8 ms·
Twitter Got Hacked, Is Mastodon Immune?
- caymanjim 6y agoExcept Twitter didn't get hacked.
- pavel_lishin 6y agoSemantics, no? Someone gained unauthorized access.
- fmpwizard 6y agoI think the prev. comment is accurate in the sense that Mastodon can easily be vulnerable to social engineering attacks, because as long as humans run it, humans are going to make mistakes. To be super clear, any (chat/microblogging/etc) software is going to be vulnerable to social eng attacks.
- caymanjim 6y agoIn most cases, I do consider gaining authorized access via social engineering to be a hack. I guess this probably qualifies, but just barely. If it turns out it was just a rogue engineer then it doesn't qualify at all. It's not clear that external "hackers" gained ongoing access. If someone leveraged an insecure remote worker's PC to gain access, that counts as hacking too. I'll wait and see if we find out what the root cause was.
- manquer 6y agoThe hack is exploiting weak internal security controls that twitter has. Reset of email for so many high profile users requiring only one person to click a button is weak design. No Review / no approval etc . Also the amount of time for them to identify it, they had blocked tweeting the address and blocked all verified users from posting before they could find the rogue account indicates logging and analysis of their admin tool actions is also not robust. Exploiting these two vulnerabilities whether by blackmail, bribe or RAT should not make a difference to consider it a hack
- 627467 6y agoKevin Mitnick is crying somewhere...
- DyslexicAtheist 6y agothe only hack Kevin Mitnick ever pulled was convincing people he was a hacker.
- 627467 6y agoReading through his charges[0] regardless of what we here consider that he has done, his criminal conviction seems to imply he was considered a "hacker" by the law. [0] https://en.m.wikipedia.org/wiki/Kevin_Mitnick https://en.m.wikipedia.org/wiki/Kevin_Mitnick
- mumblemumble 6y agoThe words "hack" and "hacker" are cognates, but both words have evolved over time, and not all senses of the word "hacker" describe someone who produces hacks. Social engineers and script kiddies can absolutely fit under the umbrella, too, and that's been the case for roughly a quarter century now. Perhaps longer.
- thesepeopledot 6y ago"Produces hacks" this isn't even a thing. Can people please stop commenting on HN threads pretending to know about hacking and making false claims.
- mumblemumble 6y agoProducing hacks is a thing, even if the phrase itself is not common, and it's a thing that people were doing long before hacking/hacker had even taken on the sense of breaking into computers. Look, there are really only two general approaches to arguing over the dictionary: Trotskyism (i.e., permanent revolution), and joining with the forces of evil.
- 6y ago
- thesepeopledot 6y agoYes it did.
- iso8859-1 6y agoDid it get cyberattacked, then? https://en.wikipedia.org/wiki/Talk:2020_Twitter_bitcoin_scam#Requested_move_19_July_2020 https://en.wikipedia.org/wiki/Talk:2020_Twitter_bitcoin_scam...
- matt_s 6y agoSecurity through obscurity, not a valid security plan. Regarding things like hacking into prominent accounts, DDOS/DOS attacks obscurity means it isn't worth the effort, like the author points out.
- yogthos 6y agoThe article isn't talking about security through obscurity at all. What it says is that Mastodon doesn't have a single point of failure like Twitter because it's a distributed network. With Twitter you can hack the entire network by compromising a single employee into giving you their credentials. With Mastodon you'd have to exploit each individual instance independently. This is orders of magnitude more effort.
- AdrianB1 6y agoThis is what suggests that: "For the time being, Mastodon remains a small enough presence in the social media sphere that this kind of attack hasn't been worth the time."
- yogthos 6y agoSure, however the more important point here is that this kind of attack is fundamentally more difficult to carry out and less effective than it would be against a centralized service.
- matt_s 6y agoYes, this is what I was referencing from the author. Git is decentralized version control. I would bet a site like Github protects itself from mass attacks because of its popularity. It has nothing to do with decentralized software. If a specific Mastodon node becomes super popular then it should have a plan to protect itself from these types of attacks.
- deleted 6y ago[deleted]
- loraa 6y agoI don't think anyone is paying attention to mastodon.
- tehabe 6y agoThe attacker gained access to the admin interface, I'm pretty sure this is also possible with Mastodon. Just you have to gain access to the right server. If someone attacks server A and the actual target is on server B, they are out of luck.
- yogthos 6y agoThe difference is that you can't compromise the whole federation by compromising a single server the way you can with Twitter.
- tehabe 6y agoThat was kinda my point. Mastadon has sadly other issues which let me stick with Twitter.
- yogthos 6y agoI use both, and I find that I generally prefer Mastodon nowadays. I find it's strictly better, and a lot snappier as well. Meanwhile, the community is now large enough that there's no lack of interesting content.
- latexr 6y ago> Unless you've been hiding under a rock the last week or so What’s the purpose of starting a blog post like that? The phrase is a cliché, and not a polite one. Whatever follows that introduction is either something the reader already knows and has fresh in memory (thus useless to mention) or you’re calling them oblivious. A sentence that’s irrelevant or mocking the reader seems like a poor way to start an essay. Most of us would do well to “hide under a rock” for a while. News and the way they are presented to us are stressful and largely irrelevant. Chances are you could live the rest of your life without knowing Twitter was hacked.
- quietbritishjim 6y agoI suppose that if you start with an obvious fact without any disclaimer of that then it gives the impression that everything else will be obvious too, and so the article isn't worth reading. They could perhaps have phrased it a bit differently e.g. "you're no doubt aware that ...". Personally, I wasn't offended. It reminds of something a little different but on a similar theme: the advice to never say "clearly, ..." in lectures, because it serves no purpose except to intimidate people that don't already know what follows. Actually, it does serve a purpose: so that people who do find it trivially obvious aren't thrown off wondering if there's something deeper there than they had realised.
- SilasX 6y agoThis. Those phrases are useful for distinguishing between “I’m giving new information” vs “I’m starting from what I expect to be common knowledge”. And yes, it’s possible to abuse such phrases but that doesn’t mean they don’t have their place.
- latexr 6y agoThe comment wasn’t on those types of phrases, but on that phrase in particular. There are better (more positive, don’t lose significance) ways to convey that information: https://news.ycombinator.com/item?id=23897649 https://news.ycombinator.com/item?id=23897649
- _qulr 6y agoThis is a mostly trivial article with a terrible clickbaity title. "Hacked"? "Immune"? No, and no. Could a Mastodon server be compromised? Of course. Would it affect all of Mastodon? Of course not, because it's distributed. Duh.
- im3w1l-alt 6y agoIf mastodon had a security hole they could all be owned at the same time. Fediverse servers on different software would be unaffected unless the hole is in a library used by both.
- _qulr 6y agoThe Twitter account takeover was an inside job. To be fair, the article is just part of a challenge to write 100 blog posts in 100 days. Nothing wrong with writing whatever you want, although the title of the post is still terrible. The question is, why did anyone think this article was worth submitting to HN?
- im3w1l-alt 6y agoYes I'm aware. An inside job against mastodon would be harder. A few people may be able to deliberately insert malicious code but that goes for any open source project.
- varbhat 6y agoEven though federation is big thing, saturation of users in single instance and poor moderation are problems. So,if users are very huge in single instance(mastodon main instance is the example) and the moderation is not likeable,there will be problems. Also federation like this is new to people. Will it work out? Currently, not likely. Also,it can't be claimed immune. Bugs might be present.
- yogthos 6y agoCurrently, Mastodon is a federation with millions of users on it, and it's been working for many years now. So, it's very clear that it's already worked out.
- mumblemumble 6y agoI think that the point being made was that there's nothing in Mastodon to counteract the natural tendency of people to concentrate in a relatively small number of individual online spaces. A quick eyeball of the English-language instances listed on instances.social, sorted by # of users, would suggest that this is true. There are a couple very large general-purpose instances, but after that it's largely much smaller topical communities. My hypothesis would be that, if one tracked these numbers over time, it would turn out that the larger ones aren't just bigger, they also grow at a faster rate. So, if Mastodon were to grow to the scale of one of the major social networks, we'd also find that the users were mostly all clumped into a single instance that's roughly the size (and level of nastiness) of one of the major social networks. At which point, from a social impact perspective, the fact that Mastodon is, from a technical standpoint, open and federated, would be beside the point.
- yogthos 6y agoClearly there are already multiple large instances in existence, so the situation is already fundamentally better than Twitter where there is only a single instance. Furthermore, I think that small instances are just as important as the big ones. If a small group of people has a shared interest and they want to run an instance in a specific way that's possible to do with Mastodon. There are tons of small Mastodon communities for all kinds of niche interests right now, and their users can make up their own rules for how they interact, what they allow, and so on. This is an incredibly important aspect of the federated model. There isn't one set of rules that applies to everybody the way there is with a centralized platform.
- stormdennis 6y agoJust for interest's sake I looked at joining a Mastodon instance. There was an application form to fill out which expected comprehensive answers to four questions about myself, my motivation for joining and my interests. I found it surprising but maybe it works for them.
- paulgb 6y agoThe thing about federation is that every instance can have their own criteria for joining. I haven't seen one that requires an application like that, but it doesn't surprise me. But surely if you just want to spin the wheels there are instances that are easier to join.
- stormdennis 6y agoYes thank you. I might do that, that one was the most interesting sounding one see the time.
- kstrauser 6y agoThat’s specific to the instance. Each one can individually choose to have open registration, moderated registration (like the instance where you applied), or invitation-only.
- stormdennis 6y agoThanks for your reply and the information. Did not see it until now.
- AndrewStephens 6y agoMy website didn't get hacked either. Of course it only gets a few dozen hits a day from a sophisticated audience so it is not really a target. Mastodon at the moment is basically a cozy little community. If a bunch of celebrities joined you can be sure they would all be on a professionally managed server - a tempting single-point of attack in the same way that the Twitter admin console was.
- yogthos 6y agoMastodon has millions of users now, and it's a part of a bigger fediverse community. Let's not belittle open source alternatives to commercial social media. The point that the article makes is that while obviously nothing can be immune, the same kind of hack would not be possible because Mastodon is decentralized. If you trick a single Twitter employee into giving you credentials, then you can get access to the entire Twitter network as recently happened. However, with Mastodon you'd have to convince the maintainer of each individual instance to give you access which is a much trickier proposition. Distributed nature of the network removes single points of failure.
- dolmen 6y agoBut what could happen is that your instance get destroyed. I can trust Twitter to have backups. I know almost nothing about the community-served Mastodon instance on which I created an account, and I'm kinda locked there.
- yogthos 6y agoIt depends on the instance. Larger instances do have backups, and they have operational funding. There is also a history of these instances operating for years without issues. Mastodon also makes it very easy to extract your data. Finally, you can always run your own instance if you wanted to and have full control over it.
- riffic 6y agoHow about this? "I can trust Gmail to have backups. I know almost nothing about the corporate-provided mail service on which my administrator created my account, and I'm kinda locked there."
- richardwhiuk 6y agoMastodon is immune because it doesn't have any influential users.
- pal_9000 6y agoSecurity by obscurity:D
- manquer 6y agoNot just that, it is also the distributed and transient nature - one instance can become far more popular than the next far easier than a twitter clone can. This makes it hard to gain and sustain traction on the platform not designed for it. Extreme example is 8chan kind of boards. Imagine how twitter will be if it never displayed any counts - followers, like, retweets etc nothing is shown to the user, even if they used all of it in the background, just by not showing it will have enormous impact on user behaviour. Linkedin did that by not showing connection count beyond 500, to dis-incentivize people from making connection requests like facebook friend requests. Architecture in Mastodon case makes it not attractive for influencers as compared to other platforms(IG, twitter etc) where they have higher Return on Effort put in.
- Nasrudith 6y agoMore like deterrence by "poverty" - if you don't have anything remotely valuable to them to exploit you don't need any security.
- v77 6y agoThis blog post was my bi-yearly reminder that a thing called Mastodon exists.
- bzb3 6y agoSoon to be followed by similar posts about DDG and Firefox.
- ghostDancer 6y agoAnd that is a feature. Influencers are best in IG , FB, Twitter and HN , is where they get their public.
- css 6y ago> Obviously Mastodon has it's own internal tools, but those tools on mastodon.social have absolutely no effect on Fosstodon, and vise versa. Mastodon has "post as user" in its internal tools? Why?
- 0-O-0 6y agoAFAIK Twitter's internal tools allowed to reset emails and circumvent 2FA, not post as users.
- css 6y agoDo Mastodon's internal tools allow administrators to circumvent 2FA?
- throwanem 6y agoNot directly. You can do it with access to the instance's Postgres database, but I'd expect relatively few instance admins (as opposed to instance owners) to have that; the admin tools don't include a database console, and you can't use a credential for the admin tools to authenticate to the database.
- Deukhoofd 6y agotootctl accounts modify USERNAME --disable-2fa --reset-password Then check your mail server for outgoing mail, and use the mail sent to the user to change the password.
- robjan 6y agoIf you are the instance owner you can do whatever you want. Additionally, many instances are installed on a single host (https://masto.host https://masto.host) and almost all instances are on VPS in various managed clouds.
- knolax 6y agoThe vast majority of instances are one man shows where the admin also has root access to the server the instance is running on. Aside from that I don't think there's anything on the Mastodon webapp itself that lets you post as a user. It's mostly limited to blocking/hiding instances and users.
- deleted 6y ago[deleted]
- Angostura 6y agoIt's "immune" to the extent that it is impossible to have a coherent identity across instances.
- yogthos 6y agoThis is akin to saying you can't have a coherent identity across instances for email. It's a nonsensical statement because the whole point of having a federation is that you have identity on one instance and you can interact with people from other instances.
- zamalek 6y agoI'd argue that Mastodon is less immune, at least if their vision of true distributed comes to fruition. In Twitter's case, it came down to some pretty poor opsec and could have been avoided. Ultimately you're going to have at most N points of failure. With security keys, the number of points of failure in Twitter could have been reduced to one (and that one user could be proactively educated). In Mastodon, every user is potentially in control of their instance. Every user is a potential point of failure. Users routinely fall victim to social engineering each day, possibly someone is this very second.
- fierarul 6y agoWith every account the user is a point of failure. Just like Twitter users can also fall victim to social engineering. On top of that, it's possible that some Mastodon instances have weak security. But others will not. So there will never be a full-blown Mastodon hack just like there's never been a full-blown email hack.
- yogthos 6y agoYou're making an argument for why Mastodon is more immune here and not less. Since there are many different servers administered in different ways by many different users, you have to infiltrate each server on case by case basis. This is orders of magnitude more effort than compromising a single administrator and getting access to the entire network.
- solidasparagus 6y agoI think the point is that good security takes effort and that is something that economies of scale help with. When each instance is run by a single administrator, it is much harder for anyone to have high quality security,
- yogthos 6y agoCounterpoint is that a distributed system doesn't have a central point of failure, so the effort to subvert the entire network is significantly more involved. So, as everything it's trade offs, but a distributed system will be more robust overall.
- tracker1 6y agoI would think it would depend on specific instances, the age of the server in use and any bugs that may exist, or the motivations and access to administrative tools. It could be easier and harder to target celebrity accounts, but would again depend on the specific hosts.