13 ms·
Hackers tell the story of the Twitter attack from the inside
- westicecoast32 6y agoDoes it end with "The Times was initially put in touch with the hackers by a security researcher in California"? There was no information whatsoever
- YoDawg 6y agoYou are right, what did we just read? Imagine reading this 50 years from today. Once upon a time, there used to be stories like the sinking of the Titanic, now there are mentions of "lol" and "Kirk".
- foogazi 6y agoI also kept scrolling to see if it continued below the other links
- mintplant 6y ago> The Times was initially put in touch with the hackers by a security researcher in California, Haseeb Awan, who was communicating with them because, he said, a number of them had previously targeted him and a Bitcoin-related company he once owned. They also unsuccessfully targeted his current company... I'm not sure what you mean. The story continues after that point. Maybe you hit the paywall?
- deleted 6y ago[deleted]
- DonHopkins 6y agoEven the Gray Lady can use the passive voice when she wants to delay or deemphasize the identity of the actor. https://www.dailywritingtips.com/7-examples-of-valid-passive-construction/ https://www.dailywritingtips.com/7-examples-of-valid-passive...
- pjc50 6y ago.. why would you hand all this info to journos? Do they have that much confidence in source protection?
- sudosysgen 6y agoThe exchange was on the communication method of their choosing, right? As long as they accessed Discord via secure methods, there is no need for trust in anything but your own aptitude.
- BitwiseFool 6y agoStill though, revealing any details could lead to their discovery.
- tantalor 6y agoTurning on your sources is not a good look.
- justinclift 6y agoAt least here in Australia, sources are no longer really all that safe. We've recently seen the police over here raiding the homes and offices of prominent journalists (quite publicly) to gain access to their sources and related material. :(
- michaericalribo 6y agoLuckily, this was the NYTimes, which is based in the US, and considered one of the most prestigious news outlets in the world—turning on a source would be major malpractice. Possible? Sure, but just like with heart surgery, I'm more inclined to trust a professional with an earned reputation to uphold, than just some random shmo—which is to say, there's not much more of aa reliable bet than the NYT for staying safe as a source.
- Firebrand 6y agoSo either this Kirk worked at Twitter and went insane or he’s lying and gained access through a third party. Should be easy for the FBI to track him from Discord.
- sudosysgen 6y agoI don't think so. It's likely either a hacked Discord account or connected entirely through a botnet and or Tor. If I'm guessing, he lied and got access somehow and wanted to destroy Twitter.
- wisemanwillhear 6y agoDidn't the feds hack a lot of Tor exit nodes some years back? https://arstechnica.com/information-technology/2014/11/law-enforcement-seized-tor-nodes-and-may-have-run-some-of-its-own/ https://arstechnica.com/information-technology/2014/11/law-e... What's to stop them from doing that today or simply running their own? It would be a minor expense and effort for them.
- techntoke 6y agoTor + VPN makes it very difficult. You have a lot of faith in the government. They usually just go for hackers who make research papers publicly available using school and library computers.
- deleted 6y ago[deleted]
- pcwalton 6y agoRoss Ulbricht, Bureau of Prisons number 18870-111, also thought Tor and a VPN would protect him from the US government.
- LyndsySimon 6y agoIt pretty much did, until he started ordering fake IDs shipped to his house...
- dry_soup 6y ago> The interviews indicate that the attack was not the work of a nation-state or a sophisticated group of hackers. So it was not the work of "a state in which a great majority shares the same culture and is conscious of it"?
- deleted 6y ago[deleted]
- dragonwriter 6y ago“narion-state” is frequently used to denote independently and supremely sovereign participants in the Westphalian system, the principal actors in and subjects of modern international law, to distinguish from other uses of the term “state” alone, which can also refer to subordinate political entities (such a those within the USA or México.) “Soveriegn state” has a similar problem to “state” alone (US states are described as “sovereign”, as well.) “Westphalian state” would probably be somewhat more clear than “nation-state”, but the use is so well established that I don't imagine it changing.
- im3w1l 6y agoI think the only reason they threw in the "nation" was to make it a backronym for NSA.
- kps 6y agoNYT is a US newspaper, and for US readers an unqualified ‘state’ is a subdivision of the US.
- toss1 6y ago>>... not the work of a nation-state or hacker group... Quite concerning, a Twitter got really lucky that it was a mere scammer. Every serious hacker group & adversarial nation-state has just learned a huge amount about Twitter internals, and their weak security. If Twitter fails to implement far more stringent controls (and yes those are a pain in the neck, expensive and inconvenient), they are 100% sure to be used for serious provocations. At the very least, Admin access to blue check accounts should require simultaneous triple access codes from admins who don't work together. As a reference point for what real security looks like: when I worked at IBM, I met a guy who had figured out how four people in different offices could conspire to get $10MM transferred to an offshore acct, and reported it. He was promoted up two levels for that insight (&the loophole was fixed). That would take 4 people conspiring, probably twice that after the fix. Meanwhile, a single Twitter admin can post ANYTHING from accounts of people who can launch nuclear weapons. Sure, it's all fun and games until someone wants to play Global Thermonuclear War - and can. I hope this gets security taken more seriously.
- syshum 6y ago>>Meanwhile, a single Twitter admin can post ANYTHING from accounts of people who can launch nuclear weapons. Sorry but if our global security come down to twitter than we have far bigger problems than twitter adding some security layers to their admin interface
- toss1 6y agoSure, a blatantly outrageous tweet would be caught But with that kind of admin access to many accounts, it would be straightforward to spread a LOT of chaos from a number of compromised accounts with a series of plausible tweets. The rate things move, it could get out of hand, and a lot of people killed before it got sorted. Especially true for experts at provokatsiya (provocation) & dezinformatsiya (disinformation) as the RUS FSB & GRU. And yes, we do have bigger problems than Twitter's absymal security (start w/FBs, which was hacked to hack multiple elections), but to act as if the capability to make comments from a verified world leader accounts is irrelevant is, to be polite, foolish beyond belief.
- neonate 6y agohttps://archive.is/SMDNY https://archive.is/SMDNY
- mellosouls 6y agoThank you. I'm fed up with people posting paywall stuff without (as per HN guidelines) a link to an open version.
- dang 6y agoIf there's a workaround, it's ok. Users usually post workarounds in the thread, as in this case. This is in the FAQ at https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html and there's more explanation here: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20paywalls&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://news.ycombinator.com/item?id=10178989 https://news.ycombinator.com/item?id=10178989
- mellosouls 6y agoSure - but I think it should be up to the OP to do so, rather than hoping somebody will get round to it, it seems pretty lazy and too supportive of paywalls. Or at least in the FAQ an explanation of how to read a paywalled article.
- dang 6y agoThere's no one explanation because the workarounds vary from site to site.
- mellosouls 6y agoI guess I was thinking of a list of the most common workarounds, but that's probably googleable by readers. ok, thanks.
- istjohn 6y ago
- noxer 6y ago>...and sent out pictures of Twitter’s internal dashboards as proof that he had taken control of the requested accounts. Screenshots - The internets best proof(TM)
- rosywoozlechan 6y agoSo a kid got access to the keys to the kingdom at Twitter by social engineering their way into Twitter's internal Slack. That sounds like crazy irresponsible use of sharing privileged access information in Twitter's internal processes. That could be career ending for someone. Just someone on Twitter's slack, lurking there, seeing passwords and services and being able to access them without an employee account or some kind of sane security process? Huh?
- panarky 6y agoSo Twitter's admin panel just takes a username and password, no 2FA, no device authentication??
- jbob2000 6y agoManagement never wants to invest in the tooling
- taytus 6y agoI get that. Everybody reading this gets that. The thing is thou, that this is not tooling. This is 101 of BASIC security practices.
- toomuchtodo 6y agoMost businesses survive opsec 101 failures with minimal cost. Equifax is still in business, for example. Practitioners take issue with these gross failings, but the markets and regulators seem to not care in the slightest. Disheartening to say the least, yet the reality of the situation.
- GycDH6mb 6y agoOr even IP firewall? Hell, our admin panel can't be accessed outside of our physical office, save for VPN.
- 6y ago
- boogies 6y agoInteresting to hear they “got access to the Twitter credentials when [they] found a way into Twitter’s internal Slack messaging channel and saw them posted there”. I wonder if using a free-as-in-freedom alternative like Zulip (on the front page yesterday), Mattermost (closer alternative, whose website https://mattermost.com/ https://mattermost.com/ emphasizes security), or Matrix (also seems popular on HN) would have prevented the hack.
- trhway 6y agoit doesn't matter. The main point is the apparent security [mis]architecture at Twitter such that those posted credentials is enough to get access. It means no 2FA, the bare minimum for prod access. It probably also means no role based access control (or such an ugly one that instead of roles assigning/modifying/etc. people resort to posting/sharing credentials of critical prod accounts).
- boogies 6y agoI'm not trying to say that the communication platform is the most important factor, but I don't see how it hurts to pose a question about it.
- eternalban 6y agoTwitter incident report & post-mortem kindly provided by NYTimes and "hackers". Perception management precedes forensics. "But four people who participated in the scheme spoke with The Times and shared numerous logs and screen shots of the conversations they had on Tuesday and Wednesday, demonstrating their involvement both before and after the hack became public." [Text file?] Logs and screenshots as evidence! That's funny. https://techcrunch.com/author/kate-conger/ https://techcrunch.com/author/kate-conger/ https://www.nytimes.com/by/nathaniel-popper https://www.nytimes.com/by/nathaniel-popper
- Stevvo 6y agoSounds like a bunch of loosers. How much more damage could have been caused by a sophisticated group of motivated attackers?
- deleted 6y ago[deleted]
- Mirioron 6y agoIf this is true, then this is even more concerning than the hack itself. Twitter asks us to trust them with our data, but can't even keep access to their own information secure. How do they expect us to trust them with anything?
- creato 6y agoDo we actually trust twitter with any data? I don't use twitter much but I can't think of anything on twitter that isn't already public. The only thing we trust twitter to do is to provide some notion of authentication for well known users. That's still very important and not something Twitter can afford to lose, but it's not trusting them "with our data", I feel that is a very heavily overused phrase these days. If these hackers had been more subtle and somehow made the confusion last a long time, it could have been a lot more serious. If people can't rely on Trump being Trump and Musk being Musk on Twitter, then Twitter is just an overgrown internet forum.
- Mirioron 6y agoTwitter does or at least did aggressively ask users for their phone numbers. They also retain information such as email addresses too. Presumably some people give them even more information about themselves.
- blisseyGo 6y agoI think private messaging is where most of the goods are. Also user's phone numbers and emails.
- waheoo 6y agoThey track almost every site you visit with a little tweet this button. Thats our data.
- ForHackernews 6y agoTwitter is just an overgrown internet forum
- the-pigeon 6y ago
- pixxel 6y agoAnyone else reading this with great skepticism?
- blisseyGo 6y agoYep. I find this story hard to believe. Finding credentials on Slack for the most important resources at the company seems too hard to believe. Also if this was the case, how come Twitter was having a hard time to figure out how to stop the hack?
- Mandatum 6y agoI've worked with a lot of organisations, including tech orgs. It's very believable.
- walleeee 6y agoIM'ing passwords/secrets is totally believable.
- almost_usual 6y agoHave you worked for a high profile tech company? This isn’t unheard of at all.
- deleted 6y ago[deleted]
- jacquesm 6y agoYes, but still: individually I've seen all these things at various companies over the years. To find them all in one place is hard to believe but it just might happen.
- hevelvarik 6y agoOk so I sign up early for every platform that hits hackers news and make one letter, and one digit usernames and profit! Amiright
- dmurray 6y agoYes, you're right. This opportunity hasn't been completely arbitraged away. Devote your time, and a moderate amount of technical chops, to this and you can likely make millions over the next 10 years.
- person_of_color 6y agoWhat a seriously lame use of time.
- DonHopkins 6y agoJohn Gilmore used to have Jesus.com (when you could register domain names for free, long before the days of the web), but when they started charging for domains, he refused to pay for Jesus.com on principle, so then he lost Jesus.com from his life. Personally (having no such principles myself), I would have paid his rent, kept him entombed for a while, then auctioned off Jesus.com to the highest bidder. He must be worth at least 30 pieces of silver! Fortunately, after an unfortunate series of events (including a creepy Jesus dating site offering eligible women a chance to Win a Shower With Jesus), Jesus.com finally ended up being adopted by the Metropolitan Community Church, https://mcchurch.org https://mcchurch.org (not affiliated with McDonalds), which is pretty good, as churches go. (Their French Friars are excellent!) https://jesus.com https://jesus.com => https://mcchurch.org https://mcchurch.org >About Metropolitan Community Churches (MCC) >Founded in 1968, Metropolitan Community Churches (MCC) has been at the vanguard of civil and human rights movements by addressing issues of race, gender, sexual orientation, economics, climate change, aging, and global human rights. MCC was the first to perform same-gender marriages and has been on the forefront of the struggle towards marriage equality in the USA and other countries worldwide. >MCC recognizes a state of need around the world in the areas of human rights and justice including but not limited to the Lesbian, Gay, Bisexual, Transgender, and Queer community. As people of faith, MCC endeavors to build bridges that liberate and unite voices of sacred defiance. MCC leads from the margins and transforms. https://www.namepros.com/threads/anyone-remember-jesus-com.151376/ https://www.namepros.com/threads/anyone-remember-jesus-com.1... http://web.archive.org/web/20001013080300/http://jesus.com/ http://web.archive.org/web/20001013080300/http://jesus.com/ http://web.archive.org/web/20001109055800/http://jesus.com/shower/ http://web.archive.org/web/20001109055800/http://jesus.com/s... http://web.archive.org/web/20001109045900/http://jesus.com/faq.html http://web.archive.org/web/20001109045900/http://jesus.com/f... 16. Why don't you use this web site to tell people about the real Jesus? If people cannot find what they need to know about Jesus then they are truly beyond hope. 17. Will you sell your domain to me? If you can write a check for 10+ million we might have something to talk about.
- thinkingkong 6y agoI wonder if this is related to the yg account being stolen / suspended at Github.
- andersco 6y agoI almost wish this attack had been perpetrated by sophisticated govt hackers. The fact that it was some kids still living at home is almost more scary. But the silver lining is this was hopefully a wake up call for Twitter.
- ngcc_hk 6y agoThe story is so real. It is a surprise if they do not just do the slow kill. The donation one is great as it looks harmless. I bet those may not be aware that it is fake. And if there are messages enough ... It could be a bigger news. Luckily it is not nation. But if a kid can do it ...
- hmmazoids 6y agoI finally understand why I kept seeing headlines saying "the Twitter hack could have been much worse"
- ajsharp 6y agoI created Sharesecret (https://sharesecret.co https://sharesecret.co) to protect against exactly these kinds of attacks. Most company Slacks are a ticking timebomb of sensitive artifacts waiting to be discovered. Whether it's passwords or just general internal info you wouldn't want to be public, it's wild how much sensitive info is sitting in like 4 systems (Slack, Gmail, Notion, Dropbox). Protect y'selves people.
- sarakayakomzin 6y ago>All encrypted at rest. https://en.wikipedia.org/wiki/Security_theater https://en.wikipedia.org/wiki/Security_theater
- grishka 6y agoA proprietary security product. That's always funny.
- ecf 6y agohttps://github.com/pinterest/snappass https://github.com/pinterest/snappass An Open-source and self-hosted version of what this service seems to be doing.
- ajsharp 6y agoIn addition to basic secret sharing, Sharesecret has a slack extension that detects different types of potentially sensitive data and alerts the sender to redact and encrypt to get it out of Slack. We also have an auto-destructing private chat feature.
- ajsharp 6y agoWhat's funny about it?
- LockAndLol 6y agoLooks like in a few months we'll have another article about these kids being arrested and dragged in front of a judge - or they'll silently be recruited by the state. They could've just deleted all accounts, cleaned up after themselves and made it difficult to be tracked down. With the information they gave, it wouldn't surprise me if 4chan anons were able to track them down and spam their details "for the lulz".
- jakeogh 6y agoAh the sourceless NYTimes. Totally just a news org. https://gawker.com/here-are-some-top-n-y-times-editors-and-staff-joking-a-1713336525 https://gawker.com/here-are-some-top-n-y-times-editors-and-s... Still run by the BBC's Mark Thompson. https://imgur.com/VUdcIou https://imgur.com/VUdcIou https://pbs.twimg.com/media/CIMxvS-WEAER49I.png https://pbs.twimg.com/media/CIMxvS-WEAER49I.png https://pbs.twimg.com/media/CINJUoqUwAEkSip.jpg https://pbs.twimg.com/media/CINJUoqUwAEkSip.jpg
- jakeogh 6y agoI don't say it lightly. The New York Times is not what it pretends to be. https://twitter.com/TuckerCarlson/status/1285386153093464065 https://twitter.com/TuckerCarlson/status/1285386153093464065 https://news.ycombinator.com/item?id=23880201 https://news.ycombinator.com/item?id=23880201 https://news.ycombinator.com/item?id=21367594 https://news.ycombinator.com/item?id=21367594