Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers take over prominent Twitter accounts in simultaneous attack

coindesk.com

Post reply on HN
Print view View original

441–450 of 1001 posts

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#441

Post by maest »

amrrs wrote: post #122
maxcan wrote: post #83

Earlier quoted context omitted.

Honestly, we should be relieved if thats all that was stolen. A more sophisticated attack would involve OTM puts on TSLA and a tweet along the lines of: "finding major defects in Ys and 3s. shutting down all lines to reconfigure for a week" That could have netted the attackers millions.

"Hacking Elon’s Twitter account and using it for a crypto scam rather than a stock-trading scam shows a complete lack of imagination" - Naval https://twitter.com/naval/status/1283507218294292481?s=19

Who is Naval? Their website doesn't have an "about me" page.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#443

Post by choward »

paulpauper wrote: post #408
jaxxstorm wrote: post #251

I'm flabbergasted they haven't just hit the panic button and shut everything down. Unless, perhaps, they can't.

a temp fix is to modify the backend to prevent anyone from pasting a bitcoin address or any long string of numbers and letters that may resemble such an address

Not really. That just prevents them from posting bitcoin addresses. They still have access to all the accounts and can post whatever they like. It's still dangerous. And what about all the real posts that contain long strings?

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#444

Post by quonn »

searchableguy wrote: post #349
GordonS wrote: post #334

Earlier quoted context omitted.

Keeping in mind the attackers will not be able to perform this stunt again though the same attack vector, It could also simply be that the attackers overestimated how much they would make from this attack.

I doubt that. For one, they wouldn't be reusing the crypto messages from the past which have been seen by everyone on twitter a thousand times. I ignore based on tweet rather than looking at who tweeted it most of the time. So they at least would write new messages if they were after money. There are so many ways to make money that even a dumb person could find something better than posting crypto ads without comprom…

Yeah, but Twitter will surely:

a) fix the bug if it‘s in their APIs

b) roll out a framework to be able to respond quickly in the future. Like a regex on their edge servers.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#446

Post by vmception »

MattGaiser wrote: post #203
vmception wrote: post #188

Earlier quoted context omitted.

probably a social media manager api keys

Do that many accounts use the same social media manager?

I think many people have try several of them before settling on one for their use case, and don't revoke the OAuth.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#447

Post by nonbirithm »

lazyjones wrote: post #315
shiado wrote: post #25

Place your bets, phishing or bug exploit. Some of these targets are too high profile to all fall for it and probably have teams that manage these accounts securely. Edit: 2fa was bypassed, interesting. https://twitter.com/tylerwinklevoss/status/12834920178892595...

Betting on inside / direct database access or admin account.

Well then we're royally fucked if all it takes is a single rogue admin at this single, societally ubiquitous company to expose everything and let people fire off false declarations of war on each other or short TSLA and additionally make the entire concept of 2FA meaningless.

This was exactly what 2FA was supposed to prevent, and if this is to be believed then because of Twitter's implementation it was all worth peanuts in the end.

There are just too many eyes on Twitter for their administration to let this happen. Twitter has grown into too big and too valuable of a target at this point, and the moment this happens you can't prevent dumb people from falling for it thirty seconds after it gets posted and starts showing up in their feed.

Then why was it even possible to do this from the inside? What employee access controls did they have on administrative accounts?

I'm thinking they're going to need to dig an underground bunker and have everyone be in the presence of at least three other certified minders when a group of two dozen people at a tech startup are the last bastion of hope in preventing the disruption of global communications.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#448

Post by byteshock »

neurostimulant wrote: post #144

With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

If they had full access to Twitter’s backend, they probably would be tweeting from accounts like @POTUS or @jack. But this seems like they have access to limited accounts. Most likely gained access to a third party service that allows you to manage your tweets?

Edit: they tweeted from the twitter support account. Just wow. They might have actually gotten into Twitter’s systems.

Edit 2: To expand on my edit above, I saw multiple tweets from other accounts that showed a screenshot of the scam tweet originating from the twitter support account. I’m not sure if it’s real or not, since they keep deleting the tweets. If it is real that would definitely open doors to more theories.

Edit 3: Seems like the twitter support account was a joke. Impossible to tell with everything going on!

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#449

Post by larrywright »

BiteCode_dev wrote: post #403
baxtr wrote: post #356

Earlier quoted context omitted.

Even worse? How about POTUS declares war on China thru twitter? OMG, I just realized how dumb that would have been to say back in 2016. But these days?

Or just post some white nationalist call for arm. The US is ripe for a blood bath right now.

If someone were to take over that account an issue a call to arms for the QAnon crowd, it could be disastrous.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#450

Post by Acrobatic_Road »

williamdclt wrote: post #410
Acrobatic_Road wrote: post #355

Earlier quoted context omitted.

You're overestimating the intelligence of the typical scammer.

The typical scammer doesn't hack twitter

Yeah, because this looks oh so professional.
Post reply on HN