8 ms·

>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Dat

>For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account’s information through our “Your Twitter Data” tool. Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts? edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be of note than just DMs. I wonder what risks there are to knowing, for example, the past IP addresses and geolocations that VIP politicians access Twitter from? Hopefully they're behind a government VPN. 0: https://help.twitter.com/en/managing-your-account/accessing-your-twitter-data https://help.twitter.com/en/managing-your-account/accessing-...

SV_BubbleTime 6y ago
From what I saw most of the “famous” accounts are surely run by PR teams. I doubt Obama has touched the Obama account let alone DM’ed Jesse Jackson some Trump memes. But I guess it’s entirely possible that people put sensitive things in DMs and inexplicably just trusted Twitter with that info.
- txcwpalpha 6y ago
  I think it likely varies on the person we're talking about. Is Obama personally tweeting and sending private memes in his DMs? Doubtful. Kanye or Elon Musk? I'd guess yes, actually.
  - SV_BubbleTime 6y ago
    Ah, Elon, forgot about that one. I fully believe he runs his own twitter. How else is he going to control the stock market!? ;) You’re right, I assume his would be one of the accounts that was exfil’ed
    - dlgeek 6y ago
      He's verified though, and they claim the only exfil'd accounts weren't.
      - zwily 6y ago
        They didn’t say that only those 8 non-verified accounts had DMs accessed.
  - Kaveren 6y ago
    Kanye West and Elon Musk have absolutely nothing of value in their DMs. Anything you could do with access to Musk's DMs you could do better just by tweeting as Musk. There is no value in Twitter DMs.
    - aspenmayer 6y ago
      Why do you dismiss hypothetical questions out of hand, without evidence? Can one prove a negative or disprove a counterfactual statement? I just don’t know why you think that you must be right, as the actions of the hackers indicate otherwise. It’s hard to tell what is intent and what is misdirection when it comes to hacks of this nature, all the same. > Hitchens has phrased the razor in writing as "What can be asserted without evidence can also be dismissed without evidence." https://en.wikipedia.org/wiki/Hitchens%27s_razor https://en.wikipedia.org/wiki/Hitchens%27s_razor
    - albatross 6y ago
      I'm sure the folks shorting TSLA would disagree on Elon's DMs. Maybe Kanye's DMs would reveal he's really just fucking with everyone and hasn't actually completely lost it. Well... Maybe just the former.
psanford 6y ago
> There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0] [0]: https://twitter.com/TwitterSupport/status/1284339148774498305 https://twitter.com/TwitterSupport/status/128433914877449830...
- txcwpalpha 6y ago
  >none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them picking solely non-verifieds.
  - WrtCdEvrydy 6y ago
    Someone pointed out that it could be targeted at activists...
    - milofeynman 6y ago
      That is exactly my worry the moment I saw they were not verified. Nation state could drop a grand per account and get data on 8 activists no problem.
      - edoceo 6y ago
        Not $8k right? $1k per hacked account - which would thousands + the narrow targets?
        milofeynman 6y ago
        The NYTb article says they were selling accounts initially for $1-1.5k before trying the Bitcoin scam
quink 6y ago
Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. And there's no big reason to think that the exfiltration of private DMs was limited to the people that had the Bitcoin scam tweeted on their accounts. I think the Bitcoin scam was also the perfect innocuous cover story - a legitimate motive that nevertheless leaves one with the impression that the operator is a pretty small fry. So many dismissals of it's a silly scamp wanting money but only got 12 BTC, next day's news please. But it did put it out there so that the public (and the public needs to know to establish the credibility of the compromised data instantly, immediately, with no room for doubt) is aware a broad hack occurred, without even exposing who was targeted specifically and the BTC didn't matter one iota. Now they can trickle-feed what they actually got all the way until the election. Also, they don't care who'll win, just like the email hackers didn't in 2016. They just want to sow discord. Tweeting the same unrelated thing on so many accounts also sends the message that they're not on anyone's side. The only reason I think Trump didn't have anything tweeted isn't because they particularly like him, but because it gives of the image of graver national security consequences.
- Kaveren 6y ago
  > Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. It's not that everyone is so security-minded, it's just that Twitter is an extremely inconvenient way to maintain personal relationships. > I think the Bitcoin scam was also the perfect innocuous cover story There is almost no value in DMs. Funny seeing HN speculate about these elite hackers selling them as if there's any market for them, let alone one that would pay $100k+.
  - quink 6y ago
    99.9% of the email hacks was uninteresting. 0.1% was nothingburger. That wouldn’t stop it from dominating in the media, especially with a trickle feed strategy. Google the whole ‘Spirit Cooking’ thing as a good example. Completely nothing. 0% interesting. Stupid enough to be idle Twitter DM chat. Did it hit the media just before the election and blow up? Yup.
tdrp 6y ago
Only slightly related, but back when GDPR was first enacted I mentioned that it would inadvertently open up some vulnerabilities and that it should have been reviewed by white hat security researchers. - "Download all my data" was mandated by GDPR (article 20) - Right to delete, right to access made it so that there is up to a ten million dollar fine if you refuse it, so you are more prone to social engineering attacks. Meaning if some user requests access or deletion, (e.g. having forgotten their password or username) you might not be 100% sure that it's him but arguing with him or asking too personal a verification proof can get you in hot water and you'd rather not get dragged into a fight with the European committee. - While our users could initially create an account without e-mails and be relatively anonymous, a couple of "right to access" requests from "users who have forgotten their username" means you are basically forced to require e-mail, thereby carrying even more PII unnecessarily. It probably wouldn't have slowed the hackers down much here though.
- Semaphor 6y ago
  Where does it say you have to follow through with data or erasure of users who can’t prove they are who they say they are? Both of those seem like the opposite of what you are supposed to do. I just checked the first result, and even the ICO [0] says > [Your full name and address and any other details such as account number to help identify you] [0] https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/ https://ico.org.uk/your-data-matters/your-right-to-get-your-...
paulpauper 6y ago
maybe a girlfriend or ex girlfriend . or a rival hacker. or someone who is believed to own a lot of crypto and is low profile.
- famouslastwords 6y ago
  Maybe they discovered Satoshi Nakamoto's Twitter account :D

SV_BubbleTime 6y ago

From what I saw most of the “famous” accounts are surely run by PR teams. I doubt Obama has touched the Obama account let alone DM’ed Jesse Jackson some Trump memes. But I guess it’s entirely possible that people put sensitive things in DMs and inexplicably just trusted Twitter with that info.

txcwpalpha 6y ago
I think it likely varies on the person we're talking about. Is Obama personally tweeting and sending private memes in his DMs? Doubtful. Kanye or Elon Musk? I'd guess yes, actually.
- SV_BubbleTime 6y ago
  Ah, Elon, forgot about that one. I fully believe he runs his own twitter. How else is he going to control the stock market!? ;) You’re right, I assume his would be one of the accounts that was exfil’ed
  - dlgeek 6y ago
    He's verified though, and they claim the only exfil'd accounts weren't.
    - zwily 6y ago
      They didn’t say that only those 8 non-verified accounts had DMs accessed.
- Kaveren 6y ago
  Kanye West and Elon Musk have absolutely nothing of value in their DMs. Anything you could do with access to Musk's DMs you could do better just by tweeting as Musk. There is no value in Twitter DMs.
  - aspenmayer 6y ago
    Why do you dismiss hypothetical questions out of hand, without evidence? Can one prove a negative or disprove a counterfactual statement? I just don’t know why you think that you must be right, as the actions of the hackers indicate otherwise. It’s hard to tell what is intent and what is misdirection when it comes to hacks of this nature, all the same. > Hitchens has phrased the razor in writing as "What can be asserted without evidence can also be dismissed without evidence." https://en.wikipedia.org/wiki/Hitchens%27s_razor https://en.wikipedia.org/wiki/Hitchens%27s_razor
  - albatross 6y ago
    I'm sure the folks shorting TSLA would disagree on Elon's DMs. Maybe Kanye's DMs would reveal he's really just fucking with everyone and hasn't actually completely lost it. Well... Maybe just the former.

psanford 6y ago

> There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0] [0]: https://twitter.com/TwitterSupport/status/1284339148774498305 https://twitter.com/TwitterSupport/status/128433914877449830...

txcwpalpha 6y ago
>none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them picking solely non-verifieds.
- WrtCdEvrydy 6y ago
  Someone pointed out that it could be targeted at activists...
  - milofeynman 6y ago
    That is exactly my worry the moment I saw they were not verified. Nation state could drop a grand per account and get data on 8 activists no problem.
    - edoceo 6y ago
      Not $8k right? $1k per hacked account - which would thousands + the narrow targets?
      - milofeynman 6y ago
        The NYTb article says they were selling accounts initially for $1-1.5k before trying the Bitcoin scam

quink 6y ago

Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. And there's no big reason to think that the exfiltration of private DMs was limited to the people that had the Bitcoin scam tweeted on their accounts. I think the Bitcoin scam was also the perfect innocuous cover story - a legitimate motive that nevertheless leaves one with the impression that the operator is a pretty small fry. So many dismissals of it's a silly scamp wanting money but only got 12 BTC, next day's news please. But it did put it out there so that the public (and the public needs to know to establish the credibility of the compromised data instantly, immediately, with no room for doubt) is aware a broad hack occurred, without even exposing who was targeted specifically and the BTC didn't matter one iota. Now they can trickle-feed what they actually got all the way until the election. Also, they don't care who'll win, just like the email hackers didn't in 2016. They just want to sow discord. Tweeting the same unrelated thing on so many accounts also sends the message that they're not on anyone's side. The only reason I think Trump didn't have anything tweeted isn't because they particularly like him, but because it gives of the image of graver national security consequences.

Kaveren 6y ago
> Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. It's not that everyone is so security-minded, it's just that Twitter is an extremely inconvenient way to maintain personal relationships. > I think the Bitcoin scam was also the perfect innocuous cover story There is almost no value in DMs. Funny seeing HN speculate about these elite hackers selling them as if there's any market for them, let alone one that would pay $100k+.
- quink 6y ago
  99.9% of the email hacks was uninteresting. 0.1% was nothingburger. That wouldn’t stop it from dominating in the media, especially with a trickle feed strategy. Google the whole ‘Spirit Cooking’ thing as a good example. Completely nothing. 0% interesting. Stupid enough to be idle Twitter DM chat. Did it hit the media just before the election and blow up? Yup.

tdrp 6y ago

Only slightly related, but back when GDPR was first enacted I mentioned that it would inadvertently open up some vulnerabilities and that it should have been reviewed by white hat security researchers. - "Download all my data" was mandated by GDPR (article 20) - Right to delete, right to access made it so that there is up to a ten million dollar fine if you refuse it, so you are more prone to social engineering attacks. Meaning if some user requests access or deletion, (e.g. having forgotten their password or username) you might not be 100% sure that it's him but arguing with him or asking too personal a verification proof can get you in hot water and you'd rather not get dragged into a fight with the European committee. - While our users could initially create an account without e-mails and be relatively anonymous, a couple of "right to access" requests from "users who have forgotten their username" means you are basically forced to require e-mail, thereby carrying even more PII unnecessarily. It probably wouldn't have slowed the hackers down much here though.

Semaphor 6y ago
Where does it say you have to follow through with data or erasure of users who can’t prove they are who they say they are? Both of those seem like the opposite of what you are supposed to do. I just checked the first result, and even the ICO [0] says > [Your full name and address and any other details such as account number to help identify you] [0] https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/ https://ico.org.uk/your-data-matters/your-right-to-get-your-...

paulpauper 6y ago

maybe a girlfriend or ex girlfriend . or a rival hacker. or someone who is believed to own a lot of crypto and is low profile.

famouslastwords 6y ago
Maybe they discovered Satoshi Nakamoto's Twitter account :D