31 ms·
Who’s behind Wednesday’s epic Twitter hack?
- strikelaserclaw 6y agoman who falls for this stuff. i've been seeing "send me money to this account to get double that" scam for like 20 years, its hard to believe there are people who still don't know better.
- chrisseaton 6y agoI too don't understand who's technical enough to know what BitCoin is but not technical enough to understand the scam. I think some people are possibly just sending the scammers some money for the banter? A sign of respect for the hack.
- txcwpalpha 6y agoBitcoin isn't just for "technical" people anymore. The 2017 craze caused a ton of non-techies to hear about Bitcoin and get involved. It was front page CNN a decent amount. Coinbase made it their mission to make Bitcoin as accessible as just downloading an app and giving it your credit card info, and IIRC at one point Coinbase was the most downloaded app on the App Store. There's an argument to be made that the only reason Bitcoin became popular the last few years is because of the amount of non-techies who have been falling for all the same, tired "join my ICO and get rich!" scams.
- stri8ed 6y agoWishful thinking is a powerful drug. The same technique is used on dating apps, where a beautiful "girl", explicitly seeking sex, sends you a link to some paid service, to "verify" your account or some nonsense.
- mxcrossb 6y agoThe very fact that someone owns bitcoin means they have been scammed by the promise of doubling their money.
- paulpauper 6y agoyeah but add verified twitter accounts from authority figures, add nice graphics, livestreams, etc. and it is very convincing for at least enough people to keep the scams going. Twitter and YouTube have millions of users. If just a tiny fraction of them send some BTC, that is a lot of $ given how valuable BTC is.
- liquidise 6y agoConsider this: i'd argue that the fundamental feature of twitter isn't tweets. It is the underlying certainty that the tweeted content belongs to the person with the blue checkmark. My friends in social media positions heard about the twitter hack from me, not the other way around. Given how this info disseminated, combined with the breaking of twitters fundamental feature, i'm surprised more people didn't fall for the scam. A commenter yesterday claimed Coinbase had blacklisted the wallet very early on. I assume Gemini and Binance had similar reactions. Without this swift action, i'd wager the actual haul could have been many times the ~13 BTC they ended up with.
- paulpauper 6y agomakes me wonder why they did the scam in the afternoon PST when everyone is at work. why not wait until midnight. bitcoin is as popular overseas as in america.
- catalogia 6y agoPerhaps they weren't willing to risk losing their window of opportunity.
- deleted 6y ago[deleted]
- syshum 6y agoHello, I am a Nigerian Prince and I need your help.... //That scam still works today, never underestimate the gullibility of people.
- runawaybottle 6y agoIt’s got to be teens that fall for it. I can’t imagine the elderly (the demographic that usually fall for this scam) managing a bitcoin transfer. ‘Mom can I please buy $50 worth of bitcoin, pretty please?’
- ajmurmann 6y agoThe trick is the scale at which you teach people. You only need a few people who are new to Bitcoin and stupid, intoxicated or otherwise not at their best in that moment and you made a profit that's significant in many countries. If you reach 100k+ people your odds should be good.
- mcphilip 6y agoI wonder if a lot of people sent test amounts to see if it worked or not. 5000 people sending $10 adds up fast.
- stri8ed 6y agoI think they could have done a lot better by having Elon tweet out a new product preorder page (limited edition Tesla merch?), which accepts payments in crypto. Really anything other than give me X so I can give you 2X, which has been done to death already. 100k is chump change, historically for this class of scam. Another idea is, hijack customer service request DM's from crypto exchanges, and lead customer to phishing login page. Perhaps could athorize API access to the account, and then change email back to original, without the owner realizing account breach.
- three_seagrass 6y agoThe traffic burst would be huge for the Tesla tweet. That type of scam introduces more complexity, such as requiring hosting for millions of visitors in an hour, which can leave a traceable trail.
- iMerNibor 6y agoCompromised aws or similar accounts shouldn't be that hard for someone to get hold of at that point though? You could probably make the whole site fairly convincing with just static files & some js which would be super easy to scale up with just a free cloudflare account or something along those lines
- Nextgrid 6y agoHosting for millions of visitors/hour isn't that hard. Maybe the cloud companies want to make you think otherwise, but a handful of bare metal servers around the world should be enough to handle that kind of load unless you're streaming video or running a really heavy web framework. Those can easily be obtained for free if you're already a criminal and have access to compromised servers or stolen credit cards to buy them with.
- three_seagrass 6y agoThe point isn't tech scalability - the point is that scaling to that many visitors requires payment, and many cloud providers have anti-fraud mechanisms in place to prevent scammers from doing this quickly and easily without being traceable.
- etaioinshrdlu 6y agoThe funny thing is you could create an ethereum smart contract that verifiably will double any money you send to it, and send it back, at least until its own funding pile runs out.
- murat124 6y agoI believe it's got a lot to do with the Dunning-Kruger effect because this scam gives the illusion to the victim that they are the one who's actually doing the scamming. When victims of this kind of scam see an opportunity that they'd be making money off of a "very stupid" offer they jump on it. In some cases though the scammer is forced to employ tactics to speak to victim's emotions by inducing guilt or pity but otherwise it's just plain stupidity powered by internalized intelligence.
- sillysaurusx 6y agoWhile it may sound ridiculous that anyone would be fooled into sending bitcoin in response to these tweets, an analysis of the BTC wallet promoted by many of the hacked Twitter profiles shows that on July 15 the account processed 383 transactions and received almost 13 bitcoin on July 15 — or approximately USD $117,000. This could be mostly the attackers’ own money. It’s impossible to tell, but I haven’t seen anyone explicitly mention this.
- nullc 6y agoIt might be better to assume that it's entirely the attacker's money until at least one actual victim steps forward.
- deleted 6y ago[deleted]
- chmod775 6y agoYou'd have to be a special kind of stupid to "un-wash" your own bitcoins this way.
- sillysaurusx 6y agoPossibly. The only reason this would be stupid is because Bitcoin has rapidly been centralizing. I suspect many exchanges might start blacklisting any wallet that has any transactions from this wallet. On the other hand, they can’t really do that. At that point the attackers would be able to poison any wallet just by sending a small amount of BTC to it. Therefore it seems like the only penalty is that they’d have to re-wash their coins.
- WrtCdEvrydy 6y ago> the attackers would be able to poison any wallet just by sending a small amount of BTC to it I'd be surprised if there was any followup blocking on this wallet. It might just be set as super high-taint wallet.
- teknopurge 6y agoIt's not a hack when an employee holds the door open and gives use of an admin management tool to a third party. Likewise, it's not a bitcoin scam when bitcoin is the method of transfer, just like it's not a US-dollar scam every other time dollars are used in theft.
- barbecue_sauce 6y agoIs bribery not considered a viable form of social engineering?
- ceo_tim_crook 6y agoI wouldn't even call that social engineering, just fraud
- c00ls0sa 6y agoWhere was that mentioned? This wasn't a hack. A "life hack" maybe.
- bpfrh 6y agoI would argue that it is not. Social engineering is when your target is unaware that what he does is wrong or will do damage.
- paxys 6y agoNo, the term (as used in the context of information security) implies deceiving/manipulating people.
- kingnight 6y agoBitcoin is sort of notable vs US-dollar in that it’s significantly more of a novelty, and unlike the dollar, doesn’t have same fraud recovery path.
- gruez 6y ago>unlike the dollar, doesn’t have same fraud recovery path. You mean electronic us dollars? I doubt you'd be able to recover physical us dollars if they were scammed.
- paulpauper 6y agoThe among taken in this scam is chump change compared to the YouTube scammers. YouTube is a vastly bigger website than twitter and way slower to respond to accounts begin stolen by scammers. I remember seeing an Ripple giveaway scam that in a single day made 100k with just a single account ,. And fake bill gates one made 40k. the list goes on and on. My guess is the total taken is in the $3-5 million range from youtube alone.
- chrisseaton 6y agoWhat are these YouTube scams you're referring to? I'm not aware of them.
- hkchad 6y agohttps://cointelegraph.com/news/fake-spacex-youtube-channels-scam-victims-out-of-150k-in-btc https://cointelegraph.com/news/fake-spacex-youtube-channels-... The first one I saw was a Rip of a SpaceX livestream. I watched it for a bit then noticed all the BitCoin references and got confused then realized it was a scam account. How they get promoted basically to the front page is the issue.
- paulpauper 6y agoA solution as simple as just hiring someone for $10/hour to periodically scan youtube for crypto keywords and disable the scam videos and accounts would have prevented millions of dollars of theft.
- Avicebron 6y agoI think this is a good solution, but maybe not viable. Going past Crypto this could apply to so many issues needed to be reviewed on YouTube. But at that scale, the human cost is something YouTube refuses to pay.
- paulpauper 6y ago
- TechBro8615 6y agoThis is the most important point: > Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. My understanding is the hackers used the admin panel to change the email addresses of the accounts, which means they could reset passwords and perform full account takeover [what about 2fa?]. That means they could login as the user, and so it means they could read the user's direct messages. (Ironically, Twitter's solution of disabling posts from blue checkmarks would not have stopped exfiltration of direct messages while an account was compromised.)
- dilandau 6y agoI'm curious about this, too. I have to believe, though, that if some bumbling sim swappers were able to get in, then it doesn't require a leap to assume sophisticated state-level actors have similar access. Granted this attack leaves a swath of evidence, but with access to internal tooling, it really is just a factor of how much information is accessible via those tools (and others like them).
- dannyw 6y agoWe know a Twitter employee worked with Saudi Arabia to target dissents.
- aahhahahaaa 6y agoIf you're already logged in to a Twitter account you can deactivate 2FA by disabling the account (aka deleting with a 30 day window) and then re-enabling the account.
- jobigoud 6y agoYou don't need 2FA to deactivate 2FA? That seems like a big flaw.
- 6y ago
- PiggySpeed 6y agoImagine combining this with a deepfake video.
- danso 6y ago> “This is NOT a method, you will be given a full refund if for any reason you aren’t given the email/@, however if it is revered/suspended I will not be held accountable,” Chaewon wrote in their sales thread, which was titled “Pulling email for any Twitter/Taking Requests.” If access were being sold via message board, I wonder if the thread contains stipulations on which accounts are off-limits for being hacked. My theory to why we didn't see any active government officials accounts get pranked is because the hackers, no matter how confident they were about covering their tracks, still might have worried that such a breach would almost guarantee FBI/NSA-level involvement.
- SahAssar 6y agoYou don't think that hacking biden and obama will do that too?
- adventured 6y agoThey did, the FBI is involved now. "U.S. FBI is leading an inquiry into the Twitter hack, sources say" https://www.reuters.com/article/us-twitter-cyber-fbi-exclusive/exclusive-u-s-fbi-is-leading-an-inquiry-into-the-twitter-hack-sources-say-idUSKCN24H2PH https://www.reuters.com/article/us-twitter-cyber-fbi-exclusi...
- thinkloop 6y agoObama and Biden are part of it
- danso 6y agoNeither Obama nor Biden nor Bloomberg are "active government officials". They have no power to conduct U.S. government business, thus an intrusion on their private social media accounts is not going to be an obvious or immediate threat to the security of the U.S. government.
- wgerard 6y agoFormer presidents are still privy to a lot of information (e.g. they receive national security briefings still). Hacking their technology accounts is absolutely a threat to the security of the US govt, and is one reason the Secret Service specifically monitors their technology usage. I'd bet a lot of money the inclusion of people like Obama and Biden all but guaranteed the FBI/NSA get involved now, or at the very least the Secret Service.
- Dahoon 6y agoKrebs should get someone half as good at html and CSS as he is in security to update his awful site. Doesnt even work in Firefox reader.
- madeofpalk 6y agoMaybe Firefox should get someone half as good as Chrome developers, because the reader mode works on his site fine there.
- jacobsenscott 6y agoWorks fine in FF reader mode too.
- bishalb 6y agoAs much as folks here on HN extol Firefox, it just feels somewhat sluggish and buggy compared to Chrome. I try to use Firefox Developer edition sometimes but just can't because primarily it feels tangibly slower than Chrome.
- gwittel 6y agoIt will be interesting to see how the access was gained. I wonder how well this administrative system was protected. Did they have basic controls like: 1) Accessible via corporate VPN only (requiring 2fa) 2) Admin panel protected by 2fa plus necessary authentication+authorization controls 3) Audit trails Short of cooperative access (device handover), I could only see an outsider gaining access to the system due to poor security practices or a remote access trojan getting installed. Though more likely, Twitter lacked these basic controls. Verified accounts could probably be subject to 2nd person controls so IF someone were to modify an account via admin panel, then a 2nd support person (preferably in a different location), would have to vet the change.
- kerng 6y agoMany startups and hip companies don't do VPNs anymore - unfortunately they also dont do Zero Trust (which would require machine certs for everything and be enforced) - so stuff is often available over Internet with password auth + maybe MFA. Attacker who gets hold of cookie or bearer token wins. And the best part, support personnel often doesnt have MFA, because its outsourced to countries where smart phones with Authenticator apps are not as common to own for the regular person. I'm not joking.
- ex3ndr 6y agoI don't see any issue with auth without VPN if TLS is terminated by owner
- deleted 6y ago[deleted]
- kerng 6y agoThe better answer/question is maybe more about what kind of auth?
- callamdelaney 6y agoTo be honest VPN's are a huge pain in the arse for everybody involved.
- christoph 6y agoI don’t really think he should be naming who his unnamed sources “think” is behind an attack on this scale, especially with full name, city of origin, Instagram, suggested current location, age, etc. It feels a very, very small step away from doxxing to me. Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to the relevant authorities and don’t sensationalise it on a blog. Technical details fine, but people’s personal information feels like it’s crossing a line on something like this.
- Qw3r7 6y agoHe might just be inferring what he believes rather than an out right allegation. You are right though, I would consider this to be doxxing.
- yjftsjthsd-h 6y ago> It feels a very, very small step away from doxxing to me. What small step is that? Looks like a textbook case of doxxing to me.
- elliotec 6y ago> Researching and publicly broadcasting private or identifying information (especially personally identifying information) about an individual or organization. Yeah this is definitionally doxxing
- Forbo 6y agoThis isn't his first time doing it, either. https://itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/security/infosec-researchers-slam-ex-wapo...
- hoppelhase 6y agoSome people claim that the coinhive story had some unnecessary doxxing aswell: https://krebsonsecurity.com/2020/03/annual-protest-to-fight-krebs-raises-e150k/ https://krebsonsecurity.com/2020/03/annual-protest-to-fight-... (see comments) The users of said image board do a yearly fundraiser to protest against the unnecessary doxxing. The first one was started by a random user.
- paxys 6y agoIt's bizarre to me that someone pulled off an account takeover of this magnitude and the end result was random people being scammed out of ~$100K in Bitcoin (that too allegedly). A single well-crafted Tweet from one of these accounts is probably worth more. Heck Twitter would have paid that much or more just in bug bounties for reporting this.
- Tempest1981 6y agosee this, from earlier: https://news.ycombinator.com/item?id=23860584 https://news.ycombinator.com/item?id=23860584 "No, you couldn't have made more money than the Twitter hacker" https://fortenf.org/e/security/2020/07/15/twitter-hack.html https://fortenf.org/e/security/2020/07/15/twitter-hack.html
- paxys 6y agoI don't buy the stock market argument. People open short positions worth more than $100K every day, especially against companies like Tesla. There would be nothing suspicious about a few such trades. But really, my point is that pulling off a sophisticated exploit involving major celebrities, politicians and CEOs, social engineering/bribery, internal access at a top company etc. doesn't really seem worth the risk if at the end it nets you $100K.
- yellow_postit 6y agoThere would be afterwards though, so the question would be could the money from the trades settle and be exfiltrated to a private non-traceable account before the SEC thought something was amiss and started looking at impacted stocks and suspicious associated trades by timing.
- bezmenov 6y agoYou need a substantial amount of capital to make the short position more profitable than $100k to begin with.
- herpderperator 6y ago
- deleted 6y ago[deleted]
- spir 6y agoIs it generally known that this hack was live for at least a few days, not just Wednesday? I personally saw one of the official @elonmusk scam tweets earlier this week.
- GaryNumanVevo 6y agoI've been seeing similar scams in Elon's replies, they just copy his profile picture and name and reply with a different account. You might have seen that one
- spir 6y agoI am used to spotting cryptocurrency scams. The tweet I saw was from his official account, days before the "Wednesday hack".
- letmevoteplease 6y agoElon Musk's account getting hacked or promoting a cryptocurrency scam would have made news immediately, so I think you are mistaken.
- jhardy54 6y agoI don't think that's been reported anywhere, could you link to an archive or something?
- spir 6y agoI couldn't find any screenshots, archive.org link, or browser history for the tweet I saw. So, unfortunately I have no evidence that the scam tweets started before Wednesday. We'll see what Twitter finds.
- jacquesm 6y agoTwitter is not incentivized to find anything and make it public if that makes matters look even worse than they already are.
- blisseyGo 6y agoI think people are still severely under-estimating how dangerous this was. Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value: Archive: http://archive.is/8lCMV http://archive.is/8lCMV https://www.washingtonpost.com/news/worldviews/wp/2013/04/23/syrian-hackers-claim-ap-hack-that-tipped-stock-market-by-136-billion-is-it-terrorism/ https://www.washingtonpost.com/news/worldviews/wp/2013/04/23... This twitter hack could have literally destroyed economies, started a war, potential for black mailing politicians and others etc. This really needs to be looked at with much bigger eyes. This wasn't just a bitcoin scam.
- brown9-2 6y agoYes it was dangerous, but nothing is “erased” if that market valuation is restored a few minutes later
- slg 6y agoFor a market to move, people need to buy and sell. So while value might not be erased on a global scale if the market recovers to the original position, lots of people will lose (and gain) large amounts of money.
- ZachPruckowski 6y agoIn the aggregate sense, it eventually netted out. But a lot of people who sold when it looked like prices were collapsing sure got a pretty decent chunk of their bank accounts "erased".
- interator7 6y agoWhy would the hackers gain this level of access, and do something that nets them so little money(relative to the amount they could have gained), when they can't even spend without having law enforcement outside their door?
- jordansmith 6y agoYou are assuming the kids doing this don’t think just getting 100k is a lot of money. They most likely originally got the backdoor solely to get original usernames and someone had the idea “we could phish bitcoin with this”. I doubt they went into it with a big plan
- coolspot 6y agoSummer break in school.
- jacobsenscott 6y ago1. For the lulz 2. For a disgruntled twitter admin who thinks they won't get caught 100k is a good haul. If you steal 1MM dollars and you have a 80k/year job you're in trouble. 100k in btc cashed out over a year or two - less of a problem. 3. I can't think of how you could make more, at least not without putting yourself at huge risk. 4. Maybe these tweets were just to serve as proof you did something else we don't know about yet, and you are getting paid for that. 5. Maybe you are a Russian operative, and your job wasn't to make money, but to try and find dirt in the DMs of Trump's political opponents.
- deleted 6y ago[deleted]
- stopshills 6y agoFunny that Krebs refers to Lucky225 as a longtime friend of Adrian Lamo. I thought it was very well-known that Lucky225 made that story up as a cover to hide the fact that he gained control of Adrian Lamo’s @6 Twitter via a SIM swap hack himself, and also took control of Lamo’s Facebook in order to hijack ownership of the 2600 Magazine group on Facebook.
- ani-ani 6y agoInteresting. I looked for evidence supporting your claim and found this: https://github.com/keybase/keybase-issues/issues/3442 https://github.com/keybase/keybase-issues/issues/3442 It's a very awkward thread where Lucky225 accidentally demonstrates that he has indeed taken over Adrian Lamo's email account. Note this doesn't say anything about whether they were or weren't friends. They definitely had overlapping interests.
- VectorLock 6y agoIs your assertion that Lucky and Adrian and no relationship and he had no right to assume stewardship of his online accounts after his demise?
- stopshills 6y agoYes. I know Lucky and I knew Adrian. If Adrian wanted Lucky to assume control of his accounts I’ll eat a hat.
- 6y ago
- electro_blah 6y ago"or attempting to start a war by issuing false, inflammatory tweets from world leaders." LMFAO
- eunos 6y agoImagine if some verified accounts will really open BTC give away with the same format. Just for giggles.
- twodave 6y agoI'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug problems and help our clients. None of it is accessible from the Internet.
- xyst 6y agoInternal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.
- danans 6y ago> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. I could be wrong, but I think they mean that access to the internal site should have been behind VPN (whether at the IP network level or via an HTTP proxy) even when accessed over the internal network. That is, the internal network should not be trusted any more than the network at the cafe down the street.
- w7 6y agoDoes it though? Using a VPN for access to internal infrastructure doesn't mean said internal infrastructure is insecure or authless itself. As in, defense in layers.
- hnzix 6y agoExactly, assume zero trust but VPN with MFA provides another layer of security. Given the weekly volume of package vulns Github notifies me about I don't want to miss a 0day and get scanned. Perimeterless is fine if you're only using SaaS or you have an army of SecOps, but I don't want an internal app rumbled.
- eternalban 6y ago"within Twitter’s admin tools, apparently you can update the email address of any Twitter user, and it does this without sending any kind of notification to the user." How is this acceptable? That's practically (thus effectively) identity theft.
- rdiddly 6y agoVery tangential: That's a surprisingly childlike & adorable UI design for a security admin dashboard!
- zdwolfe 6y agoDoesn't really surprise me much. Internal tools get 0.00001% of the UI design effort that production tools do. It looks like an old version of Bootstrap too.
- hntestacc 6y agoThis is a test. If you see this, please pass through.
- haecceity 6y agoI keep saying phone numbers for 2FA is dumb but entire industry thinks this is a good idea for some reason. The problem here is that it's not even used as 2FA, it's just one factor and these services think it's sufficient to prove identity.
- pronlover723 6y agophone numbers for almost anything is dumb. Discord wants my phone number for forums about sexual topics that could get me killed if I was in certain countries. Obviously I don't want to give them something which actually identifies me.
- deleted 6y ago[deleted]
- jugg1es 6y agoAdrian Lamo's facebook account broadcasted a new post as if it was Lamo himself a week before this Twitter hack (he's dead!). Is that related? https://www.facebook.com/felon/posts/3429161987103431 https://www.facebook.com/felon/posts/3429161987103431
- lyx0 6y agoThe thing I'm most concerned about is that if Brian Krebs is right and they had access to their DM's, that the very obvious crypto scam they ran was just a facade, some kind of distraction because they knew they would have been noticed, but the true goal were the DM's. Imagine a celebrity saying some 'not so politically correct' things to a friend in private 8 years ago, and now imagine this becoming public while the Twitter cancel culture is in full force. There's a lot of money and power in having that information. I don't want to argue about what's wrong or not, I just want to point out what I find really concerning about the hack.
- donkeyd 6y agoWhy are you so concerned about some celebs being called out on stuff they said? To me, the most concerning is innocent people having lost money to a scammer, not some celebrity's public image being hurt by something they actually wrote.
- chki 6y agoI think the point was that a malicious actor might have power (via blackmail) over a famous/powerful person.
- ransom1538 6y agoTwitter: function adminPanelShow() { if ( !isInOurVPN() ) throw logSecurityBreach(); if ( !isLoggedIn() ) throw logSecurityBreach(); slackSecurityChannel("AdminPanel Access: " + userName); ... }
- Thorrez 6y agoIs it possible the attacker was in the VPN and logged in?
- galacticaactual 6y agoDo you know how account takeovers work?
- ransom1538 6y agoYou work in security. Sad.
- hexa00 6y agoIsn't it strange all the work we put into securing networks etc... while we're engineers working from home and all it would take is someone figuring out where I live via Linkedin or whatnot.. and all this goes away with my physical security being pretty much non-existent.
- Thorrez 6y agoSure, but the vast majority of computer-focused attackers are unwilling to do show up in person. They want to operate from behind a computer. So you're not at risk of a physical attack from them unless they hire someone to conduct the physical attack. But they tend to be bad at hiring physical attackers, see how DPR hired hitmen but they turned out to be scammers. If you're facing a government though, you do need to be wary of physical attacks.
- iJohnDoe 6y agoUltimately it doesn’t matter what really happened. The most important aspect to the American people is that the largest real estate holder in San Francisco and employs roughly 5,000 employees can’t figure out how to secure their platform. Which means they are a joke of company. Similar to Google who can’t figure out how to provide customer service when they employ roughly 119,000 employees. Yes, that’s hundreds of thousands of employees and they haven’t figured out how to provide support when their “bots”, which is really their outsourced India techs that cancel their corporate customer accounts on a whim. Again, this is Google, that distributes malware on their Google Store for months and years at at a time. Seriously, the ridiculous interview bullshit we’ve all heard about regarding Google and not one smart person ever recommended taking some of Google’s billions and offering customer service or figuring out how not to distribute malware through their official store. We shouldn’t forget that Google engineers that have access to everyone’s email have also been caught and it’s only a matter of time before Google gets hacked in the same ways Twitter has. Anyways, Twitter is a cesspool. Google is also a cesspool that can’t even get search right these days. It’s a shame that America has these joke of companies on its soil. There is a healthy contingency of Google and Twitter employees on HN, so I expect the down votes. However, I know there are a ton of people out there that share my message.
- mro_name 6y agoPost on your own sever, syndicate elsewhere? Nobody mentioned indieweb.org/POSSE yet as a way to mitigate such?
- yosito 6y agoPOSSE is a great model. One of the problems is that there is no platform that reduces the friction of implementation. I have the technical ability to implement this myself on my own website, but I don't have the free time to set it all up and maintain all of the integrations with various platforms. And syndication is the creation side of the problem, but on the consumption side there's the issue of aggregating your friend's posts on other platforms into one place so you can keep up with everyone without remembering to check several different websites. That's arguably the more challenging part of making this model work at scale, and social networks actively prevent this by blocking API access and making it difficult to programmaticly access data within their platforms. I can't even subscribe to 2/3 of my content sources via RSS anymore.
- known 6y agoI thinks it's due to Work From Home;
- stormdennis 6y agoI don't care about Twitter but what makes this sort of hack impossible at, say, Gmail or my bank?
- once-in-a-while 6y agohttps://www.thegatewaypundit.com/2020/07/hackers-reveal-twitters-shadowbanning-tool-manual-not-accidental-explains-extreme-anti-conservative-bias-tech-giant/ https://www.thegatewaypundit.com/2020/07/hackers-reveal-twit...
- the_dripper 6y agoThis dude is a drainer no cap ! Look at his profile picture on twitter its bladee yooo i cant belive this. DG for life man !
- roadbeats 6y agoSocial media was praised so much for its contribution to conflicts outside western world, like middle east and North Africa. In the beginning of Syrian civil war for example; Twitter was the place where propaganda was streamed and extremists from all over the world would leave homes to join other extremists behading heads somewhere. Now, we see the potential of social media to be a tool for coordinated attacks against the western world. Just imagine this attack during the protests last month in the same narrative that started civil wars in other parts of the world. When tens of people start shooting and killing eachother, nobody would discuss what triggered the chain of events. This is a simple test that reveals how fragile is society in contrast to how much attention they pay to Twitter. The worst, the value we get from social media is also unclear. Low quality, unreliable bits of information turned millions to pigeons jumping from there to there and those who own the seeds can control the mass.
- jacobwilliamroy 6y agoI found it very interesting how Facebook et al got so much flak right after the 2016 U.S. presidential election. It was as if the DoD finally realized their little weapon could be turned against them and took action to reassert dominance.
- creato 6y agoThe less conspiratorial take on this is that social media simply exacerbates and foments conflict, period. Maybe some of these involved significant coordinated propaganda efforts, but I doubt they all did. The mistake the western world made was thinking that this social media generated conflict was a result of some coherent "positive" motivation, when perhaps it was simply blind social media outrage that coincided with revolutions in places we thought were bad somehow. It exacerbated it first in the middle east, maybe because those societies were close to conflict to start with, but the western world doesn't seem that far behind.
- roadbeats 6y agoI don't get how you see conspiracy in my comment. Was I claiming that social media is an actor in conflicts?
- deleted 6y ago[deleted]
- marceloabsousa 6y agoThe hack was epic and strange. But also epic and strange is how Twitter stock value hasn't taken a prolonged hit. Is there really so much trust on Twitter that this was an isolated incident?
- deleted 6y ago[deleted]
- wereHamster 6y agoWhy don't companies adopt WebAuthn already? https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn No 2FA, just pure and simple hardware token that's chap and easily accessible.
- Fjolsvith 6y agoMy personal theory on this is that it was an attack to stop Trumps' incessant tweeting to America. Inside access, leaving his account untouched, then all the screaming about how bad it could have been so we should never use direct, un-channeled, unfiltered communication by state leaders on social media.
- pipenew 6y agoIsn't it obvious from the second photo that the attacker is a Korean girl named Chae Won? There you go, case closed. Give me the next one.