4 ms·

I think the real purpose had to do with capturing the DMs of high-profile people for blackmail or other nefarious purposes.

eslaught 6y ago
But if that was your goal, why wouldn't you just remain silent and allow your targets to continue to use the platform? Presumably a live data feed is strictly better than one than one that immediately dries up.
- marcinzm 6y ago
  The attack requires changing the email and disabling mfa, the target and Twitter would know pretty quickly. You also have no way to prove to outside parties that you actually had control the account afterwards. This way there is trivial proof that you had control of the account by simply sending some btc from the address.
- jaywalk 6y ago
  They got their access by changing email addresses and disabling 2FA. There was no way to remain undetected.
gmm1990 6y ago
That makes more sense and this way they can prove at least prove they have the bitcoin private keys. Reduces some of the deniability that the DMs were faked.
AnimalMuppet 6y ago
If I understand correctly, the real users were locked out. Doesn't that mean that they couldn't send DMs? Now, sure, you could gain access earlier, capture DMs for a while, then lock out the real users, post the bitcoin scam messages, collect what you can in bitcoin, and still have the captured DMs as your real haul from the attack.
- EForEndeavour 6y ago
  I'm assuming your second scenario is what went down: gain access to target accounts, export DMs, then execute the public bitcoin scam as proof of work.
- amatecha 6y ago
  Yeah, what ppl mean by collecting DMs is getting copies of years' worth of private conversations that the accounts likely engaged in over Twitter DMs (not so much about continued surveiling of new DMs)
raverbashing 6y ago
And then you're forfeiting access by "burning that bridge"? I think they would just keep it for as long as they could. You set an app (a token) on the account and just ride with it
- marcinzm 6y ago
  High chance it would be detected and blocked. The hack involved changing the email, disabling mfa and locking the user out. You can change the email back but their password and mfa would still be gone. They'd also get an email notifying them of the change. For professionally managed accounts that's going to be an instant red flag. Then you have no proof you ever had access to the account.
the-dude 6y ago
You don't have to have the actual DMs. You can make shit up and claim the source is this attack.
- ASalazarMX 6y ago
  Unless they can prove control of the bitcoin wallet used for the attack, or show a portion of the DMs, no one will take them seriously.
fossuser 6y ago
Do people actually use DMs on Twitter for anything? I'm reasonably active on Twitter, but I'm not famous and don't have a ton of followers. Are DMs a common method of communication for high profile accounts? I'd suspect not (since I'd think most high profile accounts have people that run them). I'd guess the simple (dumb) explanation for this hack is probably the true one.

eslaught 6y ago

But if that was your goal, why wouldn't you just remain silent and allow your targets to continue to use the platform? Presumably a live data feed is strictly better than one than one that immediately dries up.

marcinzm 6y ago
The attack requires changing the email and disabling mfa, the target and Twitter would know pretty quickly. You also have no way to prove to outside parties that you actually had control the account afterwards. This way there is trivial proof that you had control of the account by simply sending some btc from the address.
jaywalk 6y ago
They got their access by changing email addresses and disabling 2FA. There was no way to remain undetected.

gmm1990 6y ago

That makes more sense and this way they can prove at least prove they have the bitcoin private keys. Reduces some of the deniability that the DMs were faked.

AnimalMuppet 6y ago

If I understand correctly, the real users were locked out. Doesn't that mean that they couldn't send DMs? Now, sure, you could gain access earlier, capture DMs for a while, then lock out the real users, post the bitcoin scam messages, collect what you can in bitcoin, and still have the captured DMs as your real haul from the attack.

EForEndeavour 6y ago
I'm assuming your second scenario is what went down: gain access to target accounts, export DMs, then execute the public bitcoin scam as proof of work.
amatecha 6y ago
Yeah, what ppl mean by collecting DMs is getting copies of years' worth of private conversations that the accounts likely engaged in over Twitter DMs (not so much about continued surveiling of new DMs)

raverbashing 6y ago

And then you're forfeiting access by "burning that bridge"? I think they would just keep it for as long as they could. You set an app (a token) on the account and just ride with it

marcinzm 6y ago
High chance it would be detected and blocked. The hack involved changing the email, disabling mfa and locking the user out. You can change the email back but their password and mfa would still be gone. They'd also get an email notifying them of the change. For professionally managed accounts that's going to be an instant red flag. Then you have no proof you ever had access to the account.

the-dude 6y ago

You don't have to have the actual DMs. You can make shit up and claim the source is this attack.

ASalazarMX 6y ago
Unless they can prove control of the bitcoin wallet used for the attack, or show a portion of the DMs, no one will take them seriously.

fossuser 6y ago

Do people actually use DMs on Twitter for anything? I'm reasonably active on Twitter, but I'm not famous and don't have a ton of followers. Are DMs a common method of communication for high profile accounts? I'd suspect not (since I'd think most high profile accounts have people that run them). I'd guess the simple (dumb) explanation for this hack is probably the true one.