6 ms·
This is the most important point: > Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, inf
by TechBro8615 6y ago
This is the most important point:
> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers.
My understanding is the hackers used the admin panel to change the email addresses of the accounts, which means they could reset passwords and perform full account takeover [what about 2fa?]. That means they could login as the user, and so it means they could read the user's direct messages. (Ironically, Twitter's solution of disabling posts from blue checkmarks would not have stopped exfiltration of direct messages while an account was compromised.)
- dilandau 6y agoI'm curious about this, too. I have to believe, though, that if some bumbling sim swappers were able to get in, then it doesn't require a leap to assume sophisticated state-level actors have similar access. Granted this attack leaves a swath of evidence, but with access to internal tooling, it really is just a factor of how much information is accessible via those tools (and others like them).
- dannyw 6y agoWe know a Twitter employee worked with Saudi Arabia to target dissents.
- aahhahahaaa 6y agoIf you're already logged in to a Twitter account you can deactivate 2FA by disabling the account (aka deleting with a 30 day window) and then re-enabling the account.
- jobigoud 6y agoYou don't need 2FA to deactivate 2FA? That seems like a big flaw.
- senorjazz 6y agotwitter says hello
- bonestamp2 6y agoYup. The interesting thing is that this 2FA exploit was posted to hacker news two days before the twitter hack. It's possible someone seized the opportunity before it was fixed.
- dx034 6y agoDo you have a link to that? Didn't see it here on HN.
- bonestamp2 6y agoMy apologies, perhaps my memory was failing me. I can't find what I was thinking of and may have been incorrectly remembering this as twitter instead of google: https://news.ycombinator.com/item?id=23792767 https://news.ycombinator.com/item?id=23792767
- easterncalculus 6y ago> Ironically, Twitter's solution of disabling posts from blue checkmarks would not have stopped exfiltration of direct messages while an account was compromised. Sure helps keep down on the public effect though... feels mostly like a PR move.
- phepranto 6y agoNot 100% positive on this, but I believe the admin panel allowed to remove 2FA as well.
- flatiron 6y agoYep or else none of this could happen. I work at a company that we need at least two methods to authenticate you to remove MFA through the admin console so this wouldn’t have happened.
- aspenmayer 6y agoIs this a part of your company’s product or internal tooling, or is this 2FA part of a software you use? If it’s the latter, please give a recommendation if it’s good!
- flatiron 6y agoIt’s internal tooling sadly!
- paulpauper 6y ago>> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers. It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consuming and opens the risk of being caught especially if it a high profile target, with no guarantee of being paid. Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating? Paying off a blackmailer is an admission of guilt and does no good if the info is released anyway. It also depends on how sophisticated the thief was. Did he have everything automated to dump anything everything from the inboxes while automating the posting of the spam tweets, or was he frantically doing all his postings by hand before twitter could shut it down. If the thief is not sophisticated his main priority would probably be making as much money as possible with the posts and ignore the private messages
- untog 6y ago> Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating? Maybe? I mean I certainly don't dismiss the idea out of hand. The one strong counter-argument I can think of is that very few things would actually embarrass Musk at this point.
- yjftsjthsd-h 6y agoYeah, Musk specifically doesn't feel likely to care, perhaps if we assume someone else, who is less, shall we say, favorable to controversy?
- ngold 6y agoDude seems to devoted to his workaholic persona to leave much time for dick pics.
- flatiron 6y agoMy guess was frantic copy pasta. Since the reset password emails went to both him and the OG twitter user. Plus wouldn’t you need an API key per user and set that all up? I think that takes more time than spamming a tweet.
- m3kw9 6y agoThe wonder what they saw on the dms