Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers take over prominent Twitter accounts in simultaneous attack

coindesk.com

Post reply on HN
Print view View original

611–620 of 1001 posts

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#611

Post by Darkphibre »

brentm wrote: post #377
neurostimulant wrote: post #144

With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

I wonder if this is hack in the sense that the account passwords were compromised or that the system itself was compromised in a way that would allow the attacker to tweet from any account.

I'd guess that Elon's first reaction would be to change the password. Since it's still happening, it's probably back-end.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#612

Post by Mountain_Skies »

stjo wrote: post #495
csomar wrote: post #452

Earlier quoted context omitted.

Maybe the dude shorted the Twitter stock?

Yeah, I'm not sure there is much to be gained from leaking internal data (are DMs that valuable?). The actual scam is executed so poorly that it can't be the main goal too. "Prooving" you have a good exploit by throwing it away is also not plausible.

While we'd hope that most people would be smarter than the send anything incriminating through a DM, the high profile nature of some of these accounts means anything embarrassing in their DMs could have significant value. They already have access to two presidential candidate's accounts and might have access to the incumbent's account even if they didn't post from it.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#613

Post by AlexDragusin »

Bluecobra wrote: post #517
DevX101 wrote: post #316

Twitter should suspend the entire platform until they can credibly fix this and prevent it in the future. An attacker could drop AMZN stock by 10% in minutes with just the wrong tweet from Bezos.

Yep, something like that already happened when the AP’s Twitter account was hacked back in 2013. https://www.google.com/amp/s/www.washingtonpost.com/news/wor...

Non AMP link: https://www.washingtonpost.com/news/worldviews/wp/2013/04/23...

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#614

Post by dasudasu »

hn_throwaway_99 wrote: post #513
LeoPanthera wrote: post #475

Earlier quoted context omitted.

> how little the BTC reward is going to be So far, the address has received the equivalent of over 50,000 USD.

Again, nothing. Given the accounts that were hacked, they could easily have moved markets and had pre-placed short bets that would have netted them potentially hundreds of millions.

If you do it in "real" markets, you get the attention of the SEC or similar agencies in other countries. Crypto is completely unregulated in this regard.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#615

Post by benlumen »

jgbond wrote: post #541
BiteCode_dev wrote: post #260

Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.

I’m guessing DMs were the real loot. The public display with the BTC diversion validates any DMs that were stolen. Otherwise blackmail targets could deny them.

Data theft like that is normally silently dumped after the breach occurs and anyone knows what happened.

This looks more like data injection somewhere. Perhaps an old API exploit. You used to be able to send an SMS to tweet, for example.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#616

Post by totetsu »

baxtr wrote: post #356
DevX101 wrote: post #316

Twitter should suspend the entire platform until they can credibly fix this and prevent it in the future. An attacker could drop AMZN stock by 10% in minutes with just the wrong tweet from Bezos.

Even worse? How about POTUS declares war on China thru twitter? OMG, I just realized how dumb that would have been to say back in 2016. But these days?

[bomb_emoji][china_flag_emoji]

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#617

Post by admn2 »

miguelmota wrote: post #190

Hackers still actively tweeting out from everyone's accounts https://twitter.com/search?q=All%20Bitcoin%20sent%20to%20the...

is it just me or are they now mass altering users' names?

https://twitter.com/search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p8...

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#618

Post by root_axis »

BiteCode_dev wrote: post #419
riffic wrote: post #393

This is what happens when you put all of your communication eggs into a single basket. Twitter needed to be taken down a couple of pegs. I think accounts of a high enough profile may want to closely examine the ActivityPub ecosystem.

We had a decentralized system before. It was called the mainstream medias. But they lost so much trust from the public that now we turn to social medias.

Ah yes, social media, well known for its reliability as a source of truth.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#619

Post by Geee »

kerng wrote: post #212
neurostimulant wrote: post #144

With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

Maybe a front end/OAuth issue - those are not uncommon either. Will be interesting to learn more. Also begs the question, who is liable in such cases....

Maybe a popular browser extension? Would explain why it seems to target tech people.
Post reply on HN