[deleted]
Hackers take over prominent Twitter accounts in simultaneous attack
771–780 of 1001 posts
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#772Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.
It could just be a relatively unsophisticated actor who stumbled upon a serious vulnerability and didn't know enough to market it to, eg, a state actor or whatever.
What would a state actor do with this? Read celebrities' DMs?
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#773Watch this turns out to be a JS dependency tree problem from some library that was compromised months ago in some NPM module, used in the twitter web interface.
Doubtful: It is well documented that Twitter has re-written many parts of the FE/BE framework, so I think it likely that their NIH attitude might be a benefit.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#774[deleted]
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#775Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.
The BTC is adding up to many millions so far. I'd say it's worth it by itself.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#776[deleted]
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#777Verified Twitter user here: Locks [1] are in place, attempting to tweet throws an error: Something went wrong, but don't fret -- let's give it another shot. At the bottom of the page, a notification appears: This request looks like it might be automated. To protect our users from spam and other malicious activity, we can't complete this action right now. Please try again later. [1] https://twitter.com/TwitterSupport/…
Update: Can tweet again, locks have been removed [1].
[1] https://twitter.com/TwitterSupport/status/128356244619659673...
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#778Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.
Nope. They're actually getting away with quite a big loot! The number of unconfirmed transactions has catapulted from ~9k to about ~50k right now, which means there's large amount of activity. It will take a while for the dust to settle. You can watch them here https://www.blockchain.com/btc/unconfirmed-transactions chart https://www.blockchain.com/charts/mempool-count A better graph of the current transactions sitti…
I'm a little unclear, is the following correct?.
So basically rando's are sending famous people bitcoin because the famous people tweeted "send us $$ and we'll send you double back"?
And somehow the rando's haven't heard of the hack. Is this what's happening? Like are random people seriously sending them bitcoin? Or is it some weird form of money laundering?
Although since that's very weird behavior even if there was no hack, I suppose I'm not too surprised that those people sending the coin haven't heard of the hack.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#779I was thinking the other day about a digital signature for limited character tweets. Provided I’m not a cryptography expert and you should explore my ideas with caution, why not even just sign every tweet with an ed25519 signature? It’s on 64 bytes tacked onto the message and easy to verify...
How do you plan on managing the signing keys?
Hardware security module
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#780With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it. Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!
boy I sure hope we get a juicy post mortem, this is quite a scam
Twitter hasn't released postmortems for other incidents, so I wouldn't hold out hope