6 ms·

Twitter accounts are being hijacked for spam

152 points by edent 7y ago

CheckBlanket 7y ago
The images are of type .webp which may fail to load in Safari (at least for me), maybe have them in a more accessible format?
- edent 7y ago
  My server is designed to serve webp only to devices which accept them. So Safari should show jpg / png. Obviously, if you load the image directly, it'll still be webp.
  - scrollaway 7y ago
    How do you do it? Looking at the code, it doesn't seem to be based on the Accept headers or on figure/imageset tricks. UA sniffing?
    - edent 7y ago
      I'm using LiteSpeed Cache Management plugin for WordPress. It has fiddled my .htaccess to RewriteCond %{HTTP_ACCEPT} "image/webp" [or] RewriteCond %{HTTP_USER_AGENT} "Page Speed" RewriteRule .* - [E=Cache-Control:vary=%{ENV:LSCACHE_VARY_VALUE}+webp] But... now I think about it, I probably still have CloudFlare cacheing on. Which means that won't get hit some of the time. Hmmmm.... Let's see if my server can survive HN without a CDN.
      - nitrogen 7y ago
        You should be able to send a Vary: Accept header to the cache to have it cache all image types.
        judge2020 7y ago
        If CF is caching, this won't work. https://support.cloudflare.com/hc/en-us/articles/217343117-What-headers-can-I-vary-the-cache-on- https://support.cloudflare.com/hc/en-us/articles/217343117-W...
- joshu 7y ago
  fails on mobile safari too
beager 7y ago
One thing which I didn’t see clarified here was the deceptive CNN domain. Either the preview card can be exploited to spoof CNN (bad on twitter) or CNN.com has an open redirect (bad on CNN).
- akersten 7y ago
  The malicious webserver is probably redirecting the Twitter crawler based on its user-agent to CNN, and Twitter's redirect-busting is helpfully pulling in the "final" destination.
- edent 7y ago
  The preview card can be exploited by Twitter. Visit https://cards-dev.twitter.com/validator https://cards-dev.twitter.com/validator and paste in the spam URL there. You'll see that the validator warns that it is being redirected, but follows it anyway. CNN is blameless (as far as I can tell).
  - beager 7y ago
    So the exploit is fake site -> user-agent specific redirector -> CNN. That would clear CNN. I’m thinking through how Twitter would combat something like this. IMO they would flag new domains for manual approval (or hey, require TFA for self-serve ad accounts!) but both of these add to the cost and friction of their adtech. Always a bummer when good security practice gets overruled by the need to squeeze every cent of revenue they can.
    - leeoniya 7y ago
      > I’m thinking through how Twitter would combat something like this. twitter's bot can pull the link via Tor with a randomized UA
      - rubyfan 7y ago
        Can’t you just time the redirect so that when you create the card you point to CNN then change the redirect to something malicious afterward?
swombat 7y ago
Someone has to say it... the vast majority of twitter accounts are broadcasting spam already. No need to highjack them...
Sephr 7y ago
This vulnerability is an intentional "feature" in Bing, Google, and Twitter. 1. https://twitter.com/sephr/status/1056626456770428929 https://twitter.com/sephr/status/1056626456770428929 2. https://twitter.com/sephr/status/1055751684146655232 https://twitter.com/sephr/status/1055751684146655232
simonebrunozzi 7y ago
Something similar happened to me on May 23rd, 2019 (three days ago) [0], where I ended up losing my Twitter account. Essentially, my t-mobile mobile phone number was hijacked (despite I had a PIN, which the attacker didn't need - poor security practice by t-mobile), and after that they proceed to change the password of my Twitter account using the phone. Thankfully I was close to a t-mobile shop in San Francisco, and ~40 minutes later I regained control of my SIM card. Nothing else has been affected so far. FYI, T-mobile can't be sued for damage resulting from something like this. We have to "thank" judge Scalia for this. As of now, Twitter is slowly responding to my issue, despite I had a few friends there try to help. [0]: https://news.ycombinator.com/item?id=19998553 https://news.ycombinator.com/item?id=19998553
- mieseratte 7y ago
  > We have to "thank" judge Scalia for this. Thank your legislature, not your judiciary.
Zelphyr 7y ago
I had two accounts (done because at the time I didn’t realize you could change your account handle); one I rarely used and one I used daily. I went to log in to the rarely used one and the password didn’t work nor did recovery. It had been hacked. Nothing I did could get it back and Twitter just shrugged and said sucks to be me. So I cancelled the daily use one. Not just because of that mind you. Twitter has become a cesspool anymore and I realized it was making me unhappy more than it was contributing to my life. If, by some miracle I manage to get the other account back I’ll cancel it too.
- noitsnot 7y ago
  Maybe I'm doing it wrong, but I don't have time to find and filter out decent followers. I signed up back in 2005 and couldn't tell you when it wasn't a cesspool for awful posts and comments.
  - EForEndeavour 7y ago
    It depends on how you use Twitter. Using it to keep up with politics or news can quickly lead you to some of the most highly concentrated cesspools of humanity's worst thoughts. There will be abject ignorance or just plain noise among the top replies to pretty much any tweet by The Economist, the New York Times, Barack Obama (actually any politician), ... However, I've found it healthy and helpful to tap into active communities built around certain computer science topics, like machine learning, or "ML Twitter."
  - tomjakubowski 7y ago
    Twitter didn't launch until 2006, I thought. —an '07
    - noitsnot 7y ago
      You're right. I verified what my profile displays, so I can correct my signup date as 2008. 10+ years isn't too shabby, though.
- OrgNet 7y ago
paulpauper 7y ago
It's not that twitter is not doing anything , but that scamming people out of crpyo currency and money is very lucrative owing to human gullibility and the viralness of the twitter platform, so scammers have an incentive to keep finding loopholes after twitter closes existing ones. And most scmamers fail to bypass twitter security measures, so all you're seeing the ones who succeeded. if 90 scammer fail and 10 find a loophole, then those 10 will proliferate until twitter fixes it again. It's sorta like a virus that acquires drug persistence.
paul7986 7y ago
I had a twitter account from 2007 to 2016; enjoyed using it. Though the email attached to it I lost access to and Twitter doesn't care to help you get your account back. I haven't used Twitter since!
- toephu2 7y ago
  To be fair, how could they if you lost access to the only verifiable point of contact associated with your Twitter account?
tacosx 7y ago
21 years ago was the first time I saw malware delivered over advertising on the web. 1998. I started blocking ads by manually managing my hosts file that day, for the most part I haven't look at ads since. I'm still not sure why we're now basing our entire economy around advertising crap to people that they don't want or need, the web was ad free and worked great for many years before all this nonsense. The fact that most all of the smart people in tech have been subsumed into ad tech is one of the most depressing things I could have possibly imagined 21 years ago. What a massive misuse of resources.
- EForEndeavour 7y ago
  Relevant comic: https://i.redd.it/lm4pvrl6q5q01.jpg https://i.redd.it/lm4pvrl6q5q01.jpg Found via https://www.reddit.com/r/ProgrammerHumor/comments/8a3oku/brain_drain/ https://www.reddit.com/r/ProgrammerHumor/comments/8a3oku/bra...
  - larrybeck 7y ago
    Too funny, but sooo TRUE!! What has the world come to, or better yet, what have we allowed?
- sandworm101 7y ago
  The people seeing the adds aren't the consumer, they are the commodity. The value of an ad isn't just in selling a product. Ad networks are great at collecting behavioral data. That data is quickly becoming more valuable than the products in the ads. If I click on an ad for funeral services I might buy something but probably won't. But I may have just confirmed that a close relative just died. That factoid is worth something to a great many people beyond the local funeral parlor who paid for the ad. I should expect real estate agents and quack financial advisers to be knocking on my door by the end of the day.
- Thorrez 7y ago
  >I'm still not sure why we're now basing our entire economy around advertising I see 3 models for websites: completely donation based, advertising based, or subscription based. Many sites would have trouble getting the donations they would need to operate. Subscription based means only rich people can afford to use it. Advertising means poor people get the same functionality as rich people.
hombre_fatal 7y ago
It's a good reminder that you can't just build the registration and on-boarding processes to filter out spammers. You have to ensure that the damage is limited and reversible even if your trusted users (or worse, staff) are hacked or turn malicious. Though this system is usually harder to build and generalize.
anonymous5133 7y ago
The big problem here is that people create accounts on multiple sites and then reuse the username/passwords on many sites. Then, one of the sites gets hacked, the database gets leaked with unencrypted passwords. Eventually this database gets passed around the internet for anyone to use. Now people simply go down the list trying to log in with these username/password combos on every site.
amingilani 7y ago
The guy whose tweets are being used as examples is still hacked and while this discussion is going on has no idea how to fix his account. The author could've used screenshots, but he wanted to use a live example, so instead of giving the non-technical person a straight link to ads.twitter.com, he just told him he'd written an article on the problem [0] [0]: https://twitter.com/Fishblogger/status/1132737507827834885?s=19 https://twitter.com/Fishblogger/status/1132737507827834885?s...
alfiedotwtf 7y ago
My account has been suspended in the past 2 weeks. Having gone through their support page a few times, I have yet to receive an email about the reasoning. I'll be setting up a Mastodon machine soon, deleting my Twitter account, and making sure that my posts are forever owned by myself and my online voice can't ever be taken away from me again.

152 points by edent 7y ago

The images are of type .webp which may fail to load in Safari (at least for me), maybe have them in a more accessible format?

edent 7y ago
My server is designed to serve webp only to devices which accept them. So Safari should show jpg / png. Obviously, if you load the image directly, it'll still be webp.
- scrollaway 7y ago
  How do you do it? Looking at the code, it doesn't seem to be based on the Accept headers or on figure/imageset tricks. UA sniffing?
  - edent 7y ago
    I'm using LiteSpeed Cache Management plugin for WordPress. It has fiddled my .htaccess to RewriteCond %{HTTP_ACCEPT} "image/webp" [or] RewriteCond %{HTTP_USER_AGENT} "Page Speed" RewriteRule .* - [E=Cache-Control:vary=%{ENV:LSCACHE_VARY_VALUE}+webp] But... now I think about it, I probably still have CloudFlare cacheing on. Which means that won't get hit some of the time. Hmmmm.... Let's see if my server can survive HN without a CDN.
    - nitrogen 7y ago
      You should be able to send a Vary: Accept header to the cache to have it cache all image types.
      - judge2020 7y ago
        If CF is caching, this won't work. https://support.cloudflare.com/hc/en-us/articles/217343117-What-headers-can-I-vary-the-cache-on- https://support.cloudflare.com/hc/en-us/articles/217343117-W...
joshu 7y ago
fails on mobile safari too

beager 7y ago

One thing which I didn’t see clarified here was the deceptive CNN domain. Either the preview card can be exploited to spoof CNN (bad on twitter) or CNN.com has an open redirect (bad on CNN).

akersten 7y ago
The malicious webserver is probably redirecting the Twitter crawler based on its user-agent to CNN, and Twitter's redirect-busting is helpfully pulling in the "final" destination.
edent 7y ago
The preview card can be exploited by Twitter. Visit https://cards-dev.twitter.com/validator https://cards-dev.twitter.com/validator and paste in the spam URL there. You'll see that the validator warns that it is being redirected, but follows it anyway. CNN is blameless (as far as I can tell).
- beager 7y ago
  So the exploit is fake site -> user-agent specific redirector -> CNN. That would clear CNN. I’m thinking through how Twitter would combat something like this. IMO they would flag new domains for manual approval (or hey, require TFA for self-serve ad accounts!) but both of these add to the cost and friction of their adtech. Always a bummer when good security practice gets overruled by the need to squeeze every cent of revenue they can.
  - leeoniya 7y ago
    > I’m thinking through how Twitter would combat something like this. twitter's bot can pull the link via Tor with a randomized UA
    - rubyfan 7y ago
      Can’t you just time the redirect so that when you create the card you point to CNN then change the redirect to something malicious afterward?

swombat 7y ago

Someone has to say it... the vast majority of twitter accounts are broadcasting spam already. No need to highjack them...

Sephr 7y ago

This vulnerability is an intentional "feature" in Bing, Google, and Twitter. 1. https://twitter.com/sephr/status/1056626456770428929 https://twitter.com/sephr/status/1056626456770428929 2. https://twitter.com/sephr/status/1055751684146655232 https://twitter.com/sephr/status/1055751684146655232

simonebrunozzi 7y ago

Something similar happened to me on May 23rd, 2019 (three days ago) [0], where I ended up losing my Twitter account. Essentially, my t-mobile mobile phone number was hijacked (despite I had a PIN, which the attacker didn't need - poor security practice by t-mobile), and after that they proceed to change the password of my Twitter account using the phone. Thankfully I was close to a t-mobile shop in San Francisco, and ~40 minutes later I regained control of my SIM card. Nothing else has been affected so far. FYI, T-mobile can't be sued for damage resulting from something like this. We have to "thank" judge Scalia for this. As of now, Twitter is slowly responding to my issue, despite I had a few friends there try to help. [0]: https://news.ycombinator.com/item?id=19998553 https://news.ycombinator.com/item?id=19998553

mieseratte 7y ago
> We have to "thank" judge Scalia for this. Thank your legislature, not your judiciary.

Zelphyr 7y ago

I had two accounts (done because at the time I didn’t realize you could change your account handle); one I rarely used and one I used daily. I went to log in to the rarely used one and the password didn’t work nor did recovery. It had been hacked. Nothing I did could get it back and Twitter just shrugged and said sucks to be me. So I cancelled the daily use one. Not just because of that mind you. Twitter has become a cesspool anymore and I realized it was making me unhappy more than it was contributing to my life. If, by some miracle I manage to get the other account back I’ll cancel it too.

noitsnot 7y ago
Maybe I'm doing it wrong, but I don't have time to find and filter out decent followers. I signed up back in 2005 and couldn't tell you when it wasn't a cesspool for awful posts and comments.
- EForEndeavour 7y ago
  It depends on how you use Twitter. Using it to keep up with politics or news can quickly lead you to some of the most highly concentrated cesspools of humanity's worst thoughts. There will be abject ignorance or just plain noise among the top replies to pretty much any tweet by The Economist, the New York Times, Barack Obama (actually any politician), ... However, I've found it healthy and helpful to tap into active communities built around certain computer science topics, like machine learning, or "ML Twitter."
- tomjakubowski 7y ago
  Twitter didn't launch until 2006, I thought. —an '07
  - noitsnot 7y ago
    You're right. I verified what my profile displays, so I can correct my signup date as 2008. 10+ years isn't too shabby, though.
OrgNet 7y ago

paulpauper 7y ago

It's not that twitter is not doing anything , but that scamming people out of crpyo currency and money is very lucrative owing to human gullibility and the viralness of the twitter platform, so scammers have an incentive to keep finding loopholes after twitter closes existing ones. And most scmamers fail to bypass twitter security measures, so all you're seeing the ones who succeeded. if 90 scammer fail and 10 find a loophole, then those 10 will proliferate until twitter fixes it again. It's sorta like a virus that acquires drug persistence.

paul7986 7y ago

I had a twitter account from 2007 to 2016; enjoyed using it. Though the email attached to it I lost access to and Twitter doesn't care to help you get your account back. I haven't used Twitter since!

toephu2 7y ago
To be fair, how could they if you lost access to the only verifiable point of contact associated with your Twitter account?

tacosx 7y ago

21 years ago was the first time I saw malware delivered over advertising on the web. 1998. I started blocking ads by manually managing my hosts file that day, for the most part I haven't look at ads since. I'm still not sure why we're now basing our entire economy around advertising crap to people that they don't want or need, the web was ad free and worked great for many years before all this nonsense. The fact that most all of the smart people in tech have been subsumed into ad tech is one of the most depressing things I could have possibly imagined 21 years ago. What a massive misuse of resources.

EForEndeavour 7y ago
Relevant comic: https://i.redd.it/lm4pvrl6q5q01.jpg https://i.redd.it/lm4pvrl6q5q01.jpg Found via https://www.reddit.com/r/ProgrammerHumor/comments/8a3oku/brain_drain/ https://www.reddit.com/r/ProgrammerHumor/comments/8a3oku/bra...
- larrybeck 7y ago
  Too funny, but sooo TRUE!! What has the world come to, or better yet, what have we allowed?
sandworm101 7y ago
The people seeing the adds aren't the consumer, they are the commodity. The value of an ad isn't just in selling a product. Ad networks are great at collecting behavioral data. That data is quickly becoming more valuable than the products in the ads. If I click on an ad for funeral services I might buy something but probably won't. But I may have just confirmed that a close relative just died. That factoid is worth something to a great many people beyond the local funeral parlor who paid for the ad. I should expect real estate agents and quack financial advisers to be knocking on my door by the end of the day.
Thorrez 7y ago
>I'm still not sure why we're now basing our entire economy around advertising I see 3 models for websites: completely donation based, advertising based, or subscription based. Many sites would have trouble getting the donations they would need to operate. Subscription based means only rich people can afford to use it. Advertising means poor people get the same functionality as rich people.

hombre_fatal 7y ago

It's a good reminder that you can't just build the registration and on-boarding processes to filter out spammers. You have to ensure that the damage is limited and reversible even if your trusted users (or worse, staff) are hacked or turn malicious. Though this system is usually harder to build and generalize.

anonymous5133 7y ago

The big problem here is that people create accounts on multiple sites and then reuse the username/passwords on many sites. Then, one of the sites gets hacked, the database gets leaked with unencrypted passwords. Eventually this database gets passed around the internet for anyone to use. Now people simply go down the list trying to log in with these username/password combos on every site.

amingilani 7y ago

The guy whose tweets are being used as examples is still hacked and while this discussion is going on has no idea how to fix his account. The author could've used screenshots, but he wanted to use a live example, so instead of giving the non-technical person a straight link to ads.twitter.com, he just told him he'd written an article on the problem [0] [0]: https://twitter.com/Fishblogger/status/1132737507827834885?s=19 https://twitter.com/Fishblogger/status/1132737507827834885?s...

alfiedotwtf 7y ago

My account has been suspended in the past 2 weeks. Having gone through their support page a few times, I have yet to receive an email about the reasoning. I'll be setting up a Mastodon machine soon, deleting my Twitter account, and making sure that my posts are forever owned by myself and my online voice can't ever be taken away from me again.