13 ms·
It could just be a relatively unsophisticated actor who stumbled upon a serious vulnerability and didn't know enough to market it to, eg, a state actor or whate
by fishtoaster 6y ago
It could just be a relatively unsophisticated actor who stumbled upon a serious vulnerability and didn't know enough to market it to, eg, a state actor or whatever.
- ehsankia 6y agomafia boy 2.0
- ilikecode 6y agoHah I knew that guy before he did it too. He was just a loser kiddie. I literally just signed up to reply to this.
- Sebb767 6y agoBut then why set up a rather simply scam instead of getting the bug bounty from twitter? That wallet is currently sitting at about 150k USD and these are rather hard to pay out. Why not just go for 100k USD bug bounty, completely legal and with fame?
- cwkoss 6y agoIf the hacker regularly does black hat stuff (and perhaps used black hat methods to obtain this access), they risk criminal prosecution by going through the official channel. Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. Not surprising to me that they'd cash out in this manner - especially if they got access via a token which expires: they wouldn't have much time to plot on how to monetize the access. I suspect this was a small operation - a national intelligence organization could have caused orders of magnitude more havoc with this sort of access. Smaller groups don't have the infrastructure to capitalize on such chaos.
- acatton 6y ago> Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. When they pay out. Some will even fix the bug, and just tell you "thanks, but it wasn't a security bug"
- pera 6y agoor just tell you "what bug? lol that never happened..."
- EForEndeavour 6y agoGreat way to alienate the hacking community. That would work only a small number of times before word spread not to bother even trying that company's disclosure program.
- NoodleIncident 6y agoThat's how we got here. This is the word
- hutzlibu 6y agoBut is it a fact, or just rumor?
- eitland 6y agoIt is fairly well known that certain large companies are really stingy. I'm not into this but once discovered a kind of security related bug (could reveal details about the composition of a password typed into a new Windows 8 password field, admittedly low value as you had to have the user type in the password and leave) and later found a more interesting issue in the way an official powershell module works with Azure Information Security that makes it possible to sneak a file through unencrypted. On the first I got a nice thank you mail and on the last I struggled so hard to report it that I gave up.
- 6y ago
- Sebb767 6y ago> a national intelligence organization could have caused orders of magnitude more havoc with this sort of access It doesn't need much fantasy to cause more havoc. It was speculated in another thread, but maybe the hackers held back since the manhunt is going to be far less for a 'harmless' Bitcoin scam rather than i.e. crashing $TSLA or declaring a war.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- vmception 6y agoExactly, this was the bug bounty
- kerng 6y agoThere is actually a post on Twitter from a bounty hunter who got awarded $7000 dollars or so from Twitter for ATO, and he puts that in relation now to what the adversaries are getting by exploiting things. The point is that bounty value of critical ATO kind of vulnerabilities tend to be okay-ish, but relatively low compared to what black hats could get. Personally, I think this was an opportunistic actor, not a persistent one with a strategic goal.
- shovelpile 6y agoThey might have expected to get more than 150k USD from the scam.
- celticninja 6y agoMaybe if it was the first time the scam appeared, but this is old hat now. This was possibly thrown together quickly to make the most of an explot before the API changed. Prior to this there is no reason to assume they were not very careful with access and this was not the main money making part of the job.
- magma17 6y agothey got btc, not usd.
- Sree_988711 6y agoYea they got a lot of btc
- magma17 6y agoyeah. hats off
- deleted 6y ago[deleted]
- detaro 6y ago100k USD? Twitter's payouts aren't that impressive, <10k for account takeovers: https://hackerone.com/twitter https://hackerone.com/twitter
- SV_BubbleTime 6y agoPros: no taxes Cons: trying to deal with 103k in bitcoin
- alwillis 6y agoThe market cap for Bitcoin is about $170 billion; 103k in Bitcoin would be a blip in the scheme of things. Someone moved $1 billion nearly a year ago and I don’t believe we know who made it: https://arstechnica.com/tech-policy/2019/09/someone-moved-1-billion-in-a-single-bitcoin-transaction/ https://arstechnica.com/tech-policy/2019/09/someone-moved-1-...
- Sebb767 6y agoFinding a buyer is not the problem, the problem is the buyer finding you.
- WrtCdEvrydy 6y agoSell $200 worth a pop on LocalBitcoin.
- onetimemanytime 6y agovery time consuming and risky in its own (robbery, state eventually finding out one way or another etc)
- blaser-waffle 6y agoLots of little transactions, too. Easy to hide in the noise, at least at first, but when you start throwing out tons and tons of small transactions they can start with the pattern recognition.
- konschubert 6y agoStill easily traceable.
- deleted 6y ago
- xwdv 6y agoSome men aren’t looking for anything logical.
- thinkloop 6y agoI would've guessed they would've raised more, maybe they thought so too.
- codexon 6y agoHackerone has non-technical people screening your exploits. They will often mark them as out of scope. Companies will routinely downgrade the severity of your exploit so they can pay you less.
- tgsovlerkhgsel 6y agoI've had enough repeated bad interactions through Hackerone that I will go full disclosure on any company that offers it as the only disclosure channel. (If Hackerone wants to fix that: enable easy, on-platform disclosure unconditionally after 30 days. Right now, the platform is just used to pressure people into delaying disclosure or not disclosing at all.)
- deleted 6y ago[deleted]
- base698 6y agoHow much do you think Trump's DMs are worth? Kanye's? Elon's?
- doingmyting 6y agoYou wouldn't need to gain any money directly for the tweet. Load up put options and fire off Trump tweets in your favor during market hours. You'll make orders of magnitude more than whatever you could get from followers without any trace back to you.
- dx034 6y agoMaybe Trump was protected, his tweets can certainly move markets. And while it's possible to track investments in smaller stocks, someone buying futures or ETFs on large indices to profit from that would likely be able to stay anonymous. There are way too many trades in S&P500 on a given day to find the one that sticks out.
- dynamite-ready 6y agoThen that begs the following questions... Are Twitter protecting "even higher" profile accounts? Why do they put more effort into protecting these "even higher" profile accounts? And how do they protect these accounts? And if that really is the case, and this product feature is outed during this election campaign year, then Twitter deserve a court summons. I seriously doubt Trump's account would, or should have that much more protection than other high profile, verified accounts.
- bostik 6y agoYou're probably getting downvoted because of the tone you used, but I think there's a good point hidden underneath. Trump's account is probably specially marked for two- or even three-person lock, to prevent "rogue account termination" as has already happened. So the questions quickly turn to odd angles: how many other high-profile, politically (and/or economically) influencal accounts are equally protected? What criteria are used to assign the account this level of protection? Should this kind of account lock mechanism be more widely available? If yes, to whom? I personally suspect that Twitter will eventually have to follow Google's route for high-profile accounts and identity management in general.[0] If people are using Twitter as their personal press office, the company has no choice but to accommodate. 0: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- floatingatoll 6y agoThe income tax on that bounty would halve its value compared to Bitcoin, if they have a way to cash out that isn’t reported. Also for example, if they’re a US student, they could lose access to benefits and loans as a result of reporting the income.
- dx034 6y agoReporting that social engineering would allow to take over the admin panel might not lead to any pay out at all.
- molmalo 6y agoI would bet the attacker(s) is/are reading this thread, curious about this community's reaction on the attack and having a good laugh.
- tripzilch 6y ago> Why not just go for 100k USD bug bounty, completely legal and with fame? Not everyone believes that the existence of Twitter, in its current state as an amplification medium for the ever increasing polarisation in this world, is actually a force of good. Helping them out with a security report might be the last thing on their mind.
- parasubvert 6y agoTrue, though I’d take amplified polarization any day over what Facebook and YouTube have done for years steering vulnerable people to conspiracy content.
- tripzilch 6y agoWe can argue about which is worse, but let's agree they're all bad :)
- mortenjorck 6y agoWhile possible, this scenario requires such a massive disconnect between the attacker's skill, connections, and luck versus their understanding of economic and geopolitical context that I would consider it among the least likely.
- tripzilch 6y agoSuch as the Max Headroom incident? It's not uncommon for hackers to have these weird imbalances in skill and understanding.
- Scoundreller 6y agoSounds like the 2005 hack of the Danger Sidekick (early smartphone device). I think the fellow went by the 'nym "ethics". Dude couldn't exploit it for much, despite being able to takeover/access any account, and everything was in the cloud.
- DaftDank 6y agoI used to have a Sidekick, I could type out texts so fast with that thing. Weren't there a few big celebrities who had their Sidekicks hacked back then?
- Scoundreller 6y agoYes, Paris Hilton was one. I can't seem to find too much about this ethics fellow, even though I thought there was a DoJ investigation. Ah, here's a writeup! https://www.securityfocus.com/news/10271 https://www.securityfocus.com/news/10271
- VectorLock 6y agoSomeone got mugged with their phone unlocked and the mugger had a friend who was into bitcoin.
- emiliobumachar 6y agoToo diverse and high-profile to be a physical attack by small fry. "...from the accounts of Gemini, Binance, KuCoin, Coinbase, Litecoin's Charlie Lee, Tron's Justin Sun, Bitcoin, Bitfinex, Ripple, Cash App, Elon Musk, Uber, Apple, Kanye West, Jeff Bezos, Michael Bloomberg, Warren Buffett, Barack Obama and CoinDesk."
- VectorLock 6y agoGet admin access from unlocked phones, make a bitcoin wallet, use admin access to send tweets with double-your-bitcoin tweet. Start thinking up accounts you think would work well for it and start going through them one by one.
- hombre_fatal 6y agoMy guess is that a Twitter insider sold access. I bet the reason Trump didn't get hacked was because he is special-cased in the Twitter system to avoid insider vandalism which protected his account from this insider attack.
- bmarquez 6y agoI believe you are right, a rogue Twitter employee had previously[1] deleted Trump's account. So there must have been some special protection to prevent it from happening again. [1]https://www.independent.co.uk/news/world/americas/twitter-employee-deletes-donald-trumps-account-on-last-day-a8034831.html https://www.independent.co.uk/news/world/americas/twitter-em...
- solarkraft 6y agoI find it interesting that this kind of protection isn't the default.
- ransom1538 6y agoYeah, like altering a POST variable.
- zelly 6y agoWhat would a state actor do with this? Read celebrities' DMs?
- ketzo 6y agoImagine if every celebrity you knew in New York suddenly started tweeting about some kind of massive rioting. Imagine if every verified account related to finance started tweeting “cash out your accounts NOW.” You could easily, easily cause some pretty massive panic.
- exikyut 6y agoTWTR is a largeish company. I have no evidence but presume it is overwhelmingly likely that their scale a) makes getting inside the head of every employee is impossible and b) fosters the right conditions for a healthy number of little agenda-ized splinter cells with various passionate motivations and whatnot. Besides public state and company size, Twitter is also new media. And all media is information warfare. (Hmm, that sounds a bit strong, especially considering the toxicity that is the platform itself; I mean the term generically speaking.)
- zelly 6y agoWeren't there cases of foreign spies discovered in Twitter ranks, or was that some other company?
- MandieD 6y agoYes, it was Twitter, and and the spies were working on behalf of Saudi Arabia: <a href=“https://www.washingtonpost.com/national-security/former-twitter-employees-charged-with-spying-for-saudi-arabia-by-digging-into-the-accounts-of-kingdom-critics/2019/11/06/2e9593da-00a0-11ea-8bab-0fc209e065a8_story.html“>Former https://www.washingtonpost.com/national-security/former-twit... Twitter employees charged with spying for Saudi Arabia by digging into the accounts of kingdom critics</a>
- blaser-waffle 6y agoIt was twitter. But that's largely moot -- there are almost certainly spy-espionage types in a lot of large tech companies. Mostly for siphoning off tech secrets, but I'm sure having someone with root access to some $SYSTEM is useful for political purposes too.
- mmazing 6y agoNever attribute to malice what is easily explained by incompetence. Hanlon's Razor BOIIII
- dynamite-ready 6y agoThe result of the 'mistake' is extremely specific. But you're right. You can never rule that out.
- bb2018 6y agoOccam's razor says this is almost certainly the case. It isn't like the hacker knew that it would generate such little bitcoin being sent their way until after it failed. Especially if the hacker is not from the US it seems much easier to do the bitcoin hack than try to contact a company thousands of miles away that you know one at.
- lemmonii 6y agoThe theory that I think is most probable is that someone got access to the hack, either by purchase or stumbling upon it, they tested it out and had a "holy shit this actually works" moment. After this they became paranoid of the bug being fixed within hours and tried to monetise it in the quickest, easiest and safest way possible.
- flattone 6y agoI believe it was found to be social eng upon an employee see https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
- hadeson 6y agoTwitter investigation suggest that this is a coordinated social engineering attack [0]. The idea that the hackers are some non state actors and not from the US seem unlikely. [0] https://twitter.com/TwitterSupport/status/1283591846464233474 https://twitter.com/TwitterSupport/status/128359184646423347...
- curryst 6y agoIt is of note that they're claiming a social engineering attack on an internal employee; not a wide spread social engineering attack on each individual account.
- konschubert 6y agoPossibly blackmail?
- doomjunky 6y agoI remember last year around christmas/new year 2018/2019 a similar hack/leak/doxxing took place, targeting 994 (!!) mostly german politicians, celebrities and influencers. Massive amounts of private information (names, addresses, phone numbers, e-mails, DMs, contacts, online profiles, chat logs, private documents and even intimate details) where leaked. The data was published on a wide spread of public pastebins and etherpads. It took ages to take them down. The attacker had set up a labyrinth of links, files and passwords and even structured the data by topics and political parties. Attack vector: Sim-Swapping. It was too easy. As soon as he got into one account, he got access to it's contacts and more phone numbers. The attacker (0rbit) was a 20 year old student living at his parents home. He bragged about his hack to a online friend. This friend knew that 0rbit had been raided by the police years earlier. He betrayed him to the investigators and with the exact date of the raid the they were able looked up the old case and reveal his identity. Previously on HN: https://news.ycombinator.com/item?id=18823286 https://news.ycombinator.com/item?id=18823286
- LukaD 6y agoIt was not a hack. It was just a lot of doxxing. There was really nothing impressive about it.
- cjsawyer 6y ago900 successful sim swaps is impressive.
- DeadSec 6y agoThere were no Sim-Swaps, at least not from the Student. Later it was revealed that he simply bought the Data & published it. The Hacking did somebody else.
- creato 6y agoThat doesn't make much sense. Why would a student, presumably with little money, buy something that seems likely to command a pretty high price, that he has no use for other than to post anonymously on the internet?
- WhyNotHugo 6y agoQuite true. Maybe some unscrupulous 19 year old with average understanding of tech, who happened to have access to the right tools at the right time.