Hackers take over prominent Twitter accounts in simultaneous attack • Hacker News Board

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#391

Post by justinmeiners » Wed, Jul 15, 2020, 10:02 PM UTC

dx87 wrote: post #34

shiado wrote: post #25

Place your bets, phishing or bug exploit. Some of these targets are too high profile to all fall for it and probably have teams that manage these accounts securely. Edit: 2fa was bypassed, interesting. https://twitter.com/tylerwinklevoss/status/12834920178892595...

Sounds like an exploit. The article says that some of the accounts were confirmed to have multi-factor authentication enabled.

> multi-factor authentication enabled

It sure seems like multi-factor auth isn't very helpful, when nearly all hacks have nothing to do with breaking credentials.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#392

Post by Laforet » Wed, Jul 15, 2020, 10:03 PM UTC

I have a couple of services that run on twitter API and they have all been suspended in the last half hour. They are definitely in damage control mode.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#393

Post by riffic » Wed, Jul 15, 2020, 10:03 PM UTC

This is what happens when you put all of your communication eggs into a single basket.

Twitter needed to be taken down a couple of pegs. I think accounts of a high enough profile may want to closely examine the ActivityPub ecosystem.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#394

Post by justinzollars » Wed, Jul 15, 2020, 10:03 PM UTC

Instead of putting so much engineering time into pushing a political agenda, twitter should focus on security and identity improvements.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#395

Post by mekkkkkk » Wed, Jul 15, 2020, 10:03 PM UTC

Scoundreller wrote: post #365

mekkkkkk wrote: post #332

Is it just me, or does this seem suspiciously poorly thought out? Perhaps there is a second stage involving stock plays. The BTC thing might be a diversion. Or we are incredibly lucky and the exploit was found by people with really bad foresight and imagination.

Or it's been exploited for months/years to read people's DMs and private accounts and they decided to burn it now mostly for lolz?

That would be so incredibly stupid. Burning a money machine of that magnitude for lulz? I don't think anyone would do that.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#396

Post by suzzer99 » Wed, Jul 15, 2020, 10:03 PM UTC

zelly wrote: post #307

neurostimulant wrote: post #144

With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

There is no way Twitter depends on Github CI/CD to push updates. I refuse to believe this.

That twitter buildspec.yml must be HUGE!

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#397

Post by paulpauper » Wed, Jul 15, 2020, 10:03 PM UTC

BiteCode_dev wrote: post #260

Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.

>Such a hack is worth way, WAY more than the few BTC it could bring.

lol tons of ppl have been scammed. If by 'little' you means hundreds of k. In some Eastern European country that can last a lifetime.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#398

Post by x3n0ph3n3 » Wed, Jul 15, 2020, 10:03 PM UTC

mekkkkkk wrote: post #332

Is it just me, or does this seem suspiciously poorly thought out? Perhaps there is a second stage involving stock plays. The BTC thing might be a diversion. Or we are incredibly lucky and the exploit was found by people with really bad foresight and imagination.

Stock plays would be much easier to detect and trace.