Earlier quoted context omitted.
You're overestimating the intelligence of the typical scammer.
They're not a scammer. They're a massive multimedia conglomerate hacker.
Nah, 14yr old in the basement who stumbled upon this.
Hackers take over prominent Twitter accounts in simultaneous attack
841–850 of 1001 posts
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#842Earlier quoted context omitted.
I wonder if they have access to the accounts’ DMs too. Lots of juicy info potentially there.
I’m seeing a lot of discussion of the DMs being the real target, but executives and politicians usually have staff who monitor and post to their social media channels. Hard to imagine Barack Obama communicating anything of blackmail value over a channel that a mid-level social media manager has the password to.
No, but you could blackmail a social media manager to further your cause by planting a bug in the office, for example.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#843Re: Hackers take over prominent Twitter accounts in simultaneous attack
#844I was thinking the other day about a digital signature for limited character tweets. Provided I’m not a cryptography expert and you should explore my ideas with caution, why not even just sign every tweet with an ed25519 signature? It’s on 64 bytes tacked onto the message and easy to verify...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
hi hacker news -----BEGIN PGP SIGNATURE-----
iIIEARYKACoWIQSiJQKEVJeJondn78BXE/NAGxPd0QUCXw/JqwwcZm9vQGJhci5j b20ACgkQVxPzQBsT3dGf1gEAwMzbCxEaEJzRjJwFe90TRrXZiIe4KD9cZ64CHZEz eKEA/3W0ZIx6TOASPrzuTLytBK8OsL9FFAVWMUGTyLJSSh8O =ORB6 -----END PGP SIGNATURE-----
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#845Earlier quoted context omitted.
It could just be a relatively unsophisticated actor who stumbled upon a serious vulnerability and didn't know enough to market it to, eg, a state actor or whatever.
Occam's razor says this is almost certainly the case. It isn't like the hacker knew that it would generate such little bitcoin being sent their way until after it failed. Especially if the hacker is not from the US it seems much easier to do the bitcoin hack than try to contact a company thousands of miles away that you know one at.
The theory that I think is most probable is that someone got access to the hack, either by purchase or stumbling upon it, they tested it out and had a "holy shit this actually works" moment.
After this they became paranoid of the bug being fixed within hours and tried to monetise it in the quickest, easiest and safest way possible.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#846Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.
What about Donald Trump wanting to shame the company which prevented him to tweet? Is it too far fetched?
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#847I was thinking the other day about a digital signature for limited character tweets. Provided I’m not a cryptography expert and you should explore my ideas with caution, why not even just sign every tweet with an ed25519 signature? It’s on 64 bytes tacked onto the message and easy to verify...
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hi hacker news -----BEGIN PGP SIGNATURE----- iIIEARYKACoWIQSiJQKEVJeJondn78BXE/NAGxPd0QUCXw/JqwwcZm9vQGJhci5j b20ACgkQVxPzQBsT3dGf1gEAwMzbCxEaEJzRjJwFe90TRrXZiIe4KD9cZ64CHZEz eKEA/3W0ZIx6TOASPrzuTLytBK8OsL9FFAVWMUGTyLJSSh8O =ORB6 -----END PGP SIGNATURE-----
pubkey: https://gist.github.com/rudolph9/bd672dc6d50a51a7d3f5352a918...
A little more cumbersome than I imagined but proves that the contents of a tweet can contain a message and a digital signature.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#848Earlier quoted context omitted.
I’m guessing DMs were the real loot. The public display with the BTC diversion validates any DMs that were stolen. Otherwise blackmail targets could deny them.
These are publicly managed Twitter accounts, they probably don't have any DMs of substance.
They potentially had access to any account they wanted. You don't know that they weren't snarfing DMs on interesting accounts while having the celeb accounts panhandle for bitcoin after.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#849Okay here is my mostly baseless conspiracy theory:
As many others have noted, access to the compromised accounts is worth several orders of magnitude more money than the hackers were able to extract using this naive bitcoin scam. Whether it's used to manipulate markets or just resold, the hack is probably worth millions or tens of millions. Is it plausible that hackers who could coordinate and execute this kind of a breach would not know how to maximize the value of the hack and would instead opt for a really naive and not especially lucrative BTC scam?
It is also pretty common knowledge that the activist investor hedge fund Elliott Management has wanted Jack Dorsey removed as Twitter's CEO for quite some time. What if the BTC scam is a cover for corporate espionage? What if the purpose of the hack was actually to make Dorsey look incompetent in the most public way possible, and possibly turn many influential public figures against Twitter? Elliott Management has the resources to finance a breach like this as well as the motive.
An alternate theory would be that this actually was a form of market manipulation -- manipulation of Twitter's share price.
Re: Hackers take over prominent Twitter accounts in simultaneous attack
#850Just what kind of an operation is Twitter running here? It seems crazy that they don't have any kind of anti-abuse system in place that could just block tweets with this specific Bitcoin address or possibly tweets matching the regexp of any Bitcoin address. I.e. limit the damage and buy a couple of hours while they try to find the root cause. (Yes, yes, staged rollouts. But anti-abuse systems don't work by those rule…
I can't count the number of times people have asked here "How can Twitter possibly employ 4,000+ employees?". Well, I suppose we've learned 4K isn't even enough for good anti-abuse systems.
Um why not enough and not too much? This alone doesn't say anything in regard to twitter's user count.
This means twitter had omni backend tooling that have manual/programmatic admin level access to production database.
This is a very bad idea, access to production tables should be through a controlled medium and always challenged.