Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers take over prominent Twitter accounts in simultaneous attack

coindesk.com

Post reply on HN
Print view View original

681–690 of 1001 posts

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#681

Post by arp242 »

embit wrote: post #637

I am sorry but either from the article or discussion here, I am not exactly clear what has happened. Can someone explain ? Meaning did the user accounts on Twitter got hacked or the actual company websites ? Or both ?

At this point, no one really knows much other than that they've managed to get several prominent Twitter accounts to post scam messages. There were also replies posted and tweets pinned and recovery emails reset, so the attack seems deeper than just "ability to post a new tweet".

Some accounts were protected with 2FA, so it probably is some exploit in the API which affects many accounts (possibly all?), some intrusion in the Twitter infrastructure, or some exploit which allows people to hijack accounts. But that's really just an educated guess.

Considering it doesn't seem fixed yet, I'm not even sure the Twitter people have a complete understanding of what's going on yet.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#682

Post by DaftDank »

Scoundreller wrote: post #551
fishtoaster wrote: post #336

Earlier quoted context omitted.

It could just be a relatively unsophisticated actor who stumbled upon a serious vulnerability and didn't know enough to market it to, eg, a state actor or whatever.

Sounds like the 2005 hack of the Danger Sidekick (early smartphone device). I think the fellow went by the 'nym "ethics". Dude couldn't exploit it for much, despite being able to takeover/access any account, and everything was in the cloud.

I used to have a Sidekick, I could type out texts so fast with that thing. Weren't there a few big celebrities who had their Sidekicks hacked back then?

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#683

Post by manjalyc »

csomar wrote: post #452
BiteCode_dev wrote: post #260

Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.

Maybe the dude shorted the Twitter stock?

Doubt it, that would open up too many vectors on an otherwise easily anonymized operation.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#684

Post by [deleted] »

Pmop wrote: post #525
byteshock wrote: post #448

Earlier quoted context omitted.

If they had full access to Twitter’s backend, they probably would be tweeting from accounts like @POTUS or @jack. But this seems like they have access to limited accounts. Most likely gained access to a third party service that allows you to manage your tweets? Edit: they tweeted from the twitter support account. Just wow. They might have actually gotten into Twitter’s systems. Edit 2: To expand on my edit above, I s…

I think that they just like to be alive, so they avoided hacking POTUS or other countries Presidents/PMs.

[deleted]

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#685

Post by cryptica »

andy_ppp wrote: post #656
cryptica wrote: post #181

Earlier quoted context omitted.

My bet is that some Tweet posting API is missing a critical authentication check or the hackers found a way to bypass this check. I doubt someone could individually hack all these accounts.

I mean why can they not stop the api? Why not just switch it off for a few minutes and figure out what is happening?

They would need time to figure out which API endpoint is affected. Twitter is not going to shut down everything just because one endpoint has a possible issue.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#686

Post by celticninja »

Sebb767 wrote: post #672
css wrote: post #661

Earlier quoted context omitted.

Or someone making one last use of an exploit on the old API, since ostensibly there is a day to go before the new API is released on the public net.

This might actually explain the simple scam nature. Setting up more complex monetisation, i.e. by shorting a company, takes quite a while, especially if you don't want to be tracked. A bitcoin scam is quick and simple to do. And it's not _too_ illegal (compared to, for example, stock manipulation), so the attacker will probably catch less heat.

Stock trades are easier to trace, but both can be traced with sufficient resources.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#689

Post by davidlee1435 »

celticninja wrote: post #192
davidlee1435 wrote: post #162

Kudos to Coinbase- I tried sending a small amount to the account after seeing Elon Musk's tweet, and Coinbase prevented the transaction from occurring.

Why would you do that?

Curiosity, mostly. This was very soon after the tweet was posted, and it was less than a dollar.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#690

Post by Nextgrid »

Sebb767 wrote: post #672
css wrote: post #661

Earlier quoted context omitted.

Or someone making one last use of an exploit on the old API, since ostensibly there is a day to go before the new API is released on the public net.

This might actually explain the simple scam nature. Setting up more complex monetisation, i.e. by shorting a company, takes quite a while, especially if you don't want to be tracked. A bitcoin scam is quick and simple to do. And it's not _too_ illegal (compared to, for example, stock manipulation), so the attacker will probably catch less heat.

The advantage of cryptocurrencies is that it allows you to commit the scam anonymously easily and defers the laundering of the money for later, giving you time to devise a scheme to launder it.

Stock markets or fiat currencies on the other hand require quite a bit of work upfront to set up an account before you can trade.

Post reply on HN