6 ms·
Place your bets, phishing or bug exploit. Some of these targets are too high profile to all fall for it and probably have teams that manage these accounts secur
by shiado 6y ago
Place your bets, phishing or bug exploit. Some of these targets are too high profile to all fall for it and probably have teams that manage these accounts securely. Edit: 2fa was bypassed, interesting. https://twitter.com/tylerwinklevoss/status/1283492017889259523 https://twitter.com/tylerwinklevoss/status/12834920178892595...
- dx87 6y agoSounds like an exploit. The article says that some of the accounts were confirmed to have multi-factor authentication enabled.
- justinmeiners 6y ago> multi-factor authentication enabled It sure seems like multi-factor auth isn't very helpful, when nearly all hacks have nothing to do with breaking credentials.
- Latty 6y ago> when nearly all hacks have nothing to do with breaking credentials. This seems like a big claim to make. My understanding is that by far the most common reason accounts are compromised is password reuse combined with another site being compromised.
- justinmeiners 6y agoSure, I guess that is a wrong assumption on my part. Perhaps a better way to word it, is: two factor auth only seems to protect you if all the other parts of site authentication are solid, which rarely seems to be true.
- nrmitchi 6y agoWell of course if you exclude all of the attacks that didn't happen because 2fa was enabled, then ya, 2fa won't protect you against the ones that still happen. Lets compare this to.... car safety. Ya, if you get hit head on by an 18-wheeler on the highway, your seatbelt is only going to help you as much as the rest of the safety of the car. But in pretty much every other situation, I would be glad to be wearing my seatbelt. It's uncharitable to focus on the small slice of situations that something doesn't work in order to deem it useless.
- artursapek 6y agoActually, that proves that it is helpful.
- justinmeiners 6y agoHow so?
- nathancahill 6y agoReminds me of the iCloud phishing hack, a lot of high profile celebrities were hacked that time.
- Tenoke 6y agoThe leaked credentials of an employee at a tweet scheduling service theory sounds more plausible to me on the face of it.
- hiimtroymclure 6y agobug exploit or some kind of inside access
- lazyjones 6y agoBetting on inside / direct database access or admin account.
- nonbirithm 6y agoWell then we're royally fucked if all it takes is a single rogue admin at this single, societally ubiquitous company to expose everything and let people fire off false declarations of war on each other or short TSLA and additionally make the entire concept of 2FA meaningless. This was exactly what 2FA was supposed to prevent, and if this is to be believed then because of Twitter's implementation it was all worth peanuts in the end. There are just too many eyes on Twitter for their administration to let this happen. Twitter has grown into too big and too valuable of a target at this point, and the moment this happens you can't prevent dumb people from falling for it thirty seconds after it gets posted and starts showing up in their feed. Then why was it even possible to do this from the inside? What employee access controls did they have on administrative accounts? I'm thinking they're going to need to dig an underground bunker and have everyone be in the presence of at least three other certified minders when a group of two dozen people at a tech startup are the last bastion of hope in preventing the disruption of global communications.
- hn_throwaway_99 6y agoYou seem to be greatly overestimating the level of security at most internet companies. I suspect most companies, even some of the huge tech giants, would be susceptible to a sufficiently privileged rogue admin. Heck, the entire NSA had huge amounts of their most sensitive data accessed by a rogue admin contractor.
- nonbirithm 6y agoI wasn't exactly thinking Twitter was perfectly or at least very secure. It just kind of blows my mind at the thought that they might not have considered that that kind of scenario was possible or the chance of it happening was so remote that... it ended up happening. Maybe I just didn't want to worry about it seeing as Twitter provides me with some sort of value and did end up overestimating their level of preparedness and such. I guess continuing to use Twitter anyways means being exposed to that risk at some point down the line.
- atwebb 6y agoGoing differently, an internal API for managing accounts was exposed externally or not authorized correctly.
- redisman 6y agoWay too many high profile accounts for phishing