3 ms·

This is why internal tools that can modify account settings and such need to have audit trails.

raz32dust 6y ago
I would be really surprised if they did not have audit trails. What gives you the impression they did not? The suspicion is that the credentials were stolen via social engineering. I wonder if employees needed 2FA to log in to these tools.
- hombre_fatal 6y ago
  > The attackers successfully manipulated a small number of employees and used their credentials to access Twitter’s internal systems, including getting through our two-factor protections. https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html https://blog.twitter.com/en_us/topics/company/2020/an-update...
ceejayoz 6y ago
It probably does, and it probably wouldn't have stopped this.
- bawolff 6y ago
  > probably wouldn't have stopped this. Uh yes, that is how audit trails work
  - deleted 6y ago
    [deleted]
  - wil421 6y ago
    How does auditing itself prevent a present or future attack? Auditing and what you fix during audits are reactive.
    - halfjew22 6y ago
      It's like saying a boat's wake slows down the boat. Sometimes you've just got to wonder what people are thinking
    - calvinmorrison 6y ago
      100%. My work has really great auditing tools. I use them often to understand actions by other that are routine. It still doesn't prevent a employee emailing a datacenter to rack a malicious device or give someone service without paying. Record trails are not auditing. They are records. Auditing, post mortems, whatever diagnose the situation afterwards. At the end of the day Uber can't stop a driver from kidnapping people, but it can provide documentation and gps coordinates to police. My point is companies need reasonable records and audit policies and when _really bad stuff happens_ you call in the big guns for the arm of the law. At some point you also need to trust staff and weigh that against mistakes and malicious intent. In short, security remains an imperfect balance of practicality
  - hombre_fatal 6y ago
    Can we do without the condescending "Uh" and "Um" on HN? An audit trail would tell you who was social-engineered, but it wouldn't have prevented the attack in the same way Wikipedia's revision history doesn't keep you from vandalizing it.
    - TwoBit 6y ago
      It wouldn't even necessarily tell you who was social-engineered. My understanding of this case was that CS tool credentials were posted globally in their Slack.
      - bawolff 6y ago
        In fairness, i don't think its a real audit trail if the tool doesn't have an effective per-user password.
  - halfjew22 6y ago
    And in today's "Pompous Commenter That Didn't Read the Article News": >But while logging helps with investigations, only alarms or constant reviews can turn logs into something that can prevent breaches.
  - manigandham 6y ago
    Auditing tells you what happened, it doesn't prevent it from happening. If they have logs then they can use it in the future (and it seems they do) to design better protections but only active alarms and security controls can prevent something happening in real-time. However that does raise the question of why Twitter ever needs such access to someone's account in the first place, especially without a combination of approvals to get that access.
    - suizi 6y ago
      "I forgot my password, please reset it for me."

I would be really surprised if they did not have audit trails. What gives you the impression they did not? The suspicion is that the credentials were stolen via social engineering. I wonder if employees needed 2FA to log in to these tools.

hombre_fatal 6y ago
> The attackers successfully manipulated a small number of employees and used their credentials to access Twitter’s internal systems, including getting through our two-factor protections. https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html https://blog.twitter.com/en_us/topics/company/2020/an-update...

ceejayoz 6y ago

It probably does, and it probably wouldn't have stopped this.

bawolff 6y ago
> probably wouldn't have stopped this. Uh yes, that is how audit trails work
- deleted 6y ago
  [deleted]
- wil421 6y ago
  How does auditing itself prevent a present or future attack? Auditing and what you fix during audits are reactive.
  - halfjew22 6y ago
    It's like saying a boat's wake slows down the boat. Sometimes you've just got to wonder what people are thinking
  - calvinmorrison 6y ago
    100%. My work has really great auditing tools. I use them often to understand actions by other that are routine. It still doesn't prevent a employee emailing a datacenter to rack a malicious device or give someone service without paying. Record trails are not auditing. They are records. Auditing, post mortems, whatever diagnose the situation afterwards. At the end of the day Uber can't stop a driver from kidnapping people, but it can provide documentation and gps coordinates to police. My point is companies need reasonable records and audit policies and when _really bad stuff happens_ you call in the big guns for the arm of the law. At some point you also need to trust staff and weigh that against mistakes and malicious intent. In short, security remains an imperfect balance of practicality
- hombre_fatal 6y ago
  Can we do without the condescending "Uh" and "Um" on HN? An audit trail would tell you who was social-engineered, but it wouldn't have prevented the attack in the same way Wikipedia's revision history doesn't keep you from vandalizing it.
  - TwoBit 6y ago
    It wouldn't even necessarily tell you who was social-engineered. My understanding of this case was that CS tool credentials were posted globally in their Slack.
    - bawolff 6y ago
      In fairness, i don't think its a real audit trail if the tool doesn't have an effective per-user password.
- halfjew22 6y ago
  And in today's "Pompous Commenter That Didn't Read the Article News": >But while logging helps with investigations, only alarms or constant reviews can turn logs into something that can prevent breaches.
- manigandham 6y ago
  Auditing tells you what happened, it doesn't prevent it from happening. If they have logs then they can use it in the future (and it seems they do) to design better protections but only active alarms and security controls can prevent something happening in real-time. However that does raise the question of why Twitter ever needs such access to someone's account in the first place, especially without a combination of approvals to get that access.
  - suizi 6y ago
    "I forgot my password, please reset it for me."