7 ms·
Lots of uncertainty, but I could see it being relatively mundane. It wouldn't surprise me if a lot of Twitter support people had access to these tools and that
by fossuser 6y ago
Lots of uncertainty, but I could see it being relatively mundane.
It wouldn't surprise me if a lot of Twitter support people had access to these tools and that they often worked with larger (more valuable) accounts.
It also wouldn't surprise me if some employee had a bad 1:1 and then responded to a spear fish just because they were disgruntled. To take payment for it is particularly stupid.
Of course, could also be something more serious - but if it's really just the BTC piece and the people are dumb enough to talk to the press, it may not be a group of criminal masterminds.
I hope for the employee's sake they have communication that can help the feds catch the BTC group. Either way, an incredibly stupid thing to do on their part and I don't see a good ending for them.
If this turns out to be true, they'd be lucky not to go to prison.
- derwiki 6y agoI’m not saying there isn’t one, but curious what you think is the imprisonable offense?
- fossuser 6y agoI’m not a lawyer, but I’d guess something related to wire fraud: https://www.justice.gov/archives/jm/criminal-resource-manual-941-18-usc-1343-elements-wire-fraud https://www.justice.gov/archives/jm/criminal-resource-manual...
- unishark 6y agoIt seems to generally be a crime to access a computer system you aren't supposed to, regardless of how you came by the login info (phishing, guessing passwords, etc).
- derwiki 6y agoBut the disgruntled employee may have had legitimate access to the system, even if this specific act was illegitimate
- paranoidrobot 6y agoI'm no lawyer either, but I imagine that the definition of authorisation is key here. If you're a sysadmin on a company email system, then you do technically have access to everyone's data on that system. However, you're generally limited by company policy that you are not permitted to access/modify that data without direct authorisation, say from the employee themselves or from HR. So, therefore, if you go and read the email of your boss, you're still in breach because you didn't have the authorisation.
- toyg 6y agoBut that's gross misconduct or some other fireable offense - a civil matter at best. The only item I can see here is fraud (impersonating the people whose accounts have been taken over), of which the mole would be complicit.
- richardwhiuk 6y agoNo, using a computer system in a manner other than explicitly authorized is a federal offence under the CFAA. That's been exceptionally controversial, as it can turn contract breach into a federal criminal offence in the US.
- MaxBarraclough 6y ago> That's been exceptionally controversial, as it can turn contract breach into a federal criminal offence in the US. Doesn't something similar happen with employer-provided accommodation and burglary laws?
- mc32 6y agoTerry Childs...
- nradov 6y agoThis is likely a violation of the Computer Fraud and Abuse Act of 1986 (CFAA) which allows for federal prison sentences.
- koheripbal 6y agoImpersonating a member of the military?
- _-___________-_ 6y agoIt would surprise me if a lot of Twitter support people had access to tools that allowed them to post tweets as another user. That's not functionality that should be available to a Twitter support person.
- thu2111 6y agoNo, that's easy. People's accounts get hacked all the time. To help them recover is often a manual process, because the true owner of the account can become unclear. To be able to do that a support worker must be able to change the email address on an account, undo 2FA settings and make other changes because hackers will typically change the email address and add 2FA of their own phone as the first step in an account takeover.
- thinkingemote 6y agoBut why would the support worker need to be able to post a tweet?
- detaro 6y agoIf you can change the owner of an account you don't need a special interface to post a tweet.
- lutoma 6y agoThey way I understand it based on the article is that they were only able to change the email address, then used that to reset the password and log in.
- koheripbal 6y agoHaving worked at large tech companies - it would not surprise me at all if many did. ...at least through unofficial channels or not-entirely-secure processes.
- Maxion 6y agoWeird that they didn't require any MFA from a second support // Admin account when dealing with account security settings for prominent accounts. That's not that hard to set up and makes these sort of things harder to pull off. Not to mention severe rate limitation on internal accounts. How many prominent accounts does one support person need to reset password or email per day? Not that many, I'd wager.
- koheripbal 6y agoImagine the potential damage if an attacker tweeted something on behalf of the US President (let's say Biden in 2022), that China or Iran or Russia ships could be sunk at any moment if they didn't withdraw (due to some ongoing real incident)... The other side might fire on US ships before the tweet could be corrected. Twitter is a disaster waiting to happen.
- mercer 6y agoRight, because all these other parties would totally not think Twitter might be hacked? I'm truly baffled by this kind of hysteria.
- remram 6y agoAs you say, it would probably not work on foreign governments, but would be very effective on the general population. They could have used that to cause political turmoil (hopefully not enough to change something like elections results?) or influence stock prices etc. This just looks so uninspired...
- mercer 6y ago> As you say, it would probably not work on foreign governments, but would be very effective on the general population I can't think of any serious risk posed by 'the general population'. Maybe particular stocks would dip a bit?
- deleted 6y ago[deleted]
- Aeolun 6y ago> If this turns out to be true, they'd be lucky not to go to prison. I’m not sure what you’d charge them with?
- tornato7 6y agoFraud, theft, aiding and abetting, surely some digital wiretapping laws
- jrockway 6y agoThe CFAA makes it a federal crime to access a computer in excess of authorization. The employee was unlikely to be authorized to use Twitter's customers' accounts to collect money from their followers, so it sounds like an open and shut case. I know HN doesn't believe in laws, but the rest of the world does, and they're the ones with prosecutors.
- therein 6y agoBut surely they didn't access the system and post these messages themselves. They could argue, with the advent of remote working getting more and more predominant, that they simply left their computer unattended for a second while logged in. Beyond that, they could argue they simply clicked on a link and something might have happened they aren't aware of. Or that they didn't know what running that one executable would do.
- johncolanduoni 6y agoThey don’t sound like a criminal mastermind, it’s very likely they left some trace either locally or in Twitter’s system that will contradict that story.
- deleted 6y ago[deleted]
- maxerickson 6y agoVaguely plausible excuses will not dissuade prosecutors in possession of contrary evidence.