5 ms·

Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going t

by quink 6y ago

Here's my suspicions. I may well be wrong, but this is what it feels like... I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. And there's no big reason to think that the exfiltration of private DMs was limited to the people that had the Bitcoin scam tweeted on their accounts. I think the Bitcoin scam was also the perfect innocuous cover story - a legitimate motive that nevertheless leaves one with the impression that the operator is a pretty small fry. So many dismissals of it's a silly scamp wanting money but only got 12 BTC, next day's news please. But it did put it out there so that the public (and the public needs to know to establish the credibility of the compromised data instantly, immediately, with no room for doubt) is aware a broad hack occurred, without even exposing who was targeted specifically and the BTC didn't matter one iota. Now they can trickle-feed what they actually got all the way until the election. Also, they don't care who'll win, just like the email hackers didn't in 2016. They just want to sow discord. Tweeting the same unrelated thing on so many accounts also sends the message that they're not on anyone's side. The only reason I think Trump didn't have anything tweeted isn't because they particularly like him, but because it gives of the image of graver national security consequences.

Kaveren 6y ago
> Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. It's not that everyone is so security-minded, it's just that Twitter is an extremely inconvenient way to maintain personal relationships. > I think the Bitcoin scam was also the perfect innocuous cover story There is almost no value in DMs. Funny seeing HN speculate about these elite hackers selling them as if there's any market for them, let alone one that would pay $100k+.
- quink 6y ago
  99.9% of the email hacks was uninteresting. 0.1% was nothingburger. That wouldn’t stop it from dominating in the media, especially with a trickle feed strategy. Google the whole ‘Spirit Cooking’ thing as a good example. Completely nothing. 0% interesting. Stupid enough to be idle Twitter DM chat. Did it hit the media just before the election and blow up? Yup.
- pizza 6y ago
  > Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. GP was talking about the 2016 election, where Julian Assange and Roger Stone literally communicated strategies, for how to coordinate if the FBI came down on Assange for the leaks, via Twitter DMs. Many things going on with no Signal, PGP, etc. https://www.businessinsider.com/fbi-reveals-roger-stone-was-directly-communicating-with-julian-assange-2020-4 https://www.businessinsider.com/fbi-reveals-roger-stone-was-...
  - Kaveren 6y ago
    > On 4 October, 2016, Mr Stone tweeted: “Payload coming. #Lockthemup.” It was clear publicly that Stone had a very inappropriate relationship with Wikileaks. What would you do, attempt to extort Stone for more than $100k and hope he pays? Leak little more than was publicly known?
    - ineedasername 6y ago
      No, if you were a bad actor looking to cause chaos for a target, you would gather all such things and release it. Either way, that example disproves your claim that nothing sensitive would be discussed of Twitter DM's.
  - bouncycastle 6y ago
    Just wondering, how do you prove the authenticity of the DMs if they have no cryptographic signatures? I'd be very hard. Even is some are authentic, some messages could be altered / planted, there is no way you could trust screenshots too.
blisseyGo 6y ago
The President's account might also have extra safe guards against hacks.
- jacquesm 6y ago
  Just like Obama's, right?
  - basilgohar 6y ago
    The risk of compromise of the sitting president's account poses a much greater threat than does that of a former one. Also, the prominence of Twitter as a means for a head of state to communicate official policy came much further in prominence during the current president's term than before.
    - jacquesm 6y ago
      Obama has a huge following (larger than Trump in fact) and I can think of a couple of tweets by that account that would have led to some serious trouble.
    - Nightshaxx 6y ago
      Also I'd guess that hijacking the sitting President's twitter would make the hack much worse in a legal sense. Plus now you've pissed off the president who will make especially sure your life becomes he'll.
mcintyre1994 6y ago
Whose private DMs would have as much impact as campaign emails did, and aren’t verified though? That’s the thing that raises so many questions for me - they only exfiltrated the data on accounts that aren’t verified. On Trump, apparently he has more internal protections on his account than normal so it could just be that the employees they got in through didn’t have any access. https://www.nytimes.com/2020/07/16/technology/twitter-hack-investigation.html https://www.nytimes.com/2020/07/16/technology/twitter-hack-i...
- kace91 6y ago
  >Whose private DMs would have as much impact as campaign emails did, and aren’t verified though? That’s the thing that raises so many questions for me - they only exfiltrated the data on accounts that aren’t verified. Verified doesn't necessarily mean important people, but rather public personality/official account. There could be hundreds of lobbyists, journalists, etc. that don't use verified accounts.
yalok 6y ago
I agree, this looks like the most probable real reason for the hack

by quink 6y ago

Kaveren 6y ago

> Exfiltrating DMs seems like it's going to accomplish just about as much, if not more. Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. It's not that everyone is so security-minded, it's just that Twitter is an extremely inconvenient way to maintain personal relationships. > I think the Bitcoin scam was also the perfect innocuous cover story There is almost no value in DMs. Funny seeing HN speculate about these elite hackers selling them as if there's any market for them, let alone one that would pay $100k+.

quink 6y ago
99.9% of the email hacks was uninteresting. 0.1% was nothingburger. That wouldn’t stop it from dominating in the media, especially with a trickle feed strategy. Google the whole ‘Spirit Cooking’ thing as a good example. Completely nothing. 0% interesting. Stupid enough to be idle Twitter DM chat. Did it hit the media just before the election and blow up? Yup.
pizza 6y ago
> Nobody is communicating anything valuable over Twitter. This is such a ridiculous point that people bring up all the time. Scandalous relationships? Most of that will be on true messenger applications. Business deals? Business email. Many more mainstream prominent people don't even run their own account. GP was talking about the 2016 election, where Julian Assange and Roger Stone literally communicated strategies, for how to coordinate if the FBI came down on Assange for the leaks, via Twitter DMs. Many things going on with no Signal, PGP, etc. https://www.businessinsider.com/fbi-reveals-roger-stone-was-directly-communicating-with-julian-assange-2020-4 https://www.businessinsider.com/fbi-reveals-roger-stone-was-...
- Kaveren 6y ago
  > On 4 October, 2016, Mr Stone tweeted: “Payload coming. #Lockthemup.” It was clear publicly that Stone had a very inappropriate relationship with Wikileaks. What would you do, attempt to extort Stone for more than $100k and hope he pays? Leak little more than was publicly known?
  - ineedasername 6y ago
    No, if you were a bad actor looking to cause chaos for a target, you would gather all such things and release it. Either way, that example disproves your claim that nothing sensitive would be discussed of Twitter DM's.
- bouncycastle 6y ago
  Just wondering, how do you prove the authenticity of the DMs if they have no cryptographic signatures? I'd be very hard. Even is some are authentic, some messages could be altered / planted, there is no way you could trust screenshots too.

blisseyGo 6y ago

The President's account might also have extra safe guards against hacks.

jacquesm 6y ago
Just like Obama's, right?
- basilgohar 6y ago
  The risk of compromise of the sitting president's account poses a much greater threat than does that of a former one. Also, the prominence of Twitter as a means for a head of state to communicate official policy came much further in prominence during the current president's term than before.
  - jacquesm 6y ago
    Obama has a huge following (larger than Trump in fact) and I can think of a couple of tweets by that account that would have led to some serious trouble.
  - Nightshaxx 6y ago
    Also I'd guess that hijacking the sitting President's twitter would make the hack much worse in a legal sense. Plus now you've pissed off the president who will make especially sure your life becomes he'll.

mcintyre1994 6y ago

Whose private DMs would have as much impact as campaign emails did, and aren’t verified though? That’s the thing that raises so many questions for me - they only exfiltrated the data on accounts that aren’t verified. On Trump, apparently he has more internal protections on his account than normal so it could just be that the employees they got in through didn’t have any access. https://www.nytimes.com/2020/07/16/technology/twitter-hack-investigation.html https://www.nytimes.com/2020/07/16/technology/twitter-hack-i...

kace91 6y ago
>Whose private DMs would have as much impact as campaign emails did, and aren’t verified though? That’s the thing that raises so many questions for me - they only exfiltrated the data on accounts that aren’t verified. Verified doesn't necessarily mean important people, but rather public personality/official account. There could be hundreds of lobbyists, journalists, etc. that don't use verified accounts.

yalok 6y ago

I agree, this looks like the most probable real reason for the hack