28 ms·
Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either: - a test of a new hacking system - a demonstr
by BiteCode_dev 6y ago
Given how huge this hack is, and how little the BTC reward is going to be, I'm tempting to think this is either:
- a test of a new hacking system
- a demonstration to a big client
- a first shot to threat some entity
- a diversion while they get the real loot
And that the BTC messages are just a way to justify it so it looks like a simple scam.
Such a hack is worth way, WAY more than the few BTC it could bring.
- quonn 6y agoIt can‘t really be the first three, because Twitter will fix this problem soon. So it would be wasting the exploit. It‘s either incompetence or your fourth option.
- epanchin 6y agoI read about this in the news before I saw it in my Twitter feed. My trust in Twitter has dropped severely. Why weren’t these tweets deleted immediately and a note pinned to every users feed?
- CamperBob2 6y agoArguably it was irresponsible of Twitter not to pull the plug on the servers at the first hint of an exploit at this scale. When you literally have no idea what's going on, job #1 is to keep it from getting worse.
- jonny_eh 6y agoOr a distraction while a bigger hack is going on?
- woeirua 6y agoBingo, they're probably walking away with all of Twitter's internal data as we speak...
- rainyMammoth 6y agoAll the DMs would definitely be valuable.
- woeirua 6y agoThat's definitely one way you could blackmail people for more BTC, or unmasking various prominent anonymous accounts... Lots of way to use that info to make serious money on the darkweb.
- codesternews 6y agoWhy anyone take such a big risk when they could play with stocks with one account.
- rainyMammoth 6y agoYou can easily trace stock trades.
- MattGaiser 6y agoGo ahead.... try to anonymously purchase stock.
- adrr 6y agoPretty sure this is trivial. Buy someone’s identity on the dark web to pass an online brokerages KYC then wire money in from an international bank. I say this as person who worked at a fintech. KYC checks aren’t the most robust and you can brute force the knowledge based authentication if you have enough people’s information. Some of the KBA questions you can google because all the data brokers put people’s past cities online.
- chki 6y agoBut remember: you'll also need to sell the stock after having committed the crime, with all the attention drawn to those getting a big payout.
- beaner 6y agoWhat's the logic? It makes the problem much more visible. Ostensibly the fix for fake tweets would also fix whatever they'd be trying to cover.
- BiteCode_dev 6y agoWithout knowing what they have access to, it's hard to tell. If it's a third party API key with special priviledged that they hacked, the potential harm is limited. If they have access to the full system, they could be sending millions of ghost messages to some part of the population right now to get them to do something while we all watch the BTC show: - scam them - get them infected to gather a massive bot net - make them very angry and start some kind of civil unrest in a specific part of the world - cover a currently happening terrible event somewhere so that we don't learn about it too soon because twitter is the faster medium for that At this point I realize how critical twitter has became to shape the way we view the world, and govs should worry a lot that this can be happening and act on it quickly.
- Scoundreller 6y ago> If it's a third party API key with special priviledged that they hacked Unlikely since the tweets appeared from "Twitter Web App"
- pldr1234 6y agoThat makes no sense. The BTC show increases general public suspicion in a huge way. It would be counteractive, if they are also doing what you say.
- Firebrand 6y agoI wonder if they have access to the accounts’ DMs too. Lots of juicy info potentially there.
- Monroe13 6y agoI’m seeing a lot of discussion of the DMs being the real target, but executives and politicians usually have staff who monitor and post to their social media channels. Hard to imagine Barack Obama communicating anything of blackmail value over a channel that a mid-level social media manager has the password to.
- nomadluap 6y agoNo, but you could blackmail a social media manager to further your cause by planting a bug in the office, for example.
- deleted 6y ago[deleted]
- maaarghk 6y agothis is the best fun i've had in a while but i've just ruined it for myself with a conspiracy theory that some prankster youtuber has set this up and there will be a "hilarious" video about it tomorrow
- s5300 6y agoYeah, not possible with both the last US pres and vice pres being hit. Literally, at least 3 of the top 10 richest people in the world got hit. All of whom probably really don't like each other to begin with...
- deleted 6y ago[deleted]
- madeofpalk 6y agoOr just, someone stupid and uncreative got very very lucky and this was all they could come up with.
- codesternews 6y agoThey are not stupid if they could make such a big attack.
- chki 6y agoReminder: macrumors.com/2017/11/28/macos-high-sierra-bug-admin-access/ Not all serious bugs are difficult to find.
- GordonS 6y agoKeeping in mind the attackers will not be able to perform this stunt again though the same attack vector, It could also simply be that the attackers overestimated how much they would make from this attack.
- searchableguy 6y agoI doubt that. For one, they wouldn't be reusing the crypto messages from the past which have been seen by everyone on twitter a thousand times. I ignore based on tweet rather than looking at who tweeted it most of the time. So they at least would write new messages if they were after money. There are so many ways to make money that even a dumb person could find something better than posting crypto ads without compromising on opsec.
- ilaksh 6y agoI think they have proven that it works with thousands of YouTube videos with the same scam and basically the same operating mode (impersonating famous people). They have made quite a lot of money. So they are probably on at least their second attack vector by now. I mean, who knows, based on the massive number of imposter YouTube stream BTC giveaway scams, this might be a whole sub-industry in India by now. Similar to fake virus scams etc.
- fishtoaster 6y agoIt could just be a relatively unsophisticated actor who stumbled upon a serious vulnerability and didn't know enough to market it to, eg, a state actor or whatever.
- ehsankia 6y agomafia boy 2.0
- ilikecode 6y agoHah I knew that guy before he did it too. He was just a loser kiddie. I literally just signed up to reply to this.
- Sebb767 6y agoBut then why set up a rather simply scam instead of getting the bug bounty from twitter? That wallet is currently sitting at about 150k USD and these are rather hard to pay out. Why not just go for 100k USD bug bounty, completely legal and with fame?
- cwkoss 6y agoIf the hacker regularly does black hat stuff (and perhaps used black hat methods to obtain this access), they risk criminal prosecution by going through the official channel. Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. Not surprising to me that they'd cash out in this manner - especially if they got access via a token which expires: they wouldn't have much time to plot on how to monetize the access. I suspect this was a small operation - a national intelligence organization could have caused orders of magnitude more havoc with this sort of access. Smaller groups don't have the infrastructure to capitalize on such chaos.
- acatton 6y ago> Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. When they pay out. Some will even fix the bug, and just tell you "thanks, but it wasn't a security bug"
- pizza 6y agoIt's possible this was conducted by somebody who underestimated the hack's value, or isn't even really doing it for monetary gain rather than to just stir chaos
- ErikAugust 6y agoAre you the AOL Pizza? (I’m guessing not but have to ask)
- pizza 6y agonope sorry :)
- Acrobatic_Road 6y agoYou're overestimating the intelligence of the typical scammer.
- s5300 6y agoThey're not a scammer. They're a massive multimedia conglomerate hacker.
- almost_usual 6y agoNah, 14yr old in the basement who stumbled upon this.
- williamdclt 6y agoThe typical scammer doesn't hack twitter
- Acrobatic_Road 6y agoYeah, because this looks oh so professional.
- humaniania 6y agoSeems more likely to me that it was a Twitter employee or someone with access to an employee's PC to reset passwords.
- dividedbyzero 6y agoBut wouldn't that be evident very, very quickly, from just looking at a relevant account's audit log, and shut down right away?
- londons_explore 6y agoBut it was shut down right away...
- shawabawa3 6y agoI think it only stopped in the last few minutes. It lasted hours
- toby 6y agoA senior engineer (juniors would not have this level of access) risking their job and facing prosecution for an amount that would certainly be far less than their salary? That doesn't seem likely.
- staycoolboy 6y agoI can't imagine the user's devices were targeted (e.g. Obama's cell phone), so this must be internal. Eff me.
- OriginalPenguin 6y agoWhy? It's certainly imaginable Obama's cell phone was targeted.
- staycoolboy 6y agoBecause that would require dozens of simultaneous simjacks on corporations, billionaires and politicians. Simjacking has about a 20 minute - 4 hour effective window, shorter if the person uses their phone extensively. Hacking the 2FA of Apple, Bezos, Buffet, Gates, Obama, Musk ... in that time window ... naaaaah.
- dawnerd 6y ago113k is a little reward?
- break_the_bank 6y agoTwitter would have probably paid out about $100k for this to be reported via a bug bounty program. $100k is nothing for the risk taken, they could have made a lot more.
- creato 6y agoTwitter should have paid millions for a bug like this.
- manquer 6y agoIt should be but it is not, in the bounty program the actual payout for owning accounts is 7k ish, that is assuming you met all the criteria and they still accepted the bug, which is not always the case. Having said this attack was not best way to monetize this 0 day either, it looks like something else is happening behind the scenes we wont't know about, which is paying out the kind of money this attack should have been worth.
- arp242 6y agoEven things such as "Administrative functionality" and "Unrestricted access to data" is "only" $12.5k. It's not a small amount of money, but pretty sure I could make a hell of a lot more with full access to everyone's DMs. Grepping for CCs would be a good start, and "password", and so forth. Never mind that "admin access" might give the ability to send DMs. https://hackerone.com/twitter?type=team https://hackerone.com/twitter?type=team
- manquer 6y agoEven forgoing the value arguments, the skill required to identify a vulnerability and develop a provable exploit for it and the time it will take is not free, just to pay a senior security researcher a hourly rate or monthly salary will cost much more. These kinds ofrewards are better than nothing I suppose, but it is looks like a cheap trick to crowdsource blackbox pen testing.
- paulpauper 6y ago>Such a hack is worth way, WAY more than the few BTC it could bring. lol tons of ppl have been scammed. If by 'little' you means hundreds of k. In some Eastern European country that can last a lifetime.
- break_the_bank 6y agoThey could have probably made a 100k by disclosing this to Twitter. The reward/risk graph seems concave down and not convex up.
- sdan 6y agoTwitter says for account takeover hacks, their bounty is set at $7k. $7k vs $100k, you choose.
- paulpauper 6y agoalso any attempt at negotiation can be construed as extortion, and now they have all your info too.
- londons_explore 6y agoI'm trying to think of other ways to monetize this without ending in prison, and not really coming up with much... Sure, you could short stocks and then make "Aaah, Tesla is going bankrupt!" tweets... But without an army of lawyers and accountants and money to pay them, it's hard to anonymously short stocks. You could bribe people with publishing DM's - but again that's pretty high risk. And how do we know that hasn't already happened? What else is there?
- ilkkao 6y agoMaybe shorting wouldn't have been needed. Just buy from the dip and trust that the stock recovers when twitter confirms hacking. But requires a lot of cash that the attacker probably doesn't have.
- 6y ago
- csomar 6y agoMaybe the dude shorted the Twitter stock?
- stjo 6y agoYeah, I'm not sure there is much to be gained from leaking internal data (are DMs that valuable?). The actual scam is executed so poorly that it can't be the main goal too. "Prooving" you have a good exploit by throwing it away is also not plausible.
- latraveler 6y agoExactly, this would be a pretty reckless way to prove an exploit. You could just tell the potential buyer to create a new account and then tweet from that handle.
- manquer 6y agoPerhaps, however proving you can access verified accounts is harder, still even that could have been proved lot more quietly if they wanted to , clearly this is a distraction or something else being is sold/showcased beyond this exploit
- Mountain_Skies 6y agoWhile we'd hope that most people would be smarter than the send anything incriminating through a DM, the high profile nature of some of these accounts means anything embarrassing in their DMs could have significant value. They already have access to two presidential candidate's accounts and might have access to the incumbent's account even if they didn't post from it.
- wisemanwillhear 6y agoBad idea for the hacker. Stock ownership is public information.
- drra 6y agoThere is a spike of the short volume on 8th - https://fintel.io/ss/us/twtr https://fintel.io/ss/us/twtr
- hharlequin 6y agoQuite possibly this isn't a hack and someone got a Twitter admin's account, then got access to the admin panel and "all" accounts without having to hack much of anything.
- jeffbee 6y agoIf there is such a level of privilege in Twitter's stack, that says a great deal about their technology. Insiders must not be able to act as users except in prescribed ways requiring two-person control, logged and 100% audited. Glass-breaking privilege escalation should set off every pager in the company.
- shakezula 6y agothis assumes two things: that there is a security model that would prevent this attack that they should have implemented, and that alarms _weren't_ set off. Both of those are weak assumptions.
- GVIrish 6y agoI don't think parent was assuming those measures are implemented. They were saying that they should be implemented and if they are not, it betrays seriously poor security posture at Twitter.
- somehnguy 6y agoSorry, but would you mind expanding slightly on how you would implement such a system? In my understanding once you remove all the layers of abstraction as some point it's a bunch of databases and data stores. Someone has to manage them. Why wouldn't a breach of those users be able to do whatever they want? And a higher level, someone is writing the code to implement such a stringent access system. Why wouldn't a breach of those users (or a rogue employee) be able to accomplish bad things?
- jeffbee 6y agoGlad you asked. "There is a database and some guy is the DBA" is a very outdated architecture that can get you passing grades as an undergraduate and that's about all its good for. You should not take as a given that the right to modify datastores falls ultimately upon some individual. It is possible to permanently discard this ability, and organizations should strive for that.
- joering2 6y agoI think its mostly test of miners - prominent group of tech-related personas have been hacked, so I wonder if they end up asking miners not to validate/approve the list of incoming/outgoing transactions. If they choose to minimize priority of this transactions, they may get delayed over 14 days and eventually fell off a block as never processed bitcoins. Then spender gets their money back. In 14 days they may realize it was a scam. They probably already did!
- londons_explore 6y agoIf I were a miner now, I would not reverse these transactions. Setting the precident that transactions can be reversed will do more harm to the crypto ecosystem than than $100k being taken from gullible users.
- LeoPanthera 6y ago> how little the BTC reward is going to be So far, the address has received the equivalent of over 50,000 USD.
- hn_throwaway_99 6y agoAgain, nothing. Given the accounts that were hacked, they could easily have moved markets and had pre-placed short bets that would have netted them potentially hundreds of millions.
- jacquesm 6y agoThat's a lot easier to trace than BTC transactions though. And of course even there if the adversary is determined enough you'll get caught.
- erichurkman 6y agoIf they had capital to begin with. If this is some individual hacker without much for means, swiping $100k of BTC in a potentially narrow window when a security vulnerability is in place is greater than $0 while trying to line up capital and shorts.
- dasudasu 6y agoIf you do it in "real" markets, you get the attention of the SEC or similar agencies in other countries. Crypto is completely unregulated in this regard.
- shiftpgdn 6y agoThere are literally millions of put/short orders placed against TSLA every day. I don't think they track the intentions of every single one.
- tempestn 6y agoNo, but if someone managed to hack a bunch of Teslas and cause chaos, driving their stock down, you can bet law enforcement would be looking at shorting activity.
- lazyjones 6y ago> a diversion while they get the real loot How about market manipulation via other tweets that subtly affect trading bots reading Twitter?
- monokh 6y agoHow about the possibility of a Bitcoin marketing campaign?
- shdc 6y agoHmm the thing is, associating it even more with "hack" and "scam" isn't really great marketing.
- WrtCdEvrydy 6y agoThis is good for bitcoin - /r/bitcoin probably.
- monokh 6y agoI tell you what: it has been working pretty well so far. Just about every year, this is exactly how Bitcoin is portrayed. - Bitcoin is used for scams - Bitcoin hacks - Bitcoin used for illegal activity All the meanwhile, more people become aware and interested. These sort of events prime the "nocoiners" to read and understand that little bit more.
- caetris1 6y agoI like your thinking. This is a novel idea.
- stilisstuk 6y agoInkl bite: lets say I hack capable of doing this. How do I sell my hack?
- glenstein 6y ago>a demonstration to a big client Okay, this has me curious. Could someone describe the context/circumstance where you have a 'big client' to whom you illustrate capabilities by this kind of hack? This is a black market thing, right? I don't doubt it, I'm just curious what this market is, and what it means to be a 'big client' in it, etc.
- durpkingOP 6y agothis is not a way for you to demonstrate what can be done to a big client. ignore OP.
- kshacker 6y agoI will bite. Without taking a political stance. Imagine you could show GRU that they can make Trump tweet "I just ordered a nuclear strike on..." What value would you place on this? The proof will go along with another method of hacking the account that is not disclosed.
- notatoad 6y agoAfter having alerted twitter to the hack and given them time to fix it? I'd say that's worth approximately $0
- jrumbut 6y agoIf life was like Sherlock Holmes, the real hack would be put in place during the rush to fix this one. I don't seriously suggest this is what happened though. I don't have any information about this. Glad I never did send or receive Twitter DMs though.
- durpkingOP 6y agoWhat was done was a guaranteed method of getting the method/exploit fixed in record time. If the perpetrator wanted to demonstrate, they would have targeted someone inconsequential that would not have put the problem on twitters radar. They blew their whole wad, likely on purpose, and there is nothing else planned.
- cwkoss 6y agoYeah, the idea that this is an initial step in something bigger doesn't make sense. If they wanted to exfiltrate data, they already did that previously. They very loudly burned their access, this seems a lot more like someone trying to monetize their access quickly before their access token expires - squeezing out the last few drops before they can no longer get into the system.
- mdoms 6y agoUnless they already did their exfil.
- cwkoss 6y agoYep. If they did exfil, it would make sense to do before they tweeted. I expect we'll see solicitations offering to sell a copy of DMs from the affected accounts - even if the hacker didn't exfil, the public doesn't know that and opportunistic scammers may try to pose as the hacker to get BTC. Interestingly, by tweeting a bitcoin address, the hacker could authenticate themselves to 'potential buyers' by accurately describing future transfers of bitcoin from the tweeted address.
- boring_twenties 6y ago> accurately describing future transfers of bitcoin from the tweeted address. No need to do this, just sign a short piece of text with the private key.
- benlumen 6y agoVery loudly indeed. Think message sent or stocks shorted.
- bouncycastle 6y agoNope. They're actually getting away with quite a big loot! The number of unconfirmed transactions has catapulted from ~9k to about ~50k right now, which means there's large amount of activity. It will take a while for the dust to settle. You can watch them here https://www.blockchain.com/btc/unconfirmed-transactions https://www.blockchain.com/btc/unconfirmed-transactions chart https://www.blockchain.com/charts/mempool-count https://www.blockchain.com/charts/mempool-count A better graph of the current transactions sitting unconfirmed: https://jochen-hoenicke.de/queue/#0,24h https://jochen-hoenicke.de/queue/#0,24h Note: I'm not saying that these are all from the hack, I'm saying that the activity on the Bitcoin blockchain has significantly spiked, and the hack was still ongoing at the time of writing this.
- longtom 6y agoSo we're likely talking some 50-100 million of dollars being stolen? Insane.
- deleted 6y ago[deleted]
- admn2 6y agoIt's only at 12 bitcoin ($120k) right now. (serious question) why do you think it could be as high as $50 to $100 mm? Is there a way to see the total including unconfirmed transactions?
- schoen 6y agoI think longtom read this as 9k-50k BTC rather than as 9k-50k transactions.
- SV_BubbleTime 6y agoHang on... is it “stolen”? If you trick some people into giving their money to you, it’s unethical, but you didn’t force them to hand you their money against their will. I would say “taken” is fair; but “stolen” isn’t exactly right. Plus there is no way it will be that much.
- jgbond 6y agoI’m guessing DMs were the real loot. The public display with the BTC diversion validates any DMs that were stolen. Otherwise blackmail targets could deny them.
- cj 6y agoIf DMs were the real loot, they wouldn’t have exposed the hack by tweeting on the account.
- nickff 6y agoIf DMs were the real loot, the tweets were a "proof of work" (to show the accounts had really been owned). You can prove you have 'blackmail materials' just by proving you own the bitcoin wallet.
- deleted 6y ago[deleted]
- Mountain_Skies 6y agoPerhaps it is a form of proof that they actually have access to the accounts and thus the DMs. Just posting claimed DMs that can be deleted and denied has a lower probability of being believed.
- dx034 6y agoThey needed to reset credentials so this could've never been a stealth attack. By making it public, any later leak of DMs is much more likely to be accepted as authentic. Without that, most people would've doubted the authenticity of leaked material.
- Breza 6y agoPrecisely. And who's to say which leaked DMs are real and which ones are faked? If you're interested in this kind of stuff, I recommend the book Active Measures.
- xvector 6y ago
- tazedsoul 6y agoThis.
- noobmax 6y agoI believe some twitter admin users account was hacked who maybe has access to tweet anything from anyone's account. Twitter passwords/system is safe IMO.
- caretak3r 6y agoJust imagine trading secrets to foreign actors, or selling misinformation. Can you even think of the covert operations that could have taken place to slowly poison streams of people in the twitter-sphere? This is a big yikes on a platform that "poses" as a platform of democracy and free speech.
- adventured 6y ago> - a diversion while they get the real loot It's that one. They were after the DMs of one target, and needed cover for who they were specifically after, so they hit many accounts.
- binwiederhier 6y agoDoesn't even look like Twitter has acknowledged the attack yet. The status page [1] shows all green. [1] https://api.twitterstat.us/ https://api.twitterstat.us/
- panopticon 6y agoTwitter acknowledged the incident over two hours ago: https://twitter.com/TwitterSupport/status/1283518038445223936 https://twitter.com/TwitterSupport/status/128351803844522393...
- downandout 6y agoPeople have been gushing about the value of such a hack, but as a marketer I can tell you that Twitter traffic is pretty close to worthless. I suppose there are other things you could do, such as manipulating stock prices. But that would take a large amount of capital to take advantage of, which this person may not have had.
- jsnider3 6y agoFrankly, I expect the real prize to be the DMs used by the blue checks. Biden and Barack's DMs are worth much more than 100 grand.
- Answerawake 6y agoDo they seem the type of people that would send anything sensitive over Twitter DMs? I'd imagine if anything at the very least they would use iMessage or some messaging app of that nature. Biden seems like the type of guy who relies on e-mail.
- sundvor 6y agoAgree; this looks like an ISK doubling Jita scam for laughs, given the sophistication of the event.
- WrtCdEvrydy 6y agoI thought it was just me, but yes... please send me your ISK and I will double it... here's a website with a wallet thing that shows we sent out money... everytime we received some.
- 6nf 6y agoThe BTC is adding up to many millions so far. I'd say it's worth it by itself.
- nseggs 6y agoLol not even close
- pazimzadeh 6y agoHe didn't say in what currency 100k USD = 4.2 billion rial or 2.3 billion dong
- beachjpg 6y agoMillions in rupees!
- drefanzor 6y agoTwitter's API is being updated within the next day. This is likely hackers abusing a known exploit in the current API before the changeover. 1) https://twitter.com/TwitterDev/status/1283068902331817990?s=20 https://twitter.com/TwitterDev/status/1283068902331817990?s=...
- stjohnswarts 6y agoI highly suspect that it's an inside job and someone had become aware that a security hole in the api/interface was getting ready to get patched so they jumped on it as a hail mary to make some bucks. It's one of the few things that makes sense. Otherwise they would have sold it to some nation state to pull the trigger on when they need a propaganda coupe.
- feydaykyn 6y agoWhat about Donald Trump wanting to shame the company which prevented him to tweet? Is it too far fetched?
- WillPostForFood 6y agoReal estate developer by day, elite hacker at night?
- famouslastwords 6y ago>Real estate developer by day, elite hacker at night? Is there anything this man CAN'T do? Perhaps one day he'll even become president and then "drain the swamp" or something...
- feydaykyn 6y agoWhat an entertaining idea! I was thinking more about hiring talent or using gov resources, he has the money and the position for either one.
- tbrock 6y agoI think you greatly overestimate the value of this. It’s a sham, everyone makes a few tweets, it’s on the news and it’s fixed and over tomorrow. Very little damage done that isn’t obviously corrected/correctable short term. In other words, who cares? I’d pay tree fiddy for this exploit. On the other hand, this person seems to be making BANK getting 13 BTC as of now.
- jessriedel 6y agoYou could move many, many millions of dollars on the stock market with these accounts. Would require more care and/or tricks to avoid being apprehended than a simple anonymous bitcoin scheme, but the pay off could have been at least a couple of orders of magnitude higher.
- m0zg 6y agoApparently hackers have commented that they now have DMs of all the hacked blue checks. They referred to that as the "fun" part of this exercise.
- praveen9920 6y agoOr it could be attack on Twitter itself. Jack's policies are not loved by few folks in WH. Just speculating OR Twitter's stock was down by some major percentage because of this incident. It could be a way to earn bigger and "legal" money by having prior knowledge about this incident.
- samanator 6y agoWow that's brilliant. I didn't think of that. If someone had a non trivial amount in stock shorts, they could stand to make an exorbitant amount of money.
- deleted 6y ago[deleted]
- homero 6y agoYeah a couple of tweets could have made them millions with financial derivatives.
- rland 6y agoI wonder if it's coming from inside the US, to prevent the President from using Twitter the way he has used it -- signifying that the presidential twitter account could be compromised, without actually compromising it and with minimal damage otherwise.
- otabdeveloper4 6y agoThere's a simpler explanation: someone wants to destroy Twitter. (Bless them, lol.) Twitter's only value to the world is the idea that it is a platform where "celebs" can safely broadcast their message to the public. That value proposition has now been destroyed.
- the_gipsy 6y ago"destroyed", a bit exaggerated, mate.
- otabdeveloper4 6y agoWell, if I was Obama I'd cancel my Twitter account ASAP. Today the tweet is relatively harmless and obviously fake, but who's to say that tomorrow something really toxic to Obama's reputation won't be posted under Obama's name? (Say, something anti-feminist.) Are there better options?
- bluedispatcher 6y agoMastodon lol
- the_gipsy 6y agoAccounts get hacked/phished all the time, it's not a big deal.
- otabdeveloper4 6y ago> ...it's not a big deal. Unless you're Obama or Trump.
- etxm 6y ago> a diversion while they get the real loot Twitter as a riderless horse would be wild.
- powersnail 6y agoAnother possibility is that they have already sold the hack, but the relationship with the buyer deteriorated for whatever reason, so they decided to burn the bridge.
- dx034 6y agoIf this is a demonstration to a client I don't want to know what the product is they're selling. There are few more valuable targets than being able to hijack communication of public figures.
- lanevorockz 6y agoThere is a bit of romanticism about hacking here, things are way more boring than you would think. Likely that some process on the authentication process at twitter was broken and someone took advantage to have a laugh. Hijacked the authentication cookies and injected into the app that skips validation for performance. Likely nobody got access to the accounts themselves but just allow them to tweet some jokes.
- cookiengineer 6y agoIn any case this is the perfect example why 2FA via ss7 is the worst idea any developer ever had. I mean, to take over your account I just have to grab an old motorola phone and let an imsi catcher software run on it. I hope that twitter learned that 2FA via SMS should be treated as what it is: totally unnecessary.
- dynamite-ready 6y agoI think this is a state sponsored attack. Wouldn't want to speculate on which state.
- vb6sp6 6y agobased on what?
- dynamite-ready 6y agoPerceived motive. The resources needed to do this. Compromising and paying Twitter staff, the practical, technical know how (and it's cost), and that no real attempt to profit from this has been made? I don't think that sounds like a financially motivated crime at all. As a crime it has more in common with the proverbial 'horse head on the bed', than a sophisticated heist. I think this was done to shake confidence in the perceived invincibility of Silicon Valley and FANG like companies particularly. But then any number of well resourced 'political' actors would love to send that message to the large tech companies...
- sbassi 6y ago"few BTC", for US this is no money, but for a scammer in a 3rd world country 13 BTC more money than most people do in their lives.
- nkozyra 6y ago"few BTC" is relative to the value of what they had, not the average income of the average person. If I sold a 7500 sqft home in San Fransisco for $200,000 you could say the same thing.
- leto_ii 6y agoJust wild speculation, but could it also be a stock-market play? It seems the stock went down by quite a bit in after-hours trading [0]. Shorting the stock I guess would have earned you quite a bit more than the few BTC made directly. [0] https://techcrunch.com/2020/07/15/twitter-stock-slides-after-hours-amid-scramble-to-contain-high-profile-account-hacks/ https://techcrunch.com/2020/07/15/twitter-stock-slides-after...
- C1sc0cat 6y agoIsn't a bit to high profile - the perps risk attracting the attention people a bit more serious than overworked police fraud squads