15 ms·

An update on our security incident

547 points by psanford 6y ago

minimaxir 6y ago
This is one hell of a Friday night news dump.
txcwpalpha 6y ago
>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts? edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be of note than just DMs. I wonder what risks there are to knowing, for example, the past IP addresses and geolocations that VIP politicians access Twitter from? Hopefully they're behind a government VPN. 0: https://help.twitter.com/en/managing-your-account/accessing-your-twitter-data https://help.twitter.com/en/managing-your-account/accessing-...
- SV_BubbleTime 6y ago
  From what I saw most of the “famous” accounts are surely run by PR teams. I doubt Obama has touched the Obama account let alone DM’ed Jesse Jackson some Trump memes. But I guess it’s entirely possible that people put sensitive things in DMs and inexplicably just trusted Twitter with that info.
  - txcwpalpha 6y ago
    I think it likely varies on the person we're talking about. Is Obama personally tweeting and sending private memes in his DMs? Doubtful. Kanye or Elon Musk? I'd guess yes, actually.
    - SV_BubbleTime 6y ago
      Ah, Elon, forgot about that one. I fully believe he runs his own twitter. How else is he going to control the stock market!? ;) You’re right, I assume his would be one of the accounts that was exfil’ed
      - dlgeek 6y ago
        He's verified though, and they claim the only exfil'd accounts weren't.
        zwily 6y ago
        They didn’t say that only those 8 non-verified accounts had DMs accessed.
    - Kaveren 6y ago
      Kanye West and Elon Musk have absolutely nothing of value in their DMs. Anything you could do with access to Musk's DMs you could do better just by tweeting as Musk. There is no value in Twitter DMs.
      - aspenmayer 6y ago
        Why do you dismiss hypothetical questions out of hand, without evidence? Can one prove a negative or disprove a counterfactual statement? I just don’t know why you think that you must be right, as the actions of the hackers indicate otherwise. It’s hard to tell what is intent and what is misdirection when it comes to hacks of this nature, all the same. > Hitchens has phrased the razor in writing as "What can be asserted without evidence can also be dismissed without evidence." https://en.wikipedia.org/wiki/Hitchens%27s_razor https://en.wikipedia.org/wiki/Hitchens%27s_razor
      - albatross 6y ago
        I'm sure the folks shorting TSLA would disagree on Elon's DMs. Maybe Kanye's DMs would reveal he's really just fucking with everyone and hasn't actually completely lost it. Well... Maybe just the former.
- psanford 6y ago
  > There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0] [0]: https://twitter.com/TwitterSupport/status/1284339148774498305 https://twitter.com/TwitterSupport/status/128433914877449830...
  - txcwpalpha 6y ago
    >none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them picking solely non-verifieds.
    - WrtCdEvrydy 6y ago
      Someone pointed out that it could be targeted at activists...
      - milofeynman 6y ago
        That is exactly my worry the moment I saw they were not verified. Nation state could drop a grand per account and get data on 8 activists no problem.
        edoceo 6y ago
        Not $8k right? $1k per hacked account - which would thousands + the narrow targets?
        milofeynman 6y ago
        The NYTb article says they were selling accounts initially for $1-1.5k before trying the Bitcoin scam
- quink 6y ago
  Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. And there's no big reason to think that the exfiltration of private DMs was limited to the people that had the Bitcoin scam tweeted on their accounts. I think the Bitcoin scam was also the perfect innocuous cover story - a legitimate motive that nevertheless leaves one with the impression that the operator is a pretty small fry. So many dismissals of it's a silly scamp wanting money but only got 12 BTC, next day's news please. But it did put it out there so that the public (and the public needs to know to establish the credibility of the compromised data instantly, immediately, with no room for doubt) is aware a broad hack occurred, without even exposing who was targeted specifically and the BTC didn't matter one iota. Now they can trickle-feed what they actually got all the way until the election. Also, they don't care who'll win, just like the email hackers didn't in 2016. They just want to sow discord. Tweeting the same unrelated thing on so many accounts also sends the message that they're not on anyone's side. The only reason I think Trump didn't have anything tweeted isn't because they particularly like him, but because it gives of the image of graver national security consequences.
  - Kaveren 6y ago
    > Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. It's not that everyone is so security-minded, it's just that Twitter is an extremely inconvenient way to maintain personal relationships. > I think the Bitcoin scam was also the perfect innocuous cover story There is almost no value in DMs. Funny seeing HN speculate about these elite hackers selling them as if there's any market for them, let alone one that would pay $100k+.
    - quink 6y ago
      99.9% of the email hacks was uninteresting. 0.1% was nothingburger. That wouldn’t stop it from dominating in the media, especially with a trickle feed strategy. Google the whole ‘Spirit Cooking’ thing as a good example. Completely nothing. 0% interesting. Stupid enough to be idle Twitter DM chat. Did it hit the media just before the election and blow up? Yup.
- tdrp 6y ago
  Only slightly related, but back when GDPR was first enacted I mentioned that it would inadvertently open up some vulnerabilities and that it should have been reviewed by white hat security researchers. - "Download all my data" was mandated by GDPR (article 20) - Right to delete, right to access made it so that there is up to a ten million dollar fine if you refuse it, so you are more prone to social engineering attacks. Meaning if some user requests access or deletion, (e.g. having forgotten their password or username) you might not be 100% sure that it's him but arguing with him or asking too personal a verification proof can get you in hot water and you'd rather not get dragged into a fight with the European committee. - While our users could initially create an account without e-mails and be relatively anonymous, a couple of "right to access" requests from "users who have forgotten their username" means you are basically forced to require e-mail, thereby carrying even more PII unnecessarily. It probably wouldn't have slowed the hackers down much here though.
  - Semaphor 6y ago
    Where does it say you have to follow through with data or erasure of users who can’t prove they are who they say they are? Both of those seem like the opposite of what you are supposed to do. I just checked the first result, and even the ICO [0] says > [Your full name and address and any other details such as account number to help identify you] [0] https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/ https://ico.org.uk/your-data-matters/your-right-to-get-your-...
- paulpauper 6y ago
  maybe a girlfriend or ex girlfriend . or a rival hacker. or someone who is believed to own a lot of crypto and is low profile.
  - famouslastwords 6y ago
    Maybe they discovered Satoshi Nakamoto's Twitter account :D
sidcool 6y ago
I wish they mentioned what kind of social engineering attack it was. It could be a case study for any such incidents in the future. P.S. I feel bad for the employees who were manipulated to give away the info.
- harshreality 6y ago
  I want to know how they social engineered an employee at a 2FA-enabled company into bypassing 2FA. Was the employee able to disable 2FA for their own account? Was the employee social engineered into adding someone else's 2FA key to their account? Did the employee read a 2FA code to the attacker, and that somehow enabled all the evil things the attacker did, without any additional checks or 2FA codes? Did the attacker hack the employee's system and MITM their 2FA code without their knowledge? It doesn't sound like it, because that wouldn't be social engineering.
  - _underfl0w_ 6y ago
    Too lazy to provide a link (sorry) but KrebsOnSecurity had some screenshots of a forum user offering up access to internal tooling. The access may have been deliberately sold, not necessarily coerced.
    - SyneRyder 6y ago
      Here's the Krebs link, who claims to have identified the exact hacker behind it: https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e... Vice Motherboard interviewed the hacker, who claims the Twitter employee was paid to hack the accounts for them: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
  - lovehashbrowns 6y ago
    I wonder if it was something like DUO and employees were told to just hit approve. Get employee's password Call employee "Hey [employee], I'm [coworker] from the security team and we noticed your DUO was locked. I just enabled it, but we want to make sure it works. Hit Approve when you get a notification." Log in with password Wait for employee to hit Approve.
deleted 6y ago
[deleted]
SV_BubbleTime 6y ago
So the photos going around showing they have detrending tools might be real? Is it ethically acceptable that they “curate” what is trending? (Edit: I was actually asking, but apparently got my answer) Edit: I didn’t believe it when I saw people claiming those pictures were being deleted when posted by to twitter, but verge confirms they’re real. Trends blacklist and search blacklist. Didn’t Jack testify to Congress they do not manipulate trends? https://www.theverge.com/2020/7/15/21326656/twitter-hack-explanation-bitcoin-accounts-employee-tools https://www.theverge.com/2020/7/15/21326656/twitter-hack-exp...
- s9w 6y ago
  It's the same as the HN frontpage really
- haram_masala 6y ago
  I haven’t seen this, do you have a link?
  - natch 6y ago
    Can't tell which part you mean by "this." The pictures, or the Jack testimony. You have one of the best usernames ever btw.
- ASalazarMX 6y ago
  There has to be a trend manipulation option, otherwise the trending algorithm sooner or later will become a liability. What social media giants lack is transparency about when, why and how are trends manipulated. Transparency is also a liability for their business model.
- hire_charts 6y ago
  These blacklist tags are "not new"* and are, for the most part, a necessary moderation tool to keep explicit and/or harmful content from trending. Now, is this potentially something that could be abused to truly curate away ("censor") content from individuals, particularly conservatives, posting in good faith? Sure. It could. But let's think about this -- if Twitter didn't have these tools in place, there are plenty of bad-faith actors who would constantly push profane and/or derogatory memes up into the realm of trending content. To me, preventing such content from trending is a necessary part of the service Twitter operates. The unfortunate fact of the "profane" that there is no broad consensus around what is and isn't offensive. This means that Twitter will naturally step on toes in the process of keeping their platform friendly to the masses. I honestly don't see a way around it, and I far prefer a world where more people feel comfortable than the kinds of content I see on, cough, alternative "free speech" forums. But maybe that's just me. * source: https://www.vice.com/en_us/article/n7wdxd/twitter-blacklists-lead-the-company-into-another-trump-supporter-conspiracy https://www.vice.com/en_us/article/n7wdxd/twitter-blacklists...
koluna 6y ago
> did the attackers see any of my private information? For the vast majority of people, we believe the answer is, no. This is such a weasel-y answer. “Yes, most of Earth’s population was not affected by this breach” - sure, but those that were affected, how would you be certain that they didn’t have their private information, such as DMs, pulled?
- ezluckyfree 6y ago
  That's kind of a cynical take. I parsed that statement as saying: > did the attackers see any of my private information? For the vast majority of people [who we previously mentioned were affected by this hack], we believe the answer is, no.
  - sudosysgen 6y ago
    There is no indication that the accounts whose data was accessed were the accounts which tweeted the crypto scam. Therefore, I'm not sure that's a straightforward explanation.
    - andrewxdiamond 6y ago
      They say the attackers reset passwords on the accounts. Any competent engineering team would have a complete list of those events in logs
      - bhaak 6y ago
        You can't assume competence after such an hack. Before this has happened, you would have assumed that Twitter employees wouldn't fall for social engineering on this scale. I wonder especially how they could have bypassed their 2FA. Unless they specifically tell you something, you can't assume it to be the case.
  - summitsummit 6y ago
    > That's kind of a cynical take. Disagree. The statement could be parsed more applicably as saying: > The most important question for people who use Twitter is likely — did the attackers see any of my private information? For the vast majority of people [who use Twitter], we believe the answer is, no.
mehrdadn 6y ago
> Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. They so carefully avoiding mentioning how they do store passwords that I have to wonder what their security practices are on that front (and the rest). What tools are they available under? You'd think they would've said "passwords are hashed and salted" to rule it out entirely if that was a thing.
- judge2020 6y ago
  Wording is suspicious, you would assume they mean "they had no db access so they didn't see the hashed passwords". Hopefully it just wasn't completely thought out. The only other reference to password storage efforts: https://blog.twitter.com/en_us/a/2013/keeping-our-users-secure.html#component-wrapper:~:text=encrypted%2Fsalted%20versions%20of%20passwords https://blog.twitter.com/en_us/a/2013/keeping-our-users-secu... > attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.
- batter 6y ago
  In some old articles it was mentioned they used Bcrypt. Not sure if that has changed. Not so many new algos are proven to be good.
  - skunkworker 6y ago
    As long as they’re continually bumping the work factor it should be good for now.
    - rswail 6y ago
      If passwords are peppered as well as salted, is the bcrypt work factor a factor?
      - rocqua 6y ago
        When the pepper is compromised, the work factor still matters.
Sephr 6y ago
It's still happening. I just saw this blue checkmark account linking to cryptocurrency scams only 2 hours ago: https://twitter.com/sephr/status/1284310424855343105 https://twitter.com/sephr/status/1284310424855343105
- jordansmith 6y ago
  That’s a different scam that has been going on for years. They phish/crack random, usually inactive, verified accounts. And then they chance the display name / profile picture to Elon’s. Then they reply to his tweets with this message
- Gaelan 6y ago
  Those have been happening for a long time before this, and consist of taking over some some little-known verified account (presumably through phishing, password reuse, and other such conventional means), changeing the (non-unique) display name and profile picture to Elon Musk and doing some bitcoin scammery. The actual well-known accounts are unaffected.
- aserafini 6y ago
  I believe that’s just a fake screenshot of an Elon Musk tweet.
  - deleted 6y ago
    [deleted]
Aeolun 6y ago
I kind of like the messaging around this, but I don’t have the feeling we know an awful lot more than we did before. I’m glad they at least seem to realize all trust is gone.
electro_blah 6y ago
How did they manipulate their employees? that's the most important part don't you think?
- javajosh 6y ago
  Absolutely! Insofar as a post mortem will help others avoid the same fate, understanding the specifics of the social engineering hack is by far the most useful information they could share about what happened. My guess is that they won't because either a) they are lying about this being the underlying cause, or b) it is itself too sensitive to reveal (either about the company or the targeted individuals).
  - blablabla123 6y ago
    Yeah probably they first want to "patch" that social engineering hole which is probably quite challenging. Although I don't think Twitter is really to blame since few companies see security that critical and training on that is indeed rare. Security is almost synonymous with SSH, TLS, VPN and 2FA although this kind of attack has been published widely even before these technologies have been invented.
- Sharma 6y ago
  Exactly, that is what I was hoping to find in this article. But if they disclose it might open up new opportunities and so quite possible we would never know.
- munchbunny 6y ago
  If I had to guess, likely textbook spear phishing. If they were able to get past 2FA, then either it was weak 2FA or they stole auth tokens, not passwords. In general that approach is unreasonably effective - at least single-digit percentage points of effectiveness. Between that and just bribing support people (or they were in on it to begin with), you have the two of the most common attacks on user/customer data.
- jamestimmins 6y ago
  I actually don't think it's as important as identifying how and why those employees were able to do things like tweet on behalf of Obama. Proper access controls would have high-profile accounts extremely locked down, ideally such that no single person could independently choose to access this info.
orliesaurus 6y ago
> For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets How did they initiate a password reset and successfully reset the password to login to the account? They must've had the owners' email passwords too? EDIT: So they changed the mail associated to the accounts to their own... but the system didnt email out to "old" email to notify them of the action being taken like most companies do?
- gkoberger 6y ago
  They changed the email addresses first to an account they controlled.
- a-wu 6y ago
  As I understand it, the internal tools allow for changing the email. Change email -> password reset.
  - andrepaulj 6y ago
    If this is true then it completely defeats the purpose of a two-factor authentication
    - bawolff 6y ago
      Almost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset. 2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to
      - fmajid 6y ago
        But operations like that should require a second randomly chosen individual to verify. The reality is the public loses credentials and keys all the time and at most companies security takes a back seat to convenience and customer service.
- deleted 6y ago
speeder 6y ago
I wonder if ZeroHedge prediction might end being accurate: That attackers probably would get most of their profits from blackmailing people because of their DMs. I had hoped the hack was just API abuse to tweet in someone's name, not an actual account takeover, this introduce a whole lot of issues (including the fact some world powers use twitter... ever thought what would have happened if they had hijacked Trump's and Khamenei's accounts and started to give plausible threats to each other?)
javchz 6y ago
I will use this as an ugly reminder that it's better to assume that any DMs could be public at any moment. I don't subscribe to the "nothing to fear, if you have nothing to hide", I had conversations that are not illegal, lewd or even non-politically correct jokes, but would still hate to made public by a 3rd entity; from secrets that were shared by friends, to sensitive data like addresses, or information with clients with NDAs.
- bolasanibk 6y ago
  If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.
  - fmajid 6y ago
    Cardinal Richelieu.
- coldpie 6y ago
  > I will use this as an ugly reminder that it's better to assume that any DMs could be public at any moment. Good start, but you need to go much further. You should consider anything on an Internet-connected device could be public at any moment. As we are reminded weekly, there is no such thing as computer security in 2020.
- Can_Not 6y ago
  Just "DM" is my ugly reminder, we collectively called them PM (private messages) a decade ago.
wslack 6y ago
Nothing about how they are fixing their internal processes that enabled individual employees to do password resets. Can anyone at twitter get control of any account? That seems problematic.
FlorianRappl 6y ago
I remember that answer to "What keeps you up at night?" of a major security advisor to be "Our employees! They click everything!". Fitting video: https://www.youtube.com/watch?v=bLXW2JQ0TZk https://www.youtube.com/watch?v=bLXW2JQ0TZk Training to prevent these social engineering leaks is definitely critical.
- fmajid 6y ago
  Training is not the answer to security problems, as empirically it has no effect. The only measures that work are technological, like U2F keys.
  - tantalor 6y ago
    Technical solutions can always be defeated by social engineering. Training is supposed to prevent that.
    - isbvhodnvemrwvn 6y ago
      How do you socially engineer someone to compromise their U2F-based dongle?
      - tantalor 6y ago
        "Hi I'm from tech support, I need you to go and generate some new backup codes. Now read them to me. Thanks!"
      - kerng 6y ago
        When U2F is widely used, there will be more social engineering tricks - like, visit this attacker website or download this tool/browser extension, put cursor in box, now please touch your key to verify your identity. Countless creative ways will be tried and discovered.
  - TheBigSalad 6y ago
    Do you have a source on that? Anecdotally, I'm better at recognizing threats after my company instituted annual training as well as simulated attacks.
tedunangst 6y ago
> on Wednesday, July 15, 2020, we detected a security incident at Twitter and took immediate action. > We became aware of the attackers’ action on Wednesday No mention of how they detected the incident or what alerted them to the attackers' action?
- bawolff 6y ago
  The fact it was world news was probably their first hint.
njsubedi 6y ago
Is there any information on whether a single employee or a number of employees were involved? I don't think the attackers could have had someone hired at Twitter Support only to carry out this attack, given how they tried to monetize. Also I suspect no more than one employee was involved, and that "social engineering" was done only to compromise their credentials, instead of asking them nicely to allow them access to multiple (130) popular accounts.
- filmgirlcw 6y ago
  Some of the people involved were interviewed by the New York Times [0] and indicated that the person who was offering access claimed they managed to get into the Twitter Slack account and saw credentials being shared. I don’t know if that is true or not, but all the external reporting doesn’t indicate that a Twitter employee was actively involved. It’s always possible someone was, but given the small amount of money made and the goal of the hackers themselves (OG accounts), it strikes me as unlikely. I would assume that any engineer with access to those types of systems would want to sell out for more than a tiny amount of crypto to some script kiddies on Discord, but you never know. [0]: https://www.nytimes.com/2020/07/17/technology/twitter-hackers-interview.html?referringSource=articleShare https://www.nytimes.com/2020/07/17/technology/twitter-hacker...
  - SyneRyder 6y ago
    > all the external reporting doesn’t indicate that a Twitter employee was actively involved Joseph Cox at Vice Motherboard is claiming exactly that from his interview with the hackers: "We used a rep that literally done all the work for us," one of the sources told Motherboard. The second source added they paid the Twitter insider. Motherboard granted the sources anonymity to speak candidly about a security incident. A Twitter spokesperson told Motherboard that the company is still investigating whether the employee hijacked the accounts themselves or gave hackers access to the tool. https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
exikyut 6y ago
Uhhhh.... > Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. Does this mean _current passwords ARE stored in plain text_?? IF this is the case, chances are it's because plaintext passwords more straightforward remediation and (statistically significantly) lower support times/costs. The convenience of this cannot be understated. BUT: - Twitter just leaked that current passwords are stored in plain text - Twitter just leaked that current passwords can be viewed by support tools used by employees susceptible to social engineering Again, IF this is true, it's a lesson about the privacy and security risks ever-more-frequently associated with convenience (in this case internal convenience).
- anandoza 6y ago
  They mean "previous" as in before the hackers did the password resets. (So all your passwords, except the one the hackers set.) I don't think this implies a problem with "your current password" security, just that you don't care if the hackers have the password that they set themselves (and clearly already know then).
- deleted 6y ago
  [deleted]
zamalek 6y ago
> 2FA compromised This is why sending or generating a OTP, that the user types in, is not secure. The user can be tricked into handing the OTP over the phone. Even the O365 system isn't secure (because the user can be told which number to tap over the phone). The only secure authentication these days is a non-communicable possession: Yubikey or similar. This reflects *very poorly on Twitter opsec.
- bawolff 6y ago
  very poorly is a bit much. Yes yubikey would be much better, but its not exactly standard across the industry yet. For something to reflect very poorly on twitter opsec, I would expect it to be something that is below what the average tech company was doing. e.g. There was some news article claiming [Without a whole lot of evidence] that the compromised tool used a shared password that was posted as the topic of a slack channel. Now if that was actually true, I think that would fit the description of "very poor" opsec.
  - thallada 6y ago
    Twitter is not an average company. As one of the top 40 internet companies, they are in the position of setting industry standards. I think it's fair to expect more than what the average company does from Twitter.
    - brongondwana 6y ago
      For security internally, sure. Mandating that every one of your customers has a Yubikey is somewhat trickier to do in practice, and a nightmare to manage the logistics around lost keys. I personally have 3 Yubikeys, one on my keyring, one in my small first aid kit (which is kept in my backpack and usually close to me) and one that doesn't ever travel with me. We give our staff yubikeys and require them to use them for services where we have customer data (including logins to our own service). And we support them for our customers to use, but mandating that all our customers have physical 2FA devices to protect their own accounts is still a bridge very much too far today.
filmgirlcw 6y ago
It’s interesting that the Your Data tool only started including DMs after GDPR stuff went into effect. For many years, DMs weren’t part of the archive. When the feature was added in late 2018 or early 2019, it became clear that Twitter actually maintained an archive of all DMs, whether you had previously deleted them or not. I’m glad this was only 8 accounts — but it’s a good reminder that DMs aren’t encrypted or secure and shouldn’t be used that way.
Shank 6y ago
> As mentioned above, we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness and will provide more technical details, where possible, in the future. With all due respect, I have no confidence in measures that aren’t transparent and open. They can share a lot of details without risking security, but by being vague about remediations, they’re being obscure, not secure. If they posted their exact remediations (hiding sensitive parts like precise information needed to take control of an admin account or use it), they would have an entire world of security experts ready to critique their plans. Instead, we have to trust and hope they get it right the second time.
withinrafael 6y ago
It would be helpful if Twitter supported the deletion of Direct Messages for all parties, as they do with public tweets. Right now, they just sit around in at least one party's inbox and accumulate, creating a valuable cache of private information. (Twitter's implementation of Direct Messaging aligns more closely with instant messaging than email, therefore I believe a real deletion feature isn't an unreasonable expectation or ask.)
aaron695 6y ago
> None of the eight were verified accounts. So.... Lowerclass plebs we don't care about as much? It's funny they admit this.
- jobigoud 6y ago
  They are simply stating a relevant fact, you seem to be reading a jugement that's not there.
product50 6y ago
What a joke of a company. They literally have done nothing in terms of building innovative products in the past 7 yrs since IPO and their monthly active users is static. And then, to distract away from their poor product roadmap, they take controversial political stands - but which don't result in any major impact given mostly bots and celebrities use that platform. And now this. Keep in mind, some 4k employees work in this jungle. Don't know what they do apart from just tweeting #lovewhereyouwork
- Maxious 6y ago
  > In 2009, an 18-year-old hacker from the US managed to gain access to Twitter’s back-end systems by targeting a member of the company’s support staff https://decrypt.co/35911/6-times-twitters-security-was-breached https://decrypt.co/35911/6-times-twitters-security-was-breac...
vaxman 6y ago
We need the guys at CMU (who also operate CERT) to engineer a replacement and setup a program for interns to operate it as a private non-profit for the rest of time. The system that is out there now has been a running technological joke since it was (sort of) running on Windows and it would be My_ dust now if it weren't for the President who they now (rightly or wrongly) scorn. Some seriously bad things can (and probably are going to) happen to actual human beings because of that s*faced idiot phoning it in for way too long. He doesn't get to impact the democracy or influence the beating of other human beings hearts because he is not competent or careful enough to be trusted in such capacity.
- syspec 6y ago
  Could you provide more context?
  - vaxman 6y ago
    Did hackers download DIRECT MESSAGES from some Twitter accounts, something that should not be possible were the system correctly engineered and professionally operated? Would it be naive to expect that this is the first time this mechanism has been used just because it is new to the Public? If this mechanism has been used before, would it not be safe to assume that sponsors with virtually unlimited resources (such as foreign states) would have employed it to spy on their adversaries? Would it be logical to conclude that the consequences of such adversaries having their DIRECT MESSAGES revealed resulted in personal injury and loss to those individuals and their associated social graph? Wasn't Twitter a system setup by some beach bums using a bunch of old buggy Windows systems that barely worked and although it has been reengineered, isn't that same group still calling the shots (only now amplified ten orders of magnitude by additional funding)? Shouldn't there be a better system, setup and operated by the best software engineers (like those at CMU) available to the Public along with a clear indication of why? --You know, before anyone else realizes personal injury or loss due to the actions of distracted beach bums calling the shots on the current system?
LeicaLatte 6y ago
I don’t understand the hubbub. It’s just a stupid messaging network. Not our emails that got hacked. I think this is relevant here - https://m.youtube.com/watch?feature=emb_title&v=MjufyLPKsEw https://m.youtube.com/watch?feature=emb_title&v=MjufyLPKsEw
- Bnshsysjab 6y ago
  Twitter has a far wider reach than the large majority of email accounts, and is very public.
- squarefoot 6y ago
  It's indeed a stupid messaging network, but having seen doctors and lawyers happily exchange documents and other sensitive data about their patients and clients through Facebook and Whatsapp, I wouldn't be surprised at all if it turns out that Twitter is being used for sensitive information as well. Scanning a document and sending it through mail has been swapped with taking a photo with the cellphone and sending it through Whatsapp, and whoever took the photo very often forgets about it, so we have thousands of people out there with their phones loaded with sensitive data about their clients in the same directories they keep photos of their cats. Want to get sensitive data about someone? Just know where his doctor/lawyer lives or works, then open a cellphone repair shop nearby and be ready to copy everything when they bring you the terminal for screen/battery replacement or other problems, probably at least twice a year overall.
cryptozeus 6y ago
This seems like just a PR blog, there is no information here that everyone already does not know.
deleted 6y ago
[deleted]
iso947 6y ago
So a single twitter support person can take over the account of Biden and Musk?
deleted 6y ago
[deleted]
tiku 6y ago
Immediate action? The Dutch politicians account was hijacked for a whole day.
- spoopyskelly 6y ago
  The immediate action is only for people that matter.
  - tester756 6y ago
    I don't understand. The Dutch politicians fit that description
KingOfCoders 6y ago
I think the Bitcoin scam is a red herring.
- longtom 6y ago
  What could it be distracting from, or what would be the purpose of running a smaller/dumber attack before the actual one?
  - TheBigSalad 6y ago
    Whenever people start speculating that some dumb crime is a small part of some mastermind plot, you can rest assured that it's probably not.
  - rement 6y ago
    That kinda depends on the "up to eight accounts" the attacker downloaded the data for.
honkycat 6y ago
This is pathetic. How the hell did a comapny as rich as Twitter not have a break-glass around accessing this data. No one person should have had this level of access. No TWO people should have had this level of access. Unbelievable.
- ehsankia 6y ago
  I don't think they "accessed" any data directly, rather they used the support access to initiate an account recovery (which I assume is very common, to help people who have lost their 2FA), and from there were able to take over the account. I do agree that there should probably be higher limits around initiating password reset for some very high value accounts.
xiphias2 6y ago
,,We became aware of the attackers’ action on Wednesday, and moved quickly to lock down and regain control of the compromised accounts.'' They don't write about the fact that they let the scam going on for hours destroying lives of people. Locking down the accounts actually helped.the scammers, as the owners of the accounts or other Twitter employees weren't able to delete the scam messages.
- joshl32532 6y ago
  > the fact that they let the scam going on for hours destroying lives of people Source?
  - xiphias2 6y ago
    You can look at the blockchain how much money people lost, and for how long the scam went on. Or you can just read Twitter's announcement: they did nothing to mitigate the scam. I remember being scammed for about $200 when I was a teenager and it was awful. I was ashamed of myself.
    - nullc 6y ago
      Has anyone stepped forward and claimed they were scammed yet? It's normal for scammers to pay themselves to make their scam look more legitimate. If no one steps forward... it's not impossible that they actually didn't manage to scam anyone.
      - xiphias2 6y ago
        You're right, but it's also normal for people to be ashamed of getting scammed and not come forward. I have a friend who got scammed by altcoiners and lost most of his BTC even though I warned him many times. He didn't tell me this for many years because he was ashamed. At this time he doesn't have any chance of buying so many Bitcoins again ever in his life. Leaving those messages up for so much time (at least an hour) was unacceptable anyways. When I was holding a pager for a product that impacted millions of people, my job was to mitigate all problems that could affect them as soon as I could.
mschuster91 6y ago
Let me guess, their internal support tools were available on the wide Internet instead of requiring the additional step of a VPN with certificate+password based login?
mywacaday 6y ago
Why do companies store previous passworda, does this make my now strong passwords moot due to not being being as security conscious previously and reusing passwords?
- djm_ 6y ago
  Generally if a service was to keep them it would be to keep a history of passwords you may not use ever again. They wouldn't be available for use in authentication. Obviously this is very implementation specific though, and can't be considered a rule.
thallavajhula 6y ago
I like how Twitter wrote this post. It's apologetic, transparent, and clear. I feel like Cloudflare and Twitter have been really good with communicating what has happened and that is impressive. I'm glad these companies have learned from others' mistakes. Being transparent is the starting point of gaining back lost trust.
- dsukhin 6y ago
  Agree, this is transparent, self aware, and takes responsibility. Kudos to Twitter. It's in stark contrast to how FB wrote the post this week about their SDK crashing a bunch of third party apps. Some PR firm did all sorts of verbal gymnastics to avoid actually apologizing and taking real responsibility by shifting blame. [1] [1] https://news.ycombinator.com/item?id=23827885 https://news.ycombinator.com/item?id=23827885
  - PascLeRasc 6y ago
    I've been a big fan of Twitter's engineering blog and how they're able to give historical context for why they made certain decisions. For example this recent post about search indexing could have been a university lecture: https://blog.twitter.com/engineering/en_us/topics/infrastructure/2020/reducing-search-indexing-latency-to-one-second.html https://blog.twitter.com/engineering/en_us/topics/infrastruc...
- tester756 6y ago
  I do believe that the point >In cases where an account was taken over by the attacker, they may have been able to view additional information Is kinda downplayed by wording
hummel 6y ago
I believe it's much more interesting to know that the attackers got the email and personal phones of the involved targeted users, that means they will explore new vectors to attack them from other sources. That alone is more valuable than 100K USD, I guess all affected users going to change their emails and phones asap, but probably it will be late. My theory is the public tweet storm was just to kill the exploit in public, they can be accesing and using the tools for very long time without anyone from twitter noticing.
- beervirus 6y ago
  If they got access by triggering a password reset, it probably wouldn’t go unnoticed for long.
iamben 6y ago
Like many of you, I watched this rolling on Wednesday night using live verified accounts link that was widely shared. I was also just looking at the 'regular people' tab without verified accounts and saw many, many, many accounts tweeting the same "double your bitcoin" link, with the same BTC address. These weren't retweets. I'd assumed these accounts had also been compromised - was I wrong? It was far more than 130 accounts. Or was this just people copying and pasting the same message (if so why that rather than retweet)? There were so many every few seconds I assumed it was a script just running through accounts. But --- if it wasn't, what were people hoping to gain? Views on their own profile?
- adriancooney 6y ago
  Yes! I’m confused at what the automated attack was about. Possibly botnets tweeting it to distract from the real account access or to make the attack look worse than it was?
- famouslastwords 6y ago
  >Or was this just people copying and pasting the same message (if so why that rather than retweet)? There were so many every few seconds I assumed it was a script just running through accounts. But --- if it wasn't, what were people hoping to gain? Views on their own profile? Cashing in on the public attention. Social media is filled with people who would debase themselves for a little bit of attention or likes. The hack caused a lot of uproar, what better way than pretending you're were high-profile enough to be hacked too?
jnsaff2 6y ago
‘ we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness ’ Translation - it’s not fixed. Security through obscurity. Also timeline says ‘Wednesday’ post-mortem should be accurate to the minute or second.
- philjohn 6y ago
  This isn't a post mortem, it's a press release. The internal post mortem will no doubt be accurate down to the second.
- draw_down 6y ago
  Actually, it’s good that they’re communicating proactively. It’s not supposed to be a postmortem. This post sucks
- lima 6y ago
  > Also timeline says ‘Wednesday’ post-mortem should be accurate to the minute or second. That's because it took them almost two hours to stop the attack - doesn't look good.
  - sabas123 6y ago
    is two hours really that long?
    - deleted 6y ago
      [deleted]
    - rsanheim 6y ago
      When you have heads of state making insane executive proclamations via your platform, and you know that your weak sauce security is compromised — yes, it’s way too long.
      - Spivak 6y ago
        I feel like we’re elevating Twitter to something way more meaningful and official than what it really is as a large scale public community bulletin board. Like take down the forged messages, fix the hole that let them post them, issue an apology, and compensate the people who had their data stolen. No need to blow this up into something huge.
jacquesm 6y ago
To me the really irresponsible bit is that they kept the service up knowing full well there was a live attack in progress and they had not yet found a way to stop it. The Big Red Button has a place and the time to use it was last week. Given the prominence of the accounts that were compromised there isn't a shadow of doubt that shutting it down was the only responsible course of action. The world will continue to spin without Twitter for an hour or two, that this attack did as little damage as it did is because of the immaturity of the attackers, not because of Twitter being well defended. Pure luck.
- amw-zero 6y ago
  They disabled the account that were identified to be compromised. That isn’t enough?
  - emn13 6y ago
    Disabling everything would have been quicker, and there's no way they could have been certain which accounts were compromised, certainly not so early. Even now - you have to make do with the traces the attackers leave behind, but it's unlikely you have complete certainty that some traces weren't removed, or fallback backdoors perhaps placed. Also, disabling everything would have likely been only a very short term solution - just enough to tide you over until you understand roughly what's going on, likely less than an hour. How many people saw the tweets and transferred bitcoins during the period in which twitter likely could have turned off everthing, but not yet blocked access to the respective accounts? Likely very few, but perhaps not 0. Whether in retrospect that makes twitters choice to stay online reasonable depends a little on how much you think twitter just got lucky that the scope of the attack was small, or that you think they knew what they were doing.
    - iso1210 6y ago
      > How many people saw the tweets and transferred bitcoins during the period in which twitter likely could have turned off everthing, but not yet blocked access to the respective accounts At most 475 greedy idiots, average $266 each https://www.coindesk.com/chainalysis-says-bitcoin-scammed-from-twitter-users-is-on-the-move https://www.coindesk.com/chainalysis-says-bitcoin-scammed-fr... "The most prevalent address received $120,000 in bitcoin from 375 transactions. Secondary addresses received $6,700 in bitcoin from 100 transactions. An XRP wallet netted nothing."
lindaberry22 6y ago
Hello I’m Linda from Georgia let chat more on hangout to get know more about each other lindaberry229@gmail.com
lindaberry22 6y ago
Hello I’m Linda from Georgia let chat more on hangout to get know more about each other lindaberry229@gmail.com
caiobegotti 6y ago
This postmortem (if it exists at all) will never see the light of the day...
based2 6y ago
Was this linked to the coming changes of the new API? https://blog.twitter.com/developer/en_us/topics/tools/2020/introducing_new_twitter_api.html https://blog.twitter.com/developer/en_us/topics/tools/2020/i...
- awake 6y ago
  They posted yesterday that it was not linked. but they delayed the release because of the incident.
linux_devil 6y ago
Makes me think if social engineering is easier to do when employees are working from home.
gagabity 6y ago
What I get is even if they had the credentials of internal tools how did they actually access the internal network? Surely the internal tools are not just accessible on the open internet without VPNing into Twitters internal network?
Krasnol 6y ago
> Attackers were able to view personal information including email addresses and phone numbers, which are displayed to some users of our internal support tools. Can anyone explain to me why the phone number is stored in plain text for them to see?
- TheBigSalad 6y ago
  In case you need to call them?
  - Krasnol 6y ago
    And there is no way to secure them meanwhile? This is horrible. Twitter forced me at some point to provide my phone number. I never wanted it.
actuator 6y ago
They seem to be tiptoeing around without providing actual extent of the hack. They mentioned data exports being used for 8 non verified accounts, but haven't mentioned "direct messages" as the thing that were not accessed for other accounts. Twitter tracks user engagement, so it should be possible for them to have this information either from logs/user analytics. I would be very wary of using their product's DMs now. Considering most journalists use Twitter, I can only hope that no one had used DMs to contact a journalist about something which can put the source in jeopardy.
- chapium 6y ago
  They don't want to say what happened. It sounds like the problem is negligence in security design and not just a few employees who were manipulated.
  - actuator 6y ago
    Yeah, I can understand why they wouldn't want to say much as something like your DMs were accessed will lead to a lot of bad press; but they can't really keep hiding behind that. The less they say, the more the people who are privacy/security conscious will doubt their product. I don't know how people use DMs on Twitter but if they are anywhere close to the general usage of Signal/WhatsApp/iMessage/Messenger etc. It is incredibly bad for them and something which can kill the platform unless they rethink that completely considering they don't even have E2E.
andwaal 6y ago
Not sure if it has been mentioned previous, but Reply All did an episode on sim swaping and OG handles https://gimletmedia.com/shows/reply-all/49ho5a/130-the-snapchat-thief https://gimletmedia.com/shows/reply-all/49ho5a/130-the-snapc...
goatinaboat 6y ago
Any comment on the buttons for blacklist trending and blacklist search?
hiimtroymclure 6y ago
> Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. I feel stupid for just realizing that social media account save previous passwords? How far back does it go?
- tucif 6y ago
  Probably just the old hashes to prevent a user from reusing the last N passwords. If you know the value of N (from UI errors trying to reuse one) and want them to get rid of an old hash for some reason then you could reset your password N times.
drummer 6y ago
There's no way to earn back trust after Twitter's shadow ban functionality got exposed through the leaked screenshots. Censorship is a terrible sin.

547 points by psanford 6y ago

This is one hell of a Friday night news dump.

>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts? edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be of note than just DMs. I wonder what risks there are to knowing, for example, the past IP addresses and geolocations that VIP politicians access Twitter from? Hopefully they're behind a government VPN. 0: https://help.twitter.com/en/managing-your-account/accessing-your-twitter-data https://help.twitter.com/en/managing-your-account/accessing-...

SV_BubbleTime 6y ago
From what I saw most of the “famous” accounts are surely run by PR teams. I doubt Obama has touched the Obama account let alone DM’ed Jesse Jackson some Trump memes. But I guess it’s entirely possible that people put sensitive things in DMs and inexplicably just trusted Twitter with that info.
- txcwpalpha 6y ago
  I think it likely varies on the person we're talking about. Is Obama personally tweeting and sending private memes in his DMs? Doubtful. Kanye or Elon Musk? I'd guess yes, actually.
  - SV_BubbleTime 6y ago
    Ah, Elon, forgot about that one. I fully believe he runs his own twitter. How else is he going to control the stock market!? ;) You’re right, I assume his would be one of the accounts that was exfil’ed
    - dlgeek 6y ago
      He's verified though, and they claim the only exfil'd accounts weren't.
      - zwily 6y ago
        They didn’t say that only those 8 non-verified accounts had DMs accessed.
  - Kaveren 6y ago
    Kanye West and Elon Musk have absolutely nothing of value in their DMs. Anything you could do with access to Musk's DMs you could do better just by tweeting as Musk. There is no value in Twitter DMs.
    - aspenmayer 6y ago
      Why do you dismiss hypothetical questions out of hand, without evidence? Can one prove a negative or disprove a counterfactual statement? I just don’t know why you think that you must be right, as the actions of the hackers indicate otherwise. It’s hard to tell what is intent and what is misdirection when it comes to hacks of this nature, all the same. > Hitchens has phrased the razor in writing as "What can be asserted without evidence can also be dismissed without evidence." https://en.wikipedia.org/wiki/Hitchens%27s_razor https://en.wikipedia.org/wiki/Hitchens%27s_razor
    - albatross 6y ago
      I'm sure the folks shorting TSLA would disagree on Elon's DMs. Maybe Kanye's DMs would reveal he's really just fucking with everyone and hasn't actually completely lost it. Well... Maybe just the former.
psanford 6y ago
> There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0] [0]: https://twitter.com/TwitterSupport/status/1284339148774498305 https://twitter.com/TwitterSupport/status/128433914877449830...
- txcwpalpha 6y ago
  >none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them picking solely non-verifieds.
  - WrtCdEvrydy 6y ago
    Someone pointed out that it could be targeted at activists...
    - milofeynman 6y ago
      That is exactly my worry the moment I saw they were not verified. Nation state could drop a grand per account and get data on 8 activists no problem.
      - edoceo 6y ago
        Not $8k right? $1k per hacked account - which would thousands + the narrow targets?
        milofeynman 6y ago
        The NYTb article says they were selling accounts initially for $1-1.5k before trying the Bitcoin scam
quink 6y ago
Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. And there's no big reason to think that the exfiltration of private DMs was limited to the people that had the Bitcoin scam tweeted on their accounts. I think the Bitcoin scam was also the perfect innocuous cover story - a legitimate motive that nevertheless leaves one with the impression that the operator is a pretty small fry. So many dismissals of it's a silly scamp wanting money but only got 12 BTC, next day's news please. But it did put it out there so that the public (and the public needs to know to establish the credibility of the compromised data instantly, immediately, with no room for doubt) is aware a broad hack occurred, without even exposing who was targeted specifically and the BTC didn't matter one iota. Now they can trickle-feed what they actually got all the way until the election. Also, they don't care who'll win, just like the email hackers didn't in 2016. They just want to sow discord. Tweeting the same unrelated thing on so many accounts also sends the message that they're not on anyone's side. The only reason I think Trump didn't have anything tweeted isn't because they particularly like him, but because it gives of the image of graver national security consequences.
- Kaveren 6y ago
  > Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. It's not that everyone is so security-minded, it's just that Twitter is an extremely inconvenient way to maintain personal relationships. > I think the Bitcoin scam was also the perfect innocuous cover story There is almost no value in DMs. Funny seeing HN speculate about these elite hackers selling them as if there's any market for them, let alone one that would pay $100k+.
  - quink 6y ago
    99.9% of the email hacks was uninteresting. 0.1% was nothingburger. That wouldn’t stop it from dominating in the media, especially with a trickle feed strategy. Google the whole ‘Spirit Cooking’ thing as a good example. Completely nothing. 0% interesting. Stupid enough to be idle Twitter DM chat. Did it hit the media just before the election and blow up? Yup.
tdrp 6y ago
Only slightly related, but back when GDPR was first enacted I mentioned that it would inadvertently open up some vulnerabilities and that it should have been reviewed by white hat security researchers. - "Download all my data" was mandated by GDPR (article 20) - Right to delete, right to access made it so that there is up to a ten million dollar fine if you refuse it, so you are more prone to social engineering attacks. Meaning if some user requests access or deletion, (e.g. having forgotten their password or username) you might not be 100% sure that it's him but arguing with him or asking too personal a verification proof can get you in hot water and you'd rather not get dragged into a fight with the European committee. - While our users could initially create an account without e-mails and be relatively anonymous, a couple of "right to access" requests from "users who have forgotten their username" means you are basically forced to require e-mail, thereby carrying even more PII unnecessarily. It probably wouldn't have slowed the hackers down much here though.
- Semaphor 6y ago
  Where does it say you have to follow through with data or erasure of users who can’t prove they are who they say they are? Both of those seem like the opposite of what you are supposed to do. I just checked the first result, and even the ICO [0] says > [Your full name and address and any other details such as account number to help identify you] [0] https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/ https://ico.org.uk/your-data-matters/your-right-to-get-your-...
paulpauper 6y ago
maybe a girlfriend or ex girlfriend . or a rival hacker. or someone who is believed to own a lot of crypto and is low profile.
- famouslastwords 6y ago
  Maybe they discovered Satoshi Nakamoto's Twitter account :D

sidcool 6y ago

I wish they mentioned what kind of social engineering attack it was. It could be a case study for any such incidents in the future. P.S. I feel bad for the employees who were manipulated to give away the info.

harshreality 6y ago
I want to know how they social engineered an employee at a 2FA-enabled company into bypassing 2FA. Was the employee able to disable 2FA for their own account? Was the employee social engineered into adding someone else's 2FA key to their account? Did the employee read a 2FA code to the attacker, and that somehow enabled all the evil things the attacker did, without any additional checks or 2FA codes? Did the attacker hack the employee's system and MITM their 2FA code without their knowledge? It doesn't sound like it, because that wouldn't be social engineering.
- _underfl0w_ 6y ago
  Too lazy to provide a link (sorry) but KrebsOnSecurity had some screenshots of a forum user offering up access to internal tooling. The access may have been deliberately sold, not necessarily coerced.
  - SyneRyder 6y ago
    Here's the Krebs link, who claims to have identified the exact hacker behind it: https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e... Vice Motherboard interviewed the hacker, who claims the Twitter employee was paid to hack the accounts for them: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
- lovehashbrowns 6y ago
  I wonder if it was something like DUO and employees were told to just hit approve. Get employee's password Call employee "Hey [employee], I'm [coworker] from the security team and we noticed your DUO was locked. I just enabled it, but we want to make sure it works. Hit Approve when you get a notification." Log in with password Wait for employee to hit Approve.

deleted 6y ago

[deleted]

SV_BubbleTime 6y ago

So the photos going around showing they have detrending tools might be real? Is it ethically acceptable that they “curate” what is trending? (Edit: I was actually asking, but apparently got my answer) Edit: I didn’t believe it when I saw people claiming those pictures were being deleted when posted by to twitter, but verge confirms they’re real. Trends blacklist and search blacklist. Didn’t Jack testify to Congress they do not manipulate trends? https://www.theverge.com/2020/7/15/21326656/twitter-hack-explanation-bitcoin-accounts-employee-tools https://www.theverge.com/2020/7/15/21326656/twitter-hack-exp...

s9w 6y ago
It's the same as the HN frontpage really
haram_masala 6y ago
I haven’t seen this, do you have a link?
- natch 6y ago
  Can't tell which part you mean by "this." The pictures, or the Jack testimony. You have one of the best usernames ever btw.
ASalazarMX 6y ago
There has to be a trend manipulation option, otherwise the trending algorithm sooner or later will become a liability. What social media giants lack is transparency about when, why and how are trends manipulated. Transparency is also a liability for their business model.
hire_charts 6y ago
These blacklist tags are "not new"* and are, for the most part, a necessary moderation tool to keep explicit and/or harmful content from trending. Now, is this potentially something that could be abused to truly curate away ("censor") content from individuals, particularly conservatives, posting in good faith? Sure. It could. But let's think about this -- if Twitter didn't have these tools in place, there are plenty of bad-faith actors who would constantly push profane and/or derogatory memes up into the realm of trending content. To me, preventing such content from trending is a necessary part of the service Twitter operates. The unfortunate fact of the "profane" that there is no broad consensus around what is and isn't offensive. This means that Twitter will naturally step on toes in the process of keeping their platform friendly to the masses. I honestly don't see a way around it, and I far prefer a world where more people feel comfortable than the kinds of content I see on, cough, alternative "free speech" forums. But maybe that's just me. * source: https://www.vice.com/en_us/article/n7wdxd/twitter-blacklists-lead-the-company-into-another-trump-supporter-conspiracy https://www.vice.com/en_us/article/n7wdxd/twitter-blacklists...

koluna 6y ago

> did the attackers see any of my private information? For the vast majority of people, we believe the answer is, no. This is such a weasel-y answer. “Yes, most of Earth’s population was not affected by this breach” - sure, but those that were affected, how would you be certain that they didn’t have their private information, such as DMs, pulled?

ezluckyfree 6y ago
That's kind of a cynical take. I parsed that statement as saying: > did the attackers see any of my private information? For the vast majority of people [who we previously mentioned were affected by this hack], we believe the answer is, no.
- sudosysgen 6y ago
  There is no indication that the accounts whose data was accessed were the accounts which tweeted the crypto scam. Therefore, I'm not sure that's a straightforward explanation.
  - andrewxdiamond 6y ago
    They say the attackers reset passwords on the accounts. Any competent engineering team would have a complete list of those events in logs
    - bhaak 6y ago
      You can't assume competence after such an hack. Before this has happened, you would have assumed that Twitter employees wouldn't fall for social engineering on this scale. I wonder especially how they could have bypassed their 2FA. Unless they specifically tell you something, you can't assume it to be the case.
- summitsummit 6y ago
  > That's kind of a cynical take. Disagree. The statement could be parsed more applicably as saying: > The most important question for people who use Twitter is likely — did the attackers see any of my private information? For the vast majority of people [who use Twitter], we believe the answer is, no.

mehrdadn 6y ago

> Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. They so carefully avoiding mentioning how they do store passwords that I have to wonder what their security practices are on that front (and the rest). What tools are they available under? You'd think they would've said "passwords are hashed and salted" to rule it out entirely if that was a thing.

judge2020 6y ago
Wording is suspicious, you would assume they mean "they had no db access so they didn't see the hashed passwords". Hopefully it just wasn't completely thought out. The only other reference to password storage efforts: https://blog.twitter.com/en_us/a/2013/keeping-our-users-secure.html#component-wrapper:~:text=encrypted%2Fsalted%20versions%20of%20passwords https://blog.twitter.com/en_us/a/2013/keeping-our-users-secu... > attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.
batter 6y ago
In some old articles it was mentioned they used Bcrypt. Not sure if that has changed. Not so many new algos are proven to be good.
- skunkworker 6y ago
  As long as they’re continually bumping the work factor it should be good for now.
  - rswail 6y ago
    If passwords are peppered as well as salted, is the bcrypt work factor a factor?
    - rocqua 6y ago
      When the pepper is compromised, the work factor still matters.

Sephr 6y ago

It's still happening. I just saw this blue checkmark account linking to cryptocurrency scams only 2 hours ago: https://twitter.com/sephr/status/1284310424855343105 https://twitter.com/sephr/status/1284310424855343105

jordansmith 6y ago
That’s a different scam that has been going on for years. They phish/crack random, usually inactive, verified accounts. And then they chance the display name / profile picture to Elon’s. Then they reply to his tweets with this message
Gaelan 6y ago
Those have been happening for a long time before this, and consist of taking over some some little-known verified account (presumably through phishing, password reuse, and other such conventional means), changeing the (non-unique) display name and profile picture to Elon Musk and doing some bitcoin scammery. The actual well-known accounts are unaffected.
aserafini 6y ago
I believe that’s just a fake screenshot of an Elon Musk tweet.
- deleted 6y ago
  [deleted]

Aeolun 6y ago

I kind of like the messaging around this, but I don’t have the feeling we know an awful lot more than we did before. I’m glad they at least seem to realize all trust is gone.

electro_blah 6y ago

How did they manipulate their employees? that's the most important part don't you think?

javajosh 6y ago
Absolutely! Insofar as a post mortem will help others avoid the same fate, understanding the specifics of the social engineering hack is by far the most useful information they could share about what happened. My guess is that they won't because either a) they are lying about this being the underlying cause, or b) it is itself too sensitive to reveal (either about the company or the targeted individuals).
- blablabla123 6y ago
  Yeah probably they first want to "patch" that social engineering hole which is probably quite challenging. Although I don't think Twitter is really to blame since few companies see security that critical and training on that is indeed rare. Security is almost synonymous with SSH, TLS, VPN and 2FA although this kind of attack has been published widely even before these technologies have been invented.
Sharma 6y ago
Exactly, that is what I was hoping to find in this article. But if they disclose it might open up new opportunities and so quite possible we would never know.
munchbunny 6y ago
If I had to guess, likely textbook spear phishing. If they were able to get past 2FA, then either it was weak 2FA or they stole auth tokens, not passwords. In general that approach is unreasonably effective - at least single-digit percentage points of effectiveness. Between that and just bribing support people (or they were in on it to begin with), you have the two of the most common attacks on user/customer data.
jamestimmins 6y ago
I actually don't think it's as important as identifying how and why those employees were able to do things like tweet on behalf of Obama. Proper access controls would have high-profile accounts extremely locked down, ideally such that no single person could independently choose to access this info.

orliesaurus 6y ago

> For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets How did they initiate a password reset and successfully reset the password to login to the account? They must've had the owners' email passwords too? EDIT: So they changed the mail associated to the accounts to their own... but the system didnt email out to "old" email to notify them of the action being taken like most companies do?

gkoberger 6y ago
They changed the email addresses first to an account they controlled.
a-wu 6y ago
As I understand it, the internal tools allow for changing the email. Change email -> password reset.
- andrepaulj 6y ago
  If this is true then it completely defeats the purpose of a two-factor authentication
  - bawolff 6y ago
    Almost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset. 2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to
    - fmajid 6y ago
      But operations like that should require a second randomly chosen individual to verify. The reality is the public loses credentials and keys all the time and at most companies security takes a back seat to convenience and customer service.
deleted 6y ago

speeder 6y ago

I wonder if ZeroHedge prediction might end being accurate: That attackers probably would get most of their profits from blackmailing people because of their DMs. I had hoped the hack was just API abuse to tweet in someone's name, not an actual account takeover, this introduce a whole lot of issues (including the fact some world powers use twitter... ever thought what would have happened if they had hijacked Trump's and Khamenei's accounts and started to give plausible threats to each other?)

javchz 6y ago

I will use this as an ugly reminder that it's better to assume that any DMs could be public at any moment. I don't subscribe to the "nothing to fear, if you have nothing to hide", I had conversations that are not illegal, lewd or even non-politically correct jokes, but would still hate to made public by a 3rd entity; from secrets that were shared by friends, to sensitive data like addresses, or information with clients with NDAs.

bolasanibk 6y ago
If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.
- fmajid 6y ago
  Cardinal Richelieu.
coldpie 6y ago
> I will use this as an ugly reminder that it's better to assume that any DMs could be public at any moment. Good start, but you need to go much further. You should consider anything on an Internet-connected device could be public at any moment. As we are reminded weekly, there is no such thing as computer security in 2020.
Can_Not 6y ago
Just "DM" is my ugly reminder, we collectively called them PM (private messages) a decade ago.

wslack 6y ago

Nothing about how they are fixing their internal processes that enabled individual employees to do password resets. Can anyone at twitter get control of any account? That seems problematic.

FlorianRappl 6y ago

I remember that answer to "What keeps you up at night?" of a major security advisor to be "Our employees! They click everything!". Fitting video: https://www.youtube.com/watch?v=bLXW2JQ0TZk https://www.youtube.com/watch?v=bLXW2JQ0TZk Training to prevent these social engineering leaks is definitely critical.

fmajid 6y ago
Training is not the answer to security problems, as empirically it has no effect. The only measures that work are technological, like U2F keys.
- tantalor 6y ago
  Technical solutions can always be defeated by social engineering. Training is supposed to prevent that.
  - isbvhodnvemrwvn 6y ago
    How do you socially engineer someone to compromise their U2F-based dongle?
    - tantalor 6y ago
      "Hi I'm from tech support, I need you to go and generate some new backup codes. Now read them to me. Thanks!"
    - kerng 6y ago
      When U2F is widely used, there will be more social engineering tricks - like, visit this attacker website or download this tool/browser extension, put cursor in box, now please touch your key to verify your identity. Countless creative ways will be tried and discovered.
- TheBigSalad 6y ago
  Do you have a source on that? Anecdotally, I'm better at recognizing threats after my company instituted annual training as well as simulated attacks.

tedunangst 6y ago

> on Wednesday, July 15, 2020, we detected a security incident at Twitter and took immediate action. > We became aware of the attackers’ action on Wednesday No mention of how they detected the incident or what alerted them to the attackers' action?

bawolff 6y ago
The fact it was world news was probably their first hint.

njsubedi 6y ago

Is there any information on whether a single employee or a number of employees were involved? I don't think the attackers could have had someone hired at Twitter Support only to carry out this attack, given how they tried to monetize. Also I suspect no more than one employee was involved, and that "social engineering" was done only to compromise their credentials, instead of asking them nicely to allow them access to multiple (130) popular accounts.

filmgirlcw 6y ago
Some of the people involved were interviewed by the New York Times [0] and indicated that the person who was offering access claimed they managed to get into the Twitter Slack account and saw credentials being shared. I don’t know if that is true or not, but all the external reporting doesn’t indicate that a Twitter employee was actively involved. It’s always possible someone was, but given the small amount of money made and the goal of the hackers themselves (OG accounts), it strikes me as unlikely. I would assume that any engineer with access to those types of systems would want to sell out for more than a tiny amount of crypto to some script kiddies on Discord, but you never know. [0]: https://www.nytimes.com/2020/07/17/technology/twitter-hackers-interview.html?referringSource=articleShare https://www.nytimes.com/2020/07/17/technology/twitter-hacker...
- SyneRyder 6y ago
  > all the external reporting doesn’t indicate that a Twitter employee was actively involved Joseph Cox at Vice Motherboard is claiming exactly that from his interview with the hackers: "We used a rep that literally done all the work for us," one of the sources told Motherboard. The second source added they paid the Twitter insider. Motherboard granted the sources anonymity to speak candidly about a security incident. A Twitter spokesperson told Motherboard that the company is still investigating whether the employee hijacked the accounts themselves or gave hackers access to the tool. https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...

exikyut 6y ago

Uhhhh.... > Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. Does this mean _current passwords ARE stored in plain text_?? IF this is the case, chances are it's because plaintext passwords more straightforward remediation and (statistically significantly) lower support times/costs. The convenience of this cannot be understated. BUT: - Twitter just leaked that current passwords are stored in plain text - Twitter just leaked that current passwords can be viewed by support tools used by employees susceptible to social engineering Again, IF this is true, it's a lesson about the privacy and security risks ever-more-frequently associated with convenience (in this case internal convenience).

anandoza 6y ago
They mean "previous" as in before the hackers did the password resets. (So all your passwords, except the one the hackers set.) I don't think this implies a problem with "your current password" security, just that you don't care if the hackers have the password that they set themselves (and clearly already know then).
deleted 6y ago
[deleted]

zamalek 6y ago

> 2FA compromised This is why sending or generating a OTP, that the user types in, is not secure. The user can be tricked into handing the OTP over the phone. Even the O365 system isn't secure (because the user can be told which number to tap over the phone). The only secure authentication these days is a non-communicable possession: Yubikey or similar. This reflects *very poorly on Twitter opsec.

bawolff 6y ago
very poorly is a bit much. Yes yubikey would be much better, but its not exactly standard across the industry yet. For something to reflect very poorly on twitter opsec, I would expect it to be something that is below what the average tech company was doing. e.g. There was some news article claiming [Without a whole lot of evidence] that the compromised tool used a shared password that was posted as the topic of a slack channel. Now if that was actually true, I think that would fit the description of "very poor" opsec.
- thallada 6y ago
  Twitter is not an average company. As one of the top 40 internet companies, they are in the position of setting industry standards. I think it's fair to expect more than what the average company does from Twitter.
  - brongondwana 6y ago
    For security internally, sure. Mandating that every one of your customers has a Yubikey is somewhat trickier to do in practice, and a nightmare to manage the logistics around lost keys. I personally have 3 Yubikeys, one on my keyring, one in my small first aid kit (which is kept in my backpack and usually close to me) and one that doesn't ever travel with me. We give our staff yubikeys and require them to use them for services where we have customer data (including logins to our own service). And we support them for our customers to use, but mandating that all our customers have physical 2FA devices to protect their own accounts is still a bridge very much too far today.

filmgirlcw 6y ago

It’s interesting that the Your Data tool only started including DMs after GDPR stuff went into effect. For many years, DMs weren’t part of the archive. When the feature was added in late 2018 or early 2019, it became clear that Twitter actually maintained an archive of all DMs, whether you had previously deleted them or not. I’m glad this was only 8 accounts — but it’s a good reminder that DMs aren’t encrypted or secure and shouldn’t be used that way.

Shank 6y ago

> As mentioned above, we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness and will provide more technical details, where possible, in the future. With all due respect, I have no confidence in measures that aren’t transparent and open. They can share a lot of details without risking security, but by being vague about remediations, they’re being obscure, not secure. If they posted their exact remediations (hiding sensitive parts like precise information needed to take control of an admin account or use it), they would have an entire world of security experts ready to critique their plans. Instead, we have to trust and hope they get it right the second time.

withinrafael 6y ago

It would be helpful if Twitter supported the deletion of Direct Messages for all parties, as they do with public tweets. Right now, they just sit around in at least one party's inbox and accumulate, creating a valuable cache of private information. (Twitter's implementation of Direct Messaging aligns more closely with instant messaging than email, therefore I believe a real deletion feature isn't an unreasonable expectation or ask.)

aaron695 6y ago

> None of the eight were verified accounts. So.... Lowerclass plebs we don't care about as much? It's funny they admit this.

jobigoud 6y ago
They are simply stating a relevant fact, you seem to be reading a jugement that's not there.

product50 6y ago

What a joke of a company. They literally have done nothing in terms of building innovative products in the past 7 yrs since IPO and their monthly active users is static. And then, to distract away from their poor product roadmap, they take controversial political stands - but which don't result in any major impact given mostly bots and celebrities use that platform. And now this. Keep in mind, some 4k employees work in this jungle. Don't know what they do apart from just tweeting #lovewhereyouwork

Maxious 6y ago
> In 2009, an 18-year-old hacker from the US managed to gain access to Twitter’s back-end systems by targeting a member of the company’s support staff https://decrypt.co/35911/6-times-twitters-security-was-breached https://decrypt.co/35911/6-times-twitters-security-was-breac...

vaxman 6y ago

We need the guys at CMU (who also operate CERT) to engineer a replacement and setup a program for interns to operate it as a private non-profit for the rest of time. The system that is out there now has been a running technological joke since it was (sort of) running on Windows and it would be My_ dust now if it weren't for the President who they now (rightly or wrongly) scorn. Some seriously bad things can (and probably are going to) happen to actual human beings because of that s*faced idiot phoning it in for way too long. He doesn't get to impact the democracy or influence the beating of other human beings hearts because he is not competent or careful enough to be trusted in such capacity.

syspec 6y ago
Could you provide more context?
- vaxman 6y ago
  Did hackers download DIRECT MESSAGES from some Twitter accounts, something that should not be possible were the system correctly engineered and professionally operated? Would it be naive to expect that this is the first time this mechanism has been used just because it is new to the Public? If this mechanism has been used before, would it not be safe to assume that sponsors with virtually unlimited resources (such as foreign states) would have employed it to spy on their adversaries? Would it be logical to conclude that the consequences of such adversaries having their DIRECT MESSAGES revealed resulted in personal injury and loss to those individuals and their associated social graph? Wasn't Twitter a system setup by some beach bums using a bunch of old buggy Windows systems that barely worked and although it has been reengineered, isn't that same group still calling the shots (only now amplified ten orders of magnitude by additional funding)? Shouldn't there be a better system, setup and operated by the best software engineers (like those at CMU) available to the Public along with a clear indication of why? --You know, before anyone else realizes personal injury or loss due to the actions of distracted beach bums calling the shots on the current system?

LeicaLatte 6y ago

I don’t understand the hubbub. It’s just a stupid messaging network. Not our emails that got hacked. I think this is relevant here - https://m.youtube.com/watch?feature=emb_title&v=MjufyLPKsEw https://m.youtube.com/watch?feature=emb_title&v=MjufyLPKsEw

Bnshsysjab 6y ago
Twitter has a far wider reach than the large majority of email accounts, and is very public.
squarefoot 6y ago
It's indeed a stupid messaging network, but having seen doctors and lawyers happily exchange documents and other sensitive data about their patients and clients through Facebook and Whatsapp, I wouldn't be surprised at all if it turns out that Twitter is being used for sensitive information as well. Scanning a document and sending it through mail has been swapped with taking a photo with the cellphone and sending it through Whatsapp, and whoever took the photo very often forgets about it, so we have thousands of people out there with their phones loaded with sensitive data about their clients in the same directories they keep photos of their cats. Want to get sensitive data about someone? Just know where his doctor/lawyer lives or works, then open a cellphone repair shop nearby and be ready to copy everything when they bring you the terminal for screen/battery replacement or other problems, probably at least twice a year overall.

cryptozeus 6y ago

This seems like just a PR blog, there is no information here that everyone already does not know.

deleted 6y ago

[deleted]

iso947 6y ago

So a single twitter support person can take over the account of Biden and Musk?

deleted 6y ago

[deleted]

tiku 6y ago

Immediate action? The Dutch politicians account was hijacked for a whole day.

spoopyskelly 6y ago
The immediate action is only for people that matter.
- tester756 6y ago
  I don't understand. The Dutch politicians fit that description

KingOfCoders 6y ago

I think the Bitcoin scam is a red herring.

longtom 6y ago
What could it be distracting from, or what would be the purpose of running a smaller/dumber attack before the actual one?
- TheBigSalad 6y ago
  Whenever people start speculating that some dumb crime is a small part of some mastermind plot, you can rest assured that it's probably not.
- rement 6y ago
  That kinda depends on the "up to eight accounts" the attacker downloaded the data for.

honkycat 6y ago

This is pathetic. How the hell did a comapny as rich as Twitter not have a break-glass around accessing this data. No one person should have had this level of access. No TWO people should have had this level of access. Unbelievable.

ehsankia 6y ago
I don't think they "accessed" any data directly, rather they used the support access to initiate an account recovery (which I assume is very common, to help people who have lost their 2FA), and from there were able to take over the account. I do agree that there should probably be higher limits around initiating password reset for some very high value accounts.

xiphias2 6y ago

,,We became aware of the attackers’ action on Wednesday, and moved quickly to lock down and regain control of the compromised accounts.'' They don't write about the fact that they let the scam going on for hours destroying lives of people. Locking down the accounts actually helped.the scammers, as the owners of the accounts or other Twitter employees weren't able to delete the scam messages.

joshl32532 6y ago
> the fact that they let the scam going on for hours destroying lives of people Source?
- xiphias2 6y ago
  You can look at the blockchain how much money people lost, and for how long the scam went on. Or you can just read Twitter's announcement: they did nothing to mitigate the scam. I remember being scammed for about $200 when I was a teenager and it was awful. I was ashamed of myself.
  - nullc 6y ago
    Has anyone stepped forward and claimed they were scammed yet? It's normal for scammers to pay themselves to make their scam look more legitimate. If no one steps forward... it's not impossible that they actually didn't manage to scam anyone.
    - xiphias2 6y ago
      You're right, but it's also normal for people to be ashamed of getting scammed and not come forward. I have a friend who got scammed by altcoiners and lost most of his BTC even though I warned him many times. He didn't tell me this for many years because he was ashamed. At this time he doesn't have any chance of buying so many Bitcoins again ever in his life. Leaving those messages up for so much time (at least an hour) was unacceptable anyways. When I was holding a pager for a product that impacted millions of people, my job was to mitigate all problems that could affect them as soon as I could.

mschuster91 6y ago

Let me guess, their internal support tools were available on the wide Internet instead of requiring the additional step of a VPN with certificate+password based login?

mywacaday 6y ago

Why do companies store previous passworda, does this make my now strong passwords moot due to not being being as security conscious previously and reusing passwords?

djm_ 6y ago
Generally if a service was to keep them it would be to keep a history of passwords you may not use ever again. They wouldn't be available for use in authentication. Obviously this is very implementation specific though, and can't be considered a rule.

thallavajhula 6y ago

I like how Twitter wrote this post. It's apologetic, transparent, and clear. I feel like Cloudflare and Twitter have been really good with communicating what has happened and that is impressive. I'm glad these companies have learned from others' mistakes. Being transparent is the starting point of gaining back lost trust.

dsukhin 6y ago
Agree, this is transparent, self aware, and takes responsibility. Kudos to Twitter. It's in stark contrast to how FB wrote the post this week about their SDK crashing a bunch of third party apps. Some PR firm did all sorts of verbal gymnastics to avoid actually apologizing and taking real responsibility by shifting blame. [1] [1] https://news.ycombinator.com/item?id=23827885 https://news.ycombinator.com/item?id=23827885
- PascLeRasc 6y ago
  I've been a big fan of Twitter's engineering blog and how they're able to give historical context for why they made certain decisions. For example this recent post about search indexing could have been a university lecture: https://blog.twitter.com/engineering/en_us/topics/infrastructure/2020/reducing-search-indexing-latency-to-one-second.html https://blog.twitter.com/engineering/en_us/topics/infrastruc...
tester756 6y ago
I do believe that the point >In cases where an account was taken over by the attacker, they may have been able to view additional information Is kinda downplayed by wording

hummel 6y ago

I believe it's much more interesting to know that the attackers got the email and personal phones of the involved targeted users, that means they will explore new vectors to attack them from other sources. That alone is more valuable than 100K USD, I guess all affected users going to change their emails and phones asap, but probably it will be late. My theory is the public tweet storm was just to kill the exploit in public, they can be accesing and using the tools for very long time without anyone from twitter noticing.

beervirus 6y ago
If they got access by triggering a password reset, it probably wouldn’t go unnoticed for long.

iamben 6y ago

Like many of you, I watched this rolling on Wednesday night using live verified accounts link that was widely shared. I was also just looking at the 'regular people' tab without verified accounts and saw many, many, many accounts tweeting the same "double your bitcoin" link, with the same BTC address. These weren't retweets. I'd assumed these accounts had also been compromised - was I wrong? It was far more than 130 accounts. Or was this just people copying and pasting the same message (if so why that rather than retweet)? There were so many every few seconds I assumed it was a script just running through accounts. But --- if it wasn't, what were people hoping to gain? Views on their own profile?

adriancooney 6y ago
Yes! I’m confused at what the automated attack was about. Possibly botnets tweeting it to distract from the real account access or to make the attack look worse than it was?
famouslastwords 6y ago
>Or was this just people copying and pasting the same message (if so why that rather than retweet)? There were so many every few seconds I assumed it was a script just running through accounts. But --- if it wasn't, what were people hoping to gain? Views on their own profile? Cashing in on the public attention. Social media is filled with people who would debase themselves for a little bit of attention or likes. The hack caused a lot of uproar, what better way than pretending you're were high-profile enough to be hacked too?

jnsaff2 6y ago

‘ we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness ’ Translation - it’s not fixed. Security through obscurity. Also timeline says ‘Wednesday’ post-mortem should be accurate to the minute or second.

philjohn 6y ago
This isn't a post mortem, it's a press release. The internal post mortem will no doubt be accurate down to the second.
draw_down 6y ago
Actually, it’s good that they’re communicating proactively. It’s not supposed to be a postmortem. This post sucks
lima 6y ago
> Also timeline says ‘Wednesday’ post-mortem should be accurate to the minute or second. That's because it took them almost two hours to stop the attack - doesn't look good.
- sabas123 6y ago
  is two hours really that long?
  - deleted 6y ago
    [deleted]
  - rsanheim 6y ago
    When you have heads of state making insane executive proclamations via your platform, and you know that your weak sauce security is compromised — yes, it’s way too long.
    - Spivak 6y ago
      I feel like we’re elevating Twitter to something way more meaningful and official than what it really is as a large scale public community bulletin board. Like take down the forged messages, fix the hole that let them post them, issue an apology, and compensate the people who had their data stolen. No need to blow this up into something huge.

jacquesm 6y ago

To me the really irresponsible bit is that they kept the service up knowing full well there was a live attack in progress and they had not yet found a way to stop it. The Big Red Button has a place and the time to use it was last week. Given the prominence of the accounts that were compromised there isn't a shadow of doubt that shutting it down was the only responsible course of action. The world will continue to spin without Twitter for an hour or two, that this attack did as little damage as it did is because of the immaturity of the attackers, not because of Twitter being well defended. Pure luck.

amw-zero 6y ago
They disabled the account that were identified to be compromised. That isn’t enough?
- emn13 6y ago
  Disabling everything would have been quicker, and there's no way they could have been certain which accounts were compromised, certainly not so early. Even now - you have to make do with the traces the attackers leave behind, but it's unlikely you have complete certainty that some traces weren't removed, or fallback backdoors perhaps placed. Also, disabling everything would have likely been only a very short term solution - just enough to tide you over until you understand roughly what's going on, likely less than an hour. How many people saw the tweets and transferred bitcoins during the period in which twitter likely could have turned off everthing, but not yet blocked access to the respective accounts? Likely very few, but perhaps not 0. Whether in retrospect that makes twitters choice to stay online reasonable depends a little on how much you think twitter just got lucky that the scope of the attack was small, or that you think they knew what they were doing.
  - iso1210 6y ago
    > How many people saw the tweets and transferred bitcoins during the period in which twitter likely could have turned off everthing, but not yet blocked access to the respective accounts At most 475 greedy idiots, average $266 each https://www.coindesk.com/chainalysis-says-bitcoin-scammed-from-twitter-users-is-on-the-move https://www.coindesk.com/chainalysis-says-bitcoin-scammed-fr... "The most prevalent address received $120,000 in bitcoin from 375 transactions. Secondary addresses received $6,700 in bitcoin from 100 transactions. An XRP wallet netted nothing."

lindaberry22 6y ago

Hello I’m Linda from Georgia let chat more on hangout to get know more about each other lindaberry229@gmail.com

lindaberry22 6y ago

Hello I’m Linda from Georgia let chat more on hangout to get know more about each other lindaberry229@gmail.com

caiobegotti 6y ago

This postmortem (if it exists at all) will never see the light of the day...

based2 6y ago

Was this linked to the coming changes of the new API? https://blog.twitter.com/developer/en_us/topics/tools/2020/introducing_new_twitter_api.html https://blog.twitter.com/developer/en_us/topics/tools/2020/i...

awake 6y ago
They posted yesterday that it was not linked. but they delayed the release because of the incident.

linux_devil 6y ago

Makes me think if social engineering is easier to do when employees are working from home.

gagabity 6y ago

What I get is even if they had the credentials of internal tools how did they actually access the internal network? Surely the internal tools are not just accessible on the open internet without VPNing into Twitters internal network?

Krasnol 6y ago

> Attackers were able to view personal information including email addresses and phone numbers, which are displayed to some users of our internal support tools. Can anyone explain to me why the phone number is stored in plain text for them to see?

TheBigSalad 6y ago
In case you need to call them?
- Krasnol 6y ago
  And there is no way to secure them meanwhile? This is horrible. Twitter forced me at some point to provide my phone number. I never wanted it.

actuator 6y ago

They seem to be tiptoeing around without providing actual extent of the hack. They mentioned data exports being used for 8 non verified accounts, but haven't mentioned "direct messages" as the thing that were not accessed for other accounts. Twitter tracks user engagement, so it should be possible for them to have this information either from logs/user analytics. I would be very wary of using their product's DMs now. Considering most journalists use Twitter, I can only hope that no one had used DMs to contact a journalist about something which can put the source in jeopardy.

chapium 6y ago
They don't want to say what happened. It sounds like the problem is negligence in security design and not just a few employees who were manipulated.
- actuator 6y ago
  Yeah, I can understand why they wouldn't want to say much as something like your DMs were accessed will lead to a lot of bad press; but they can't really keep hiding behind that. The less they say, the more the people who are privacy/security conscious will doubt their product. I don't know how people use DMs on Twitter but if they are anywhere close to the general usage of Signal/WhatsApp/iMessage/Messenger etc. It is incredibly bad for them and something which can kill the platform unless they rethink that completely considering they don't even have E2E.

andwaal 6y ago

Not sure if it has been mentioned previous, but Reply All did an episode on sim swaping and OG handles https://gimletmedia.com/shows/reply-all/49ho5a/130-the-snapchat-thief https://gimletmedia.com/shows/reply-all/49ho5a/130-the-snapc...

goatinaboat 6y ago

Any comment on the buttons for blacklist trending and blacklist search?

hiimtroymclure 6y ago

> Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. I feel stupid for just realizing that social media account save previous passwords? How far back does it go?

tucif 6y ago
Probably just the old hashes to prevent a user from reusing the last N passwords. If you know the value of N (from UI errors trying to reuse one) and want them to get rid of an old hash for some reason then you could reset your password N times.

drummer 6y ago

There's no way to earn back trust after Twitter's shadow ban functionality got exposed through the leaked screenshots. Censorship is a terrible sin.