3 ms·
> For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets How did they initiate a password reset
by orliesaurus 6y ago
> For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets
How did they initiate a password reset and successfully reset the password to login to the account? They must've had the owners' email passwords too?
EDIT: So they changed the mail associated to the accounts to their own... but the system didnt email out to "old" email to notify them of the action being taken like most companies do?
- gkoberger 6y agoThey changed the email addresses first to an account they controlled.
- a-wu 6y agoAs I understand it, the internal tools allow for changing the email. Change email -> password reset.
- andrepaulj 6y agoIf this is true then it completely defeats the purpose of a two-factor authentication
- bawolff 6y agoAlmost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset. 2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to
- fmajid 6y agoBut operations like that should require a second randomly chosen individual to verify. The reality is the public loses credentials and keys all the time and at most companies security takes a back seat to convenience and customer service.
- deleted 6y ago[deleted]
- odensc 6y agoI'd assume they had the ability to change the email on the account.
- deleted 6y ago[deleted]