3 ms·
With everyone working from home due to the pandemic I think these admin tools have never been more vulnerable. I would bet these tools were unavailable outside
by jacobsenscott 6y ago
With everyone working from home due to the pandemic I think these admin tools have never been more vulnerable. I would bet these tools were unavailable outside of a twitter office building until now.
But now these tools are accessible from the homes of twitter admins. How many of them are running behind compromised home routers, etc? Everyone in the house has access - spouses, partners, teens, visitors.
I bet twitter doesn't have a lot of extra security on their admin tools. They probably write straight to the production database. Those safeguards would really slow down day to day support and be expensive to build, and they probably assumed the physical security of the office building was good enough.
I think the most like cause was a disgruntled employee working from home plus a little bribery.
- gwittel 6y agoYes, given increased working from home I'd expect more breaches to come. Especially if companies allow non-corporate machines to connect to their VPNs (or other once internal systems are on the open internet). Putting an admin tool on the internet places a lot of trust on your users and developers to be perfect. That also assumes any 3rd party dependencies are free of issues. Putting VPN and MFA on shouldn't slow down people much. They'd just have to spend a bit more time logging in each day. Annoying? Yes, but that's better than a breach.