Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers take over prominent Twitter accounts in simultaneous attack

coindesk.com

Post reply on HN
Print view View original

881–890 of 1001 posts

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#881

Post by kabacha »

IMAYousaf wrote: post #863

I have a question to ask you all. If I wanted to study things to get to the point where internally/externally I could coordinate a hack of this magnitude, what things do I need to study? What are the technical things needed to pull something like this off? What are the social corporate things I needed to know to pull this off? I know that we don't have specifics, but I'm asking as a pure academic exercise how much I'…

Unfortunately majority of big breaches like this are a result of social hacking rather than some computer science magic. However to answer your question of how much you'd actually need to know? Decent networking and system understanding as well as how to apply this knowledge in reverse engineering. Finally you need loads of luck. Most of penetration testing is just throwing existing things at the system and generally looking around for flaws and if you're lucky you might just stumble on something valuable.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#883

Post by anonu »

zelly wrote: post #767
blisseyGo wrote: post #634

Tweet from TwitterDev team yesterday: https://twitter.com/TwitterDev/status/1283068902331817990 > 2 days to go… #TwitterAPI https://twitter.com/TwitterDev/status/1283433096780677122 > Thank you to all of you who have engaged with us and shared your feedback. Your input has been vital, and we’re committed to continuing these conversations with you. There’s so much more we’re doing to build a better #TwitterAPI… and Ea…

It looks like someone found a 0-day in the new API and wanted to use it before others did. Probably didn't help that the bug bounty for this would have been only 7k. How much does the Twitter employee who implemented this bug get paid? https://twitter.com/LiveOverflow/status/1283511782380908545

We now know it wasn't a 0 day. It was socially engineered access to internal tools. That's still a tricky one to lockdown.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#885

Post by perryizgr8 »

donohoe wrote: post #331
jaxxstorm wrote: post #251

I'm flabbergasted they haven't just hit the panic button and shut everything down. Unless, perhaps, they can't.

Exactly. Just like AT&T and Verizon often shutdown the telephone system when its being abused.

ATT and Verizon also don't block users for speaking something that goes against their CEO's politics.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#886

Post by perryizgr8 »

stefan_ wrote: post #139
tass wrote: post #125

Earlier quoted context omitted.

Searching for the bitcoin address in twitter gives an absolute ton of results. Are all these accounts hacked, or are people now posting just to joke around?

Love how they don't just ban the bitcoin address. Firehose big data my ass. No one at home at Twitter.

> No one at home at Twitter.

Or maybe everyone at home?

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#887

Post by tjomk »

blisseyGo wrote: post #874
Nextgrid wrote: post #827

Initial postmortem: https://twitter.com/TwitterSupport/status/128359184496275046... Seems to be a social-engineering attack on Twitter staff.

Very strange. Why exactly is it possible for any employee to tweet as any user? Unless the person who was targeted was the Database admin himself or something. Even then, how tech illiterate is this employee with such high permissions to fall for a social engineering attack? I would like to know what this employee's role was in the company. Also who did the social engineering?

Well, it's actually not that hard to fall for social engineering even if you're well educated about the topic. Have a listen to an interview Christopher Hadnagy gave on Darknet Diaries.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#888

Post by perryizgr8 »

puranjay wrote: post #182
caiobegotti wrote: post #172

I'm honestly surprised that Twitter doesn't have some sort of circuit breaking for such gigantic attack towards major accounts. It's a PR nightmare that a circuit breaker would help a bit with, no?

Considering that Twitter has taken a decade and not managed to create a functional web media player, something like a circuit breaker is probably low on their priority list.

I still haven't figured out the correct way to watch a video on twitter. I always have to mess around with the mute button, seek back to start of video, etc.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#889

Post by WillPostForFood »

feydaykyn wrote: post #846
BiteCode_dev wrote: post #260

Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.

What about Donald Trump wanting to shame the company which prevented him to tweet? Is it too far fetched?

Real estate developer by day, elite hacker at night?
Post reply on HN