Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers take over prominent Twitter accounts in simultaneous attack

coindesk.com

Post reply on HN
Print view View original

921–930 of 1001 posts

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#921

Post by lanevorockz »

BiteCode_dev wrote: post #260

Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.

There is a bit of romanticism about hacking here, things are way more boring than you would think. Likely that some process on the authentication process at twitter was broken and someone took advantage to have a laugh.

Hijacked the authentication cookies and injected into the app that skips validation for performance. Likely nobody got access to the accounts themselves but just allow them to tweet some jokes.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#922

Post by dx034 »

xvector wrote: post #586
jgbond wrote: post #541

Earlier quoted context omitted.

I’m guessing DMs were the real loot. The public display with the BTC diversion validates any DMs that were stolen. Otherwise blackmail targets could deny them.

These are publicly managed Twitter accounts, they probably don't have any DMs of substance.

Is Musks account really publicly managed? He probably has an agency helping him but I doubt he'd use another account for DMs.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#923

Post by dx034 »

reilly3000 wrote: post #631
jgbond wrote: post #541

Earlier quoted context omitted.

I’m guessing DMs were the real loot. The public display with the BTC diversion validates any DMs that were stolen. Otherwise blackmail targets could deny them.

I think that's the case. No prominent Republicans were targeted. See: Watergate, Wikileaks DNC emails. Same shit.

Or they were but it was kept secret. Twitter hasn't published a list, we only know of the BTC tweets. Maybe they actually were after other accounts' DMs and the tweets are just diversion to make it seem like an undirected attack.

Unless we hear from account holders that their credentials weren't stolen, there's no reason to believe that only those were hacked that sent tweets.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#924

Post by dx034 »

cj wrote: post #569
jgbond wrote: post #541

Earlier quoted context omitted.

I’m guessing DMs were the real loot. The public display with the BTC diversion validates any DMs that were stolen. Otherwise blackmail targets could deny them.

If DMs were the real loot, they wouldn’t have exposed the hack by tweeting on the account.

They needed to reset credentials so this could've never been a stealth attack. By making it public, any later leak of DMs is much more likely to be accepted as authentic. Without that, most people would've doubted the authenticity of leaked material.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#925

Post by swarnie_ »

maxcan wrote: post #83
iamben wrote: post #7

Elon Musk as well. Tweets still up, saying "Feeling greatful, doubling all payments sent to my BTC address! You send $1,000, I send back $2,000! Only doing this for the next 30 minutes." As of now, 121 people have sent cash totally more than 2.5BTC. Edit: Just seen @BillGates compromised as well, same bitcoin account. Edit 2: Elon's tweet seems to be getting removed, and then reposted again shortly after. About $40k…

Honestly, we should be relieved if thats all that was stolen. A more sophisticated attack would involve OTM puts on TSLA and a tweet along the lines of: "finding major defects in Ys and 3s. shutting down all lines to reconfigure for a week" That could have netted the attackers millions.

Sounds like "committing suicide" in a US super max with extra steps.

Golden rule is you don't steal money from rich people, only poors.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#926

Post by kzrdude »

baxtr wrote: post #356
DevX101 wrote: post #316

Twitter should suspend the entire platform until they can credibly fix this and prevent it in the future. An attacker could drop AMZN stock by 10% in minutes with just the wrong tweet from Bezos.

Even worse? How about POTUS declares war on China thru twitter? OMG, I just realized how dumb that would have been to say back in 2016. But these days?

You would be surprised. Of course it would be a disruptive tweet, but it would not be a credible threat of war, in reality.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#927

Post by buzzerbetrayed »

aazaa wrote: post #673
davidlee1435 wrote: post #162

Kudos to Coinbase- I tried sending a small amount to the account after seeing Elon Musk's tweet, and Coinbase prevented the transaction from occurring.

In time you may come to view this as a bug, not a feature.

This is exactly what I was thinking. This has made me lose a lot of faith in crypto, not that I had a ton of faith to begin with. But I keep hearing people talk about blacklisting addresses and blocking transactions. That's scary stuff. How can people ever feel comfortable storing large amounts of money in crypto if the big players can simply block their address and make it near impossible to liquidize their money? I feel like this incident is showing Bitcoin's (at least what Bitcoin has grown to become) true colors.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#928

Post by cookiengineer »

BiteCode_dev wrote: post #260

Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstration to a big client - a first shot to threat some entity - a diversion while they get the real loot And that the BTC messages are just a way to justify it so it looks like a simple scam. Such a hack is worth way, WAY more than the few BTC it could bring.

In any case this is the perfect example why 2FA via ss7 is the worst idea any developer ever had.

I mean, to take over your account I just have to grab an old motorola phone and let an imsi catcher software run on it.

I hope that twitter learned that 2FA via SMS should be treated as what it is: totally unnecessary.

Re: Hackers take over prominent Twitter accounts in simultaneous attack

#930

Post by jansan »

actuator wrote: post #343
tass wrote: post #117

Bezos now, too! https://twitter.com/JeffBezos/status/1283508547897171969

On a light note: https://twitter.com/lendamico/status/1283510105170948096

Bezos is probably a great guy to hang out with, but do not expect him do boy you a beer :)
Post reply on HN