Tampa teen accused of being ‘mastermind’ behind Twitter hack • Hacker News Board

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#571

Post by dehrmann » Sat, Aug 01, 2020, 4:09 AM UTC

montenegrohugo wrote: post #27

If this turns out to be true, then we can conclude two things: 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. 2. This also explains why the profit of the hack was 'only' ~$100k. Many speculated about how incredibly valuable such a hack could be and how much more a group could have profited from this hack. Using it for two hours of bitcoin scammi…

> 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account.

Someone else spoke to him being a teenager as not especially relevant, and I agree; it dismisses teenagers somewhat.

You're also falling for a selection bias. Twitter is a big target and likely stops attacks like this daily. This is just the one that got through, and probably more because of luck than skill.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#572

Post by joering2 » Sat, Aug 01, 2020, 4:10 AM UTC

slg wrote: post #140

Taek wrote: post #131

Hitting a 17yo with 30 felony charges feels a bit steep to me. Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? If a 17yo could do it, I'm sure a nation state could do it.

The age of the attacker is irrelevant to Twitter's role in this story. However your underlying point still stands. If we want these types of attacks to stop, we can't just let all these companies off with a public embarrassment being the primary punishment. At a certain point we have to start calling it negligence when companies fall for these attacks and fail to have proper precautions in place to prevent them.

Of course its steep. But he’s just a pawn. He is irrelevant. The bigger picture is that one of the largest tech companies with stock traded publicly got caught with pants down and revealed that their staff is not properly trained and vulnerable to social hacking. As a result millions of dollars invested in the stock were lost. Some angry billionaires who happen to write fat checks to politicians placed few very harsh phonecalls and then these politicians placed ten times more angry calls to the next in line, until they reached DOJ. That’s all it is. Now DOJ has last chance to look all serious and harsh before they turn the light off.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#573

Post by remarkEon » Sat, Aug 01, 2020, 4:12 AM UTC

dragonwriter wrote: post #565

remarkEon wrote: post #562

Earlier quoted context omitted.

The only reason that we look at the Boston Tea Party as a "good" thing that happened is because that side ended up winning a war. If the British had won that conflict it would be a footnote in history, noting that some hooligans destroyed some property.

> The only reason that we look at the Boston Tea Party as a "good" thing that happened is because that side ended up winning a war. No, it's because they ended up winning a war and became us . If it has been a group that went on to win war of national liberation against us, we probably wouldn't too kindly on it.

Sure, but the point remains. We remember the Boston Tea Party as a good thing only because the victors of that war celebrate it.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#574

Post by refurb » Sat, Aug 01, 2020, 4:15 AM UTC

MisterPea wrote: post #514

refurb wrote: post #493

Earlier quoted context omitted.

But that's not actually the law, is it? You could certainly bring a civil lawsuit (and so could Twitter users), but I haven't committed a crime.

True, but I think this case opens up doors on regulation of tech companies for security, or at least new laws for security negligence. The power that Twitter has due to its highest-profile users is immense, however, this hack made them look incredibly stupid.

I don't disagree, it's pretty damn embarrassing someone can get the keys to the kingdom through some social engineering.

My only concern is what happened with Equifax - some punishment is put on the company and it's only a token amount and nothing changes.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#575

Post by eschaton » Sat, Aug 01, 2020, 4:20 AM UTC

SahAssar wrote: post #155

Taek wrote: post #131

Hitting a 17yo with 30 felony charges feels a bit steep to me. Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? If a 17yo could do it, I'm sure a nation state could do it.

Having bad security is not criminal. If it was we wouldn't have a voting village at defcon cracked by pre-teens and there would be a lot more irresponsible CEO's in prison (so probably a better world).

Negligence is actionable regardless of whether it’s criminal. And whether it’s criminal depends on the duty of care that can be reasonably expected from the negligent party.

In this case, I’ll leave the expected duty of care to your imagination, but I’ll point out that we’re talking about a publicly-traded multinational corporation with many millions of users including governments and world leaders.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#576

Post by amiga_500 » Sat, Aug 01, 2020, 4:25 AM UTC

riquito wrote: post #553

bobmaxup wrote: post #547

Earlier quoted context omitted.

Why doesn't it make it proportionally more serious?

Ehm, seriously? 10 machine 40 years? 20 machine 80 years? There's no correlation with the concept of reforming that person after a while

Usa system isn't reformative

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#577

Post by eschaton » Sat, Aug 01, 2020, 4:27 AM UTC

lopmotr wrote: post #544

camjohnson26 wrote: post #242

Earlier quoted context omitted.

That attitude is exactly the problem though. These kids getting hit with a 30 year sentence bothers those of us who relate, when the same thing happens to young black inner city kids every day. Plenty of them are just as intelligent, risky, and bold as these kids but we throw them in prison for the best parts of their life without a second thought.

That's violent crime though, which is more obviously bad, even to a teenager. If you're 17 and intentionally kill someone then your brain is broken and you should be kept away from innocent people forever unless you really have some delayed development that comes later.

Why do you assume black kids are being put away for violent crimes? Mostly it’s drug possession, and they get hit with years while a white kid caught for exactly the same drug and amount gets off with a warning “to avoid ruining his future.”

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#578

Post by z3ncyberpunk » Sat, Aug 01, 2020, 4:36 AM UTC

VWWHFSfQ wrote: post #537

Taek wrote: post #131

Hitting a 17yo with 30 felony charges feels a bit steep to me. Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? If a 17yo could do it, I'm sure a nation state could do it.

> Hitting a 17yo with 30 felony charges feels a bit steep to me. Hitting them with 30 felony charges is perfectly reasonable/correct. Those are what the charges are for the crimes. But the punishment for those 30 felonies should/will be adjusted down. I think at most this person will lose 5 years of their life. Not like the 25 year old girl in Seattle that set a bunch of Seattle Police cars on fire during the protest…

Except that cyber crime laws are horrible written, outdated, and flat out wrong. I guess we should just blindly follow the law, like when it said slavery was all good!

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#579

Post by namibj » Sat, Aug 01, 2020, 4:41 AM UTC

helsinkiandrew wrote: post #564

saghm wrote: post #508

Earlier quoted context omitted.

> To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http This is probably off-topic, but companies shouldn't even be sending the passwords over HTTPS; passwords should be hashed client-side and then the hash should be sent to the server (preferably over HTTPS).

Can you elaborate on how this makes things more secure (assuming HTTPS) Surely if the server accepts a client side hash of a password, then the hash has become the password

At that point you can do key derivation to get an ed25519 private key from the password and a server-supplied salt (specific to that user), after which the client signs a challenge the server supplied with that private key. When the password was set/changed, the corresponding public key was stored on the server.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#580

Post by solipsism » Sat, Aug 01, 2020, 4:46 AM UTC

varenc wrote: post #499

nickff wrote: post #183

Earlier quoted context omitted.

From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.

An acquaintance of mine worked at the NSA and they also deal with this. He said during his first week he made the mistake of putting a CD-ROM with some official training materials into his work system. Within 10 minute two people showed up to stop him and investigate what was going on with his computer. It was fine in the end but he was seriously reprimanded by his boss. When you can’t trust users, the answer isn’t j…

And the same acquaintance described those NSA security protocols to you, who are now talking about them in a public forum. If your acquaintance actually did work for the NSA (God help us), he probably shouldn't have.