6 ms·
It looks like someone found a 0-day in the new API and wanted to use it before others did. Probably didn't help that the bug bounty for this would have been onl
by zelly 6y ago
It looks like someone found a 0-day in the new API and wanted to use it before others did. Probably didn't help that the bug bounty for this would have been only 7k. How much does the Twitter employee who implemented this bug get paid?
https://twitter.com/LiveOverflow/status/1283511782380908545 https://twitter.com/LiveOverflow/status/1283511782380908545
- kabacha 6y agoCurrently their earned BTC balance is $120k+ for comparison. That's a pretty successful scam and 5% of potential revenue will not make anyone go white hat.
- metafunctor 6y agoSorry, but $120k is ridiculously low for something like this.
- samstave 6y agoThey could have caused so much more havok... They must have been having an extreme adrenaline rush during this which clouded them from having a more sinister plan.
- aj3 6y agoMany previous ICO hacks (wait for initial coin offering -> change the bitcoin address to your own) have paid millions. Musk's or Buffet's tweets have moved markets multiple times. This sort of access could have been leveraged to gain at least x100 more than what they achieved.
- saberdancer 6y agoMoving the market doesn't do anything if you don't have the stocks. This might have been a temporary hack where the hacker was not sure how much time he has. It could be simple as someone gaining access to an unlocked home PC of a remote Twitter employee.
- anonu 6y agoWe now know it wasn't a 0 day. It was socially engineered access to internal tools. That's still a tricky one to lockdown.
- johnnyfaehell 6y agoMore info on this https://techcrunch.com/2020/07/15/twitter-hacker-admin-scam/ https://techcrunch.com/2020/07/15/twitter-hacker-admin-scam/
- AustinDev 6y agoInteresting looks like a moderation tool form the screenshots. You can block a user from timelines and searches or a tweet.
- mschuster91 6y agoSo the infamous "shadow ban" actually does exist on Twitter, based on this screenshot. I remember them actively denying this two years ago when a wave of shadow ban incidents hit German news.
- jonathanstrange 6y agoWhere do you see a shadowban option on that screenshot?
- mschuster91 6y ago"Search blacklist" is one of the things that indicates a shadow ban (per https://shadowban.eu/ https://shadowban.eu/). Lower left corner in the screenshot.
- Already__Taken 6y agothat's nothing controversial surely, like your bank doesn't explain the anti fraud mechanisms even if you posted "this is exactly how it works"