post #252

Earlier quoted context omitted.

I believe they are referring to the fact that they could have theoretically tweeted the wrong thing from the wrong account that could have caused a war. It isn't extremely likely but not comically unrealistic. Definitely within the realm of possibility.

How do you envision that happening? I mean the actual chain of events. A tweet is seen and some general launches all ICBMs? They pour their country’s military might into a war because of a tweet that is known to be fake within 3 minutes? No, it is not within the realm of possibility.

Tweet from Trumps account that it’s time for all true patriot militias to take to the street to stop the terrorists in BLM, as the democrats are preventing cops and national guard from handling the situation?

A bunch of other voices seemingly agreeing, and a bunch of BLM voices responding to take up arms and show the white people that they won’t back down?

Re: Who’s behind Wednesday’s epic Twitter hack?

#363

Post by tolbish »

lifeformed wrote: post #260
dmitryminkovsky wrote: post #197

Earlier quoted context omitted.

People keep saying it could have started a war. Excuse me for being naive but come on—really? This is total sensationalism. What party wouldn’t verify something on twitter through diplomatic channels before going to war? Equity destruction: sure. War: no way.

Here's how I think it could be done: Get Trump's account, and tweet something like, "I've ordered a NUCLEAR STRIKE on China! The missiles are already in the air. The DEEP STATE is trying to take me out. They will try to silence me and delete these tweets and use deep fakes to say this was a hoax! The storm is here, Q is real, it's time to take up arms and kill democrats." Then continue tweeting escalating things over…

Needs more typos and asinine adjectives like "kill the TRAITOROUS democrats".

Re: Who’s behind Wednesday’s epic Twitter hack?

#364

Post by jrumbut »

akira2501 wrote: post #157
dwd wrote: post #133

Earlier quoted context omitted.

The same could be said for radio, whether Orson Wells "Alien Invasion" broadcast or the multitude of April 1st jokes that got out of hand.

> The same could be said for radio Yes, except the FCC can forcefully suspend the operations of a radio station.

I think radio is probably a better source than Twitter as a whole, however they did air (still air?) Coast to Coast AM for decades.

Though Art Bell said the show was "pure entertainment", anyone who tuned in without that context heard what sounded like a serious news talk program about aliens, crystal healing, reptilians, etc, etc.

Re: Who’s behind Wednesday’s epic Twitter hack?

#365

Post by imhoguy »

twodave wrote: post #176

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

This could be even some malcious browser extension running on one highly privileged employee computer. Security is arms race and tradeoffs game, even computers never connected to the Internet are at risk (see Stuxnet story)

Re: Who’s behind Wednesday’s epic Twitter hack?

#366

Post by vertak »

dwd wrote: post #292
subpixel wrote: post #254

Earlier quoted context omitted.

People are not looking for trusted sources of knowledge. They are looking for entertainment.

Trust is a loaded concept. What people trust is generally what fits their worldview which is increasingly reinforced by the filter bubbles provided by tech companies. The increasing polarisation and tribalism is made worse by the traditional network programming and now algorithms that present what the audience is comfortable to see and hear. I like using DDG because it doesn't filter, but at the same time I hate wadi…

How often do you need to be the filter? I’m genuinely curious because your experience is very different from my own, where I’ve been using DDG for years and I only notice poor results roughly 1 in 100 of the times, and then I’m just a quick “g! ” away from slightly higher quality results.

Re: Who’s behind Wednesday’s epic Twitter hack?

#367

Post by westmeal »

blisseyGo wrote: post #225
ilaksh wrote: post #179

Earlier quoted context omitted.

Its almost as if we shouldn't centralize such communication in a single giant private corporation.

While I am 10000% onboard with decentralizing communication, I am not sure if that would help in cases like this though. Back in 2013, only a single news outlet AP's twitter was hacked and had similar consequences. Decentralizing wouldn't have helped there I think.

Signing the message would be but who uses that nonsense right

Re: Who’s behind Wednesday’s epic Twitter hack?

#368

Post by hvidgaard »

xyst wrote: post #200
twodave wrote: post #176

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug p…

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

The rhetoric of this statement is far more of an "anti-pattern" than VPN will ever be. If VPN is your only line of defense, then it's not secure at all - not because of VPN, but because of poor security practices in general.

VPN and IP restrictions in general is a very good tool to limit the attack surface. That does not mean that Karen from accounting should be able to log into the production environment servers.

Re: Who’s behind Wednesday’s epic Twitter hack?

#369

Post by dannyw »

dilandau wrote: post #34
TechBro8615 wrote: post #23

This is the most important point: > Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. My understanding is the hackers used the admin panel to change the email addresses of…

I'm curious about this, too. I have to believe, though, that if some bumbling sim swappers were able to get in, then it doesn't require a leap to assume sophisticated state-level actors have similar access. Granted this attack leaves a swath of evidence, but with access to internal tooling, it really is just a factor of how much information is accessible via those tools (and others like them).

We know a Twitter employee worked with Saudi Arabia to target dissents.

Re: Who’s behind Wednesday’s epic Twitter hack?

#370

Post by martinko »

crtasm wrote: post #20
paulpauper wrote: post #7

The among taken in this scam is chump change compared to the YouTube scammers. YouTube is a vastly bigger website than twitter and way slower to respond to accounts begin stolen by scammers. I remember seeing an Ripple giveaway scam that in a single day made 100k with just a single account ,. And fake bill gates one made 40k. the list goes on and on. My guess is the total taken is in the $3-5 million range from youtu…

And you don't even need to steal an account. When the Playstation 5 launch event was happening I searched for it on Youtube, clicked the top result and it turned out to be a scammer restreaming the real live event with graphics added saying Sony would double your BTC - just send to this address ___.

It was probably the top result, because the account the hacker was streaming from was a stolen high-profile account.
Post reply on HN