8 ms·

Kind of sensationalist. There's thousands of people that have the ability to drain your bank account right now. Your average call center employee wields immense

Kind of sensationalist. There's thousands of people that have the ability to drain your bank account right now. Your average call center employee wields immense power. The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools.

hombre_fatal 6y ago
Education programs only move the needle, not something you do instead of minimizing the number of attack vectors. For example, education programs do squat against me attacking the employees directly (targeted malware, getting on their computer somehow, offering each of the thousands of employees $10,000 for temp access to their account). And each additional employee only strengthens my attack.
dguido 6y ago
It's not sensationalist when you realize it directly contradicts Twitter's prior statements from just last year about it: > Twitter, in a statement, said it is aware that "bad actors" will try to undermine its service and that the company "limits access to sensitive account information to a limited group of trained and vetted employees." https://www.npr.org/2019/11/06/777098293/2-former-twitter-employees-charged-with-spying-for-saudi-arabia https://www.npr.org/2019/11/06/777098293/2-former-twitter-em... 1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." It's news because they misled people about their security, again.
- ceejayoz 6y ago
  > 1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." That's not necessarily true. 20% of the company could fairly reasonably be deemed "limited", and there being a thousand of them doesn't mean they're not trained on their tasks.
  - monsieurbanana 6y ago
    We'll have to agree to disagree on what we consider fairly reasonable to call "limited".
  - dorkwood 6y ago
    Today I learned that Twitter has 4,600 employees. What are they all doing?
    - vangelis 6y ago
      They have 35 offices, I assume it adds up.
      - dorkwood 6y ago
        Oh, right. That makes sense.
    - freeone3000 6y ago
      Support, operations, legal, purchasing, finance, marketing, development, and management.
    - yomly 6y ago
      Ya cos Twitter is just a CRUD app /s Once you want to add more people to any business, you need to add even more people to that business. Lets say you have 10 engineers and want to add another. Suddenly HR's workload has tipped over the limit and you need more HR people. Now communication is fracturing for those 10 engineers and you need a Product Manager and an Engineering Manager to centralise the steering and cohesion of those 11 engineers. Now budgets, payroll and accounting has increased and you need another Finance person. Suddenly your office is too small so you need a bigger office and an office manager. This is obviously a contrived example, but having worked at very early stage startup, a mid sized startup and a global megacorp while seeing all of them go through various growth cycles you start to appreciate how headcount can creep in ways which feel indirect to the most pressing problem at hand (ship more features, deliver more customer value). You see it software terms too - as your software project scales suddenly you need more infra, your CI environment gets more complex. Suddenly your workflows don't scale as too many engineers are working on the same code, so you rearchitect (components/microservices) then you need to start building dev tooling and metrics/observability.... I guess as some kind of system scales, the leverage you gain from adding a thing to it has some diminishing curve / inverse relationship to the size of the system.
- akersten 6y ago
  I don't think that's a contradiction, I think you and Twitter have different understandings of what the size of a "limited group of employees" is. The usual advice of dismissing nebulous corporate statements like that applies. Anyway, even if they had provided a figure, I think you're taking it out of context - the quote says access to "sensitive account information" is limited, not access to account recovery options. So it's potentially someone outside of that limited group whose credentials were compromised.
  - bigiain 6y ago
    <cynical view> I think the misunderstanding is over the phrase "sensitive account information". I notice it wasn't Nestle or Verizon or Disney or Heinz or Unilever accounts that got hacked. You know, the information about "accounts". The records of monetary transactions. https://www.statista.com/statistics/1094351/us-twitter-advertisers-ranked-by-impressions/ https://www.statista.com/statistics/1094351/us-twitter-adver...
- vangelis 6y ago
  I'm sure they took a web training before being handed the keys to the kingdom.
- verroq 6y ago
  It can be every employee except one and still be called "limited group of trained and vetted employees". It's written that way so that they covered their ass, it's not a statement of security.
- nl 6y ago
  > 1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." It's news because they misled people about their security, again. I don't think this is misleading at all. Your bank probably has thousands of people who can get equivalent access to your account, and they serve a lot less people than Twitter, and mostly during business hours, in one language, in one country. 1000 people in total when they have to have some available 24/7 isn't many. Say 200 of them are individual technical staff with access for specific debugging purposes. Then it's only 200 people per 8 hour shift. There's probably requirements for specific language support too, which increases the head count. There was a period of time some years ago when Twitter's peak usage was from Japan, in Japanese hours, in Japanese language.
- MattGaiser 6y ago
  Banks make the same promise that it is a "limited group of trained and vetted employees." In an organization as large as Twitter or a bank, that still means thousands of people. You are seeing 1000 as large because you are forgetting the scale on which they operate.
- freeone3000 6y ago
  1000 people absolutely is limited - it's not everyone at the company! I'm sure they did their annual security training, like everyone here, and they might have even passed an additional screening and another training session for account access. You have unreasonable expectations for what "limited group of trained and vetted employees" means in a CSR environment for millions of customers.
- gcc_programmer 6y ago
  It's funny how most people think that 1000 out of 4600 employees having admin access is "not misleading" and counts as a "limited" group. It shows how in the public mind, technology groups should not be held accountable for their actions.
  - rutthenut 6y ago
    I take it that 1000 out of 4600 employees shows that, not unsurprisingly, a lot of the staff at this technology company may be involved in hands-on activities against live services. Maybe DevOps style.
    - gcc_programmer 6y ago
      Why is that not surprising? Maybe we are used to different types of technology companies though.
tjdetwiler 6y ago
CS tools should require some 2FA based on personal information. CS agents should not be able to access arbitrary data.
manigandham 6y ago
Do they? There are usually levels of access and the bigger the change the more approval you need. Some things can only be done by an entirely separate team with manager sign off and other oversight. It seems like Twitter has none of this, and while you can argue it's not the same a banking, there are still sensitive communications and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals.
- akersten 6y ago
  > and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals. Unless new information has emerged recently, this wasn't the attack vector. The attack was resetting account emails/passwords and turning off 2FA. I agree that there should have been more protections around this, but it's hardly newsworthy that Twitter employs a large support team to support their large userbase - my main gripe is with how the headline is framed.
  - manigandham 6y ago
    There's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then they already have everything. The reset via admin tools must have bypassed the normal email workflow.
    - SifJar 6y ago
      Admin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
      - manigandham 6y ago
        Then that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.
deleted 6y ago
[deleted]
mandatory 6y ago
> The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools. Spear-phishing by its very definition is a highly targeted attack. I wouldn't count on any level of training to prevent someone from getting phished. Given some of the spear phishing campaigns I've seen, I wouldn't trust even myself not to fall for them. It's a problem that needs to be solved with technical solutions like hardware U2F, locked-down customer support devices (e.g. Chrome enterprise policy managed ChromeOS devices), and special account VIP/anomaly locking and auto-escalation.
- _jal 6y ago
  FWIW, this is actually quantifiable. We contract with a firm that tests employees' response to spear phishing about once a quarter with varying degrees of "difficulty". Part of an overall scheme that also identifies people who blindly click on things for, uh, further email education.
  - bigiain 6y ago
    I'd love to know if you have any data to show if that "further email education" makes any difference in future behaviour... The cynic in me reckons "Hell no! Those sorts of people are way too often _proud_ of their zero-thought blind clicking and lack of understanding of how things work"...
- p1esk 6y ago
  It’s only going to get worse. Imagine your boss calling you and telling you to provide him some info: https://www.wsj.com/articles/fraudsters-use-ai-to-mimic-ceos-voice-in-unusual-cybercrime-case-11567157402 https://www.wsj.com/articles/fraudsters-use-ai-to-mimic-ceos...
- miles 6y ago
  It's very easy to avoid being spear phished: do not trust any unsolicited message over any medium. Email/text/phone message/popup window purporting to be from your registrar with an urgent call to action? Ignore said call and contact them directly via known good number, email address, URL, etc. EDIT: Voice mimicry scam? Verify via known channel before taking action.
lucio 6y ago
"There's thousands of people that have the ability to drain your bank account right now" Do you have some data to back that up? Sounds implausible
- akersten 6y ago
  Certainly it will depend on who you bank with, but JPMorganChase has 250,000 employees[1]. If even 1% of them are customer service representatives, bank tellers, or in other positions with direct access to your account (which I hope we can agree is an underestimate), that's 2,500 people right there. [1]: https://www.google.com/search?q=chase+employees https://www.google.com/search?q=chase+employees
  - jobigoud 6y ago
    And they all have access to all accounts? I would imagine only a bank teller from the appropriate branch would have access to this branch's accounts.
    - theduder99 6y ago
      Maybe back in the 1960s it was like that. Doesn't matter which branch I open an account at. I can walk into any branch and the teller should be able to pull up my info.
- lopmotr 6y ago
  Does it matter? There are also millions of people who could murder you or burn down your house or kidnap you and force you to withdraw your money from the bank. But just like a bank worker stealing money, these are all serious crimes and easy to get caught so we're pretty safe.
TwoBit 6y ago
There's a difference though. The money you lost can be returned in the case of theft, which happens a lot. But Twitter cannot undo what happened here. Also I don't think thousands of call center people typically have sole ability to directly overwrite bank and brokerage key data fields.
zkms 6y ago
i dont think spear-phishing training is the solution here; especially given the possibility of collaborating insiders. Short social media usernames are bizarrely coveted and so there's an entire cottage industry based on illicitly commandeering accounts and these operations have used insiders working for cellular telephone companies who are paid to grease along processes like unauthorized SIM-swaps/porting. For operations on accounts where illicit access can cause massive irreversible damage -- either by exfiltrating private information (emails, DMs/PMs, posts on locked accounts, etc) or by making a post that appears authorized (the more notable the victim the worse it gets) -- there has got to be some sort of two-man rule (https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule) integrated into the system that can't be bypassed by the people with authority to make changes to accounts. Otherwise any insider / careless spear-phishing victim will make the changes they want, and theres no reason the adversary will limit themselves to posting shoddily-executed (they used the same address instead of generating one per victim!) bitcoin scams. Furthermore, i'd really like there a way for any user (not just bluechecks) to opt-in to some sort of feature where Twitter enforces more stringent requirements/documentation/delays for the email/phone-change / password-reset processes -- at the cost of accepting higher delays or maybe even monetary payment. There's no reason i need such critical account procedures to happen on twitter (or my email accounts, for that matter) to happen in real-time, and i would happily give that up in order to require that such a procedure only happen after, like, a week of enforced, non-bypassable delay where they contact me with details of the change on all my phone-numbers and emails every day.
irjustin 6y ago
Yes but it's missing the fact that you can't actually drain an account even with access. The overall network is designed for rollbacks, but more importantly, they're internally insured. My money will be put back if someone inside steals it (outside is completely different). With twitter, the damage is not practically reversible since it was a bitcoin scam. The analogy/comparison works to a degree, but misses some key differences as to why this is actually worse with twitter than a bank.
amf12 6y ago
> There's thousands of people that have the ability to drain your bank account right now. That's false equivalence. If a bank employee drains my account without authorization, it won't be difficult to prove and get back. But once your data leaks, it's out there.
- bryan_w 6y ago
  But a bank employee can leak data as well. Some would say more important data than some tweets
dwild 6y ago
> There's thousands of people that have the ability to drain your bank account right now. Let them do it... the bank will always be responsible and it will always be solved without much issue. Twitter accounts though... good luck taking back theses bitcoins from all the one that got scammed. Good luck even getting back your account if you aren't named Bill Gates.
slaymaker1907 6y ago
I worked at a bank as an engineer and while some people did have _read_ access on certain databases, anything PII or otherwise highly sensitive would require special approvals and such approval would only be granted in 1 hour intervals. Write access generally required submitting the specific update query for approvals and was highly discouraged.

hombre_fatal 6y ago

Education programs only move the needle, not something you do instead of minimizing the number of attack vectors. For example, education programs do squat against me attacking the employees directly (targeted malware, getting on their computer somehow, offering each of the thousands of employees $10,000 for temp access to their account). And each additional employee only strengthens my attack.

dguido 6y ago

It's not sensationalist when you realize it directly contradicts Twitter's prior statements from just last year about it: > Twitter, in a statement, said it is aware that "bad actors" will try to undermine its service and that the company "limits access to sensitive account information to a limited group of trained and vetted employees." https://www.npr.org/2019/11/06/777098293/2-former-twitter-employees-charged-with-spying-for-saudi-arabia https://www.npr.org/2019/11/06/777098293/2-former-twitter-em... 1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." It's news because they misled people about their security, again.

ceejayoz 6y ago
> 1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." That's not necessarily true. 20% of the company could fairly reasonably be deemed "limited", and there being a thousand of them doesn't mean they're not trained on their tasks.
- monsieurbanana 6y ago
  We'll have to agree to disagree on what we consider fairly reasonable to call "limited".
- dorkwood 6y ago
  Today I learned that Twitter has 4,600 employees. What are they all doing?
  - vangelis 6y ago
    They have 35 offices, I assume it adds up.
    - dorkwood 6y ago
      Oh, right. That makes sense.
  - freeone3000 6y ago
    Support, operations, legal, purchasing, finance, marketing, development, and management.
  - yomly 6y ago
    Ya cos Twitter is just a CRUD app /s Once you want to add more people to any business, you need to add even more people to that business. Lets say you have 10 engineers and want to add another. Suddenly HR's workload has tipped over the limit and you need more HR people. Now communication is fracturing for those 10 engineers and you need a Product Manager and an Engineering Manager to centralise the steering and cohesion of those 11 engineers. Now budgets, payroll and accounting has increased and you need another Finance person. Suddenly your office is too small so you need a bigger office and an office manager. This is obviously a contrived example, but having worked at very early stage startup, a mid sized startup and a global megacorp while seeing all of them go through various growth cycles you start to appreciate how headcount can creep in ways which feel indirect to the most pressing problem at hand (ship more features, deliver more customer value). You see it software terms too - as your software project scales suddenly you need more infra, your CI environment gets more complex. Suddenly your workflows don't scale as too many engineers are working on the same code, so you rearchitect (components/microservices) then you need to start building dev tooling and metrics/observability.... I guess as some kind of system scales, the leverage you gain from adding a thing to it has some diminishing curve / inverse relationship to the size of the system.
akersten 6y ago
I don't think that's a contradiction, I think you and Twitter have different understandings of what the size of a "limited group of employees" is. The usual advice of dismissing nebulous corporate statements like that applies. Anyway, even if they had provided a figure, I think you're taking it out of context - the quote says access to "sensitive account information" is limited, not access to account recovery options. So it's potentially someone outside of that limited group whose credentials were compromised.
- bigiain 6y ago
  <cynical view> I think the misunderstanding is over the phrase "sensitive account information". I notice it wasn't Nestle or Verizon or Disney or Heinz or Unilever accounts that got hacked. You know, the information about "accounts". The records of monetary transactions. https://www.statista.com/statistics/1094351/us-twitter-advertisers-ranked-by-impressions/ https://www.statista.com/statistics/1094351/us-twitter-adver...
vangelis 6y ago
I'm sure they took a web training before being handed the keys to the kingdom.
verroq 6y ago
It can be every employee except one and still be called "limited group of trained and vetted employees". It's written that way so that they covered their ass, it's not a statement of security.
nl 6y ago
> 1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." It's news because they misled people about their security, again. I don't think this is misleading at all. Your bank probably has thousands of people who can get equivalent access to your account, and they serve a lot less people than Twitter, and mostly during business hours, in one language, in one country. 1000 people in total when they have to have some available 24/7 isn't many. Say 200 of them are individual technical staff with access for specific debugging purposes. Then it's only 200 people per 8 hour shift. There's probably requirements for specific language support too, which increases the head count. There was a period of time some years ago when Twitter's peak usage was from Japan, in Japanese hours, in Japanese language.
MattGaiser 6y ago
Banks make the same promise that it is a "limited group of trained and vetted employees." In an organization as large as Twitter or a bank, that still means thousands of people. You are seeing 1000 as large because you are forgetting the scale on which they operate.
freeone3000 6y ago
1000 people absolutely is limited - it's not everyone at the company! I'm sure they did their annual security training, like everyone here, and they might have even passed an additional screening and another training session for account access. You have unreasonable expectations for what "limited group of trained and vetted employees" means in a CSR environment for millions of customers.
gcc_programmer 6y ago
It's funny how most people think that 1000 out of 4600 employees having admin access is "not misleading" and counts as a "limited" group. It shows how in the public mind, technology groups should not be held accountable for their actions.
- rutthenut 6y ago
  I take it that 1000 out of 4600 employees shows that, not unsurprisingly, a lot of the staff at this technology company may be involved in hands-on activities against live services. Maybe DevOps style.
  - gcc_programmer 6y ago
    Why is that not surprising? Maybe we are used to different types of technology companies though.

tjdetwiler 6y ago

CS tools should require some 2FA based on personal information. CS agents should not be able to access arbitrary data.

manigandham 6y ago

Do they? There are usually levels of access and the bigger the change the more approval you need. Some things can only be done by an entirely separate team with manager sign off and other oversight. It seems like Twitter has none of this, and while you can argue it's not the same a banking, there are still sensitive communications and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals.

akersten 6y ago
> and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals. Unless new information has emerged recently, this wasn't the attack vector. The attack was resetting account emails/passwords and turning off 2FA. I agree that there should have been more protections around this, but it's hardly newsworthy that Twitter employs a large support team to support their large userbase - my main gripe is with how the headline is framed.
- manigandham 6y ago
  There's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then they already have everything. The reset via admin tools must have bypassed the normal email workflow.
  - SifJar 6y ago
    Admin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
    - manigandham 6y ago
      Then that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.

deleted 6y ago

[deleted]

mandatory 6y ago

> The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools. Spear-phishing by its very definition is a highly targeted attack. I wouldn't count on any level of training to prevent someone from getting phished. Given some of the spear phishing campaigns I've seen, I wouldn't trust even myself not to fall for them. It's a problem that needs to be solved with technical solutions like hardware U2F, locked-down customer support devices (e.g. Chrome enterprise policy managed ChromeOS devices), and special account VIP/anomaly locking and auto-escalation.

_jal 6y ago
FWIW, this is actually quantifiable. We contract with a firm that tests employees' response to spear phishing about once a quarter with varying degrees of "difficulty". Part of an overall scheme that also identifies people who blindly click on things for, uh, further email education.
- bigiain 6y ago
  I'd love to know if you have any data to show if that "further email education" makes any difference in future behaviour... The cynic in me reckons "Hell no! Those sorts of people are way too often _proud_ of their zero-thought blind clicking and lack of understanding of how things work"...
p1esk 6y ago
It’s only going to get worse. Imagine your boss calling you and telling you to provide him some info: https://www.wsj.com/articles/fraudsters-use-ai-to-mimic-ceos-voice-in-unusual-cybercrime-case-11567157402 https://www.wsj.com/articles/fraudsters-use-ai-to-mimic-ceos...
miles 6y ago
It's very easy to avoid being spear phished: do not trust any unsolicited message over any medium. Email/text/phone message/popup window purporting to be from your registrar with an urgent call to action? Ignore said call and contact them directly via known good number, email address, URL, etc. EDIT: Voice mimicry scam? Verify via known channel before taking action.

lucio 6y ago

"There's thousands of people that have the ability to drain your bank account right now" Do you have some data to back that up? Sounds implausible

akersten 6y ago
Certainly it will depend on who you bank with, but JPMorganChase has 250,000 employees[1]. If even 1% of them are customer service representatives, bank tellers, or in other positions with direct access to your account (which I hope we can agree is an underestimate), that's 2,500 people right there. [1]: https://www.google.com/search?q=chase+employees https://www.google.com/search?q=chase+employees
- jobigoud 6y ago
  And they all have access to all accounts? I would imagine only a bank teller from the appropriate branch would have access to this branch's accounts.
  - theduder99 6y ago
    Maybe back in the 1960s it was like that. Doesn't matter which branch I open an account at. I can walk into any branch and the teller should be able to pull up my info.
lopmotr 6y ago
Does it matter? There are also millions of people who could murder you or burn down your house or kidnap you and force you to withdraw your money from the bank. But just like a bank worker stealing money, these are all serious crimes and easy to get caught so we're pretty safe.

TwoBit 6y ago

There's a difference though. The money you lost can be returned in the case of theft, which happens a lot. But Twitter cannot undo what happened here. Also I don't think thousands of call center people typically have sole ability to directly overwrite bank and brokerage key data fields.

zkms 6y ago

i dont think spear-phishing training is the solution here; especially given the possibility of collaborating insiders. Short social media usernames are bizarrely coveted and so there's an entire cottage industry based on illicitly commandeering accounts and these operations have used insiders working for cellular telephone companies who are paid to grease along processes like unauthorized SIM-swaps/porting. For operations on accounts where illicit access can cause massive irreversible damage -- either by exfiltrating private information (emails, DMs/PMs, posts on locked accounts, etc) or by making a post that appears authorized (the more notable the victim the worse it gets) -- there has got to be some sort of two-man rule (https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule) integrated into the system that can't be bypassed by the people with authority to make changes to accounts. Otherwise any insider / careless spear-phishing victim will make the changes they want, and theres no reason the adversary will limit themselves to posting shoddily-executed (they used the same address instead of generating one per victim!) bitcoin scams. Furthermore, i'd really like there a way for any user (not just bluechecks) to opt-in to some sort of feature where Twitter enforces more stringent requirements/documentation/delays for the email/phone-change / password-reset processes -- at the cost of accepting higher delays or maybe even monetary payment. There's no reason i need such critical account procedures to happen on twitter (or my email accounts, for that matter) to happen in real-time, and i would happily give that up in order to require that such a procedure only happen after, like, a week of enforced, non-bypassable delay where they contact me with details of the change on all my phone-numbers and emails every day.

irjustin 6y ago

Yes but it's missing the fact that you can't actually drain an account even with access. The overall network is designed for rollbacks, but more importantly, they're internally insured. My money will be put back if someone inside steals it (outside is completely different). With twitter, the damage is not practically reversible since it was a bitcoin scam. The analogy/comparison works to a degree, but misses some key differences as to why this is actually worse with twitter than a bank.

amf12 6y ago

> There's thousands of people that have the ability to drain your bank account right now. That's false equivalence. If a bank employee drains my account without authorization, it won't be difficult to prove and get back. But once your data leaks, it's out there.

bryan_w 6y ago
But a bank employee can leak data as well. Some would say more important data than some tweets

dwild 6y ago

> There's thousands of people that have the ability to drain your bank account right now. Let them do it... the bank will always be responsible and it will always be solved without much issue. Twitter accounts though... good luck taking back theses bitcoins from all the one that got scammed. Good luck even getting back your account if you aren't named Bill Gates.

slaymaker1907 6y ago

I worked at a bank as an engineer and while some people did have _read_ access on certain databases, anything PII or otherwise highly sensitive would require special approvals and such approval would only be granted in 1 hour intervals. Write access generally required submitting the specific update query for approvals and was highly discouraged.