10 ms·
accounts with more than 10,000 followers should at least need two people to change key settings For accounts that could start a war this might be necessary, bu
by laughinghan 6y ago
accounts with more than 10,000 followers should at least need two people to change key settings
For accounts that could start a war this might be necessary, but for celebrities with >10K followers this sounds expensive and unnecessary to me.
To me, it seems like you could instead ensure the admin view of every account has a timestamped log of recent settings changes, including changes done by admins, with a link to the profile of the admin responsible, and a button to suspend that admin account with one click.
This way, the security team could've seen that Elon Musk's account had just been reset by J. Random Employee minutes before tweeting the suspicious bitcoin tweet, messaged J. on Slack to be like "hey did you do that?", and suspended the compromised admin account within minutes.
Sure, some accounts might be briefly compromised initially, but it would be resolved in minutes and not the hours that it took Twitter, right? That seems fine for what should be a relatively low-likelihood, high-expense attack like compromised admin account (of course, you have to ensure that is the case).
- foota 6y agoI think the long tail was in undoing the actions made by the attackers. Resetting passwords, emails, etc.,.
- laughinghan 6y agoNo, according to The Block, @elonmusk repeatedly tweeted the scam at 4:17pm, 5:19pm, and 5:32pm, a span of 90 minutes, and the final scam tweet was at 6:05pm from @KimKardashian. An hour after @elonmusk's first scam tweet, 7 celebrity or corporate accounts had tweeted the scam, all with the same Bitcoin address. With the two-click system I described, how many compromised admin accounts would you expect the security team to have been able to suspend by then? 8 more celebrity accounts went on to tweet the scam, plus @elonmusk and @kanyewest repeating the scam tweets. https://www.theblockcrypto.com/post/71906/twitter-account-hacks-timeline https://www.theblockcrypto.com/post/71906/twitter-account-ha...
- londons_explore 6y agoIf your database system doesn't have a complete audit log of all fields (most databases have this capability, but more often than not it's disabled), it's possible that the mere act of reverting account ownership might remove data needed for tracing down what happened. Sure, it's a sucky position to be in, but I can see why they might have been hesitant to dive right in and start trying to undo damage before understanding what had happened.
- bigiain 6y ago> I can see why they might have been hesitant to dive right in and start trying I mean, after all - it was only the cattle. It's not as if the attackers got into the accounts of customers, the paying advertisers. (Besides, the Part Time CEO was probably in Africa and unavailable to provide decisive direction, right?)
- dtech 6y agoWhich databases? It's definitely not standard in PostgreSQL or MySQL/MariaDB
- londons_explore 6y agoReplication logs (WAL logs in postgres) contain a complete list of changes to every field. Most big companies keep them as part of a backup strategy. But most wouldn't have the tooling to inspect the logs and see exactly which change was made when during an incident.
- ceejayoz 6y agoI once had to restore my Authy 2FAs from a backup, and didn't have access to the original device. Restoring it took 24 hours, during which I got bombarded with text messages and emails warning me that someone was restoring my backup, and that if it wasn't me, I should immediately click or reply to prevent it from happening. Seems like that might help - a 24 hour waiting period on any significant account changes for verified accounts.
- laughinghan 6y agoI actually had a similar idea for fighting SIM swaps—we should be able to ask telecoms "hey, when's the last time this phone number was moved to another device/changed IMEI numbers?" and distrust the number if it's been changed less than 48 hours ago. I've looked but as far as I can tell, such an API does not exist, alas.
- yuliyp 6y agoSomething like Require-Recipient-Valid-Since from SMTP? That would be neat. Does SMS have the necessary protocol flexibility to allow that to be added?
- shakna 6y agoThe User Data Header of SMS [0] isn't very flexible, and quite constrained - both it and the message needs to fit inside a 140 byte payload. There are a handful of bytes reserved for a future purpose, which could be used for something like this, but you're limiting how large the message can be, likely significantly. [0] https://en.wikipedia.org/wiki/User_Data_Header https://en.wikipedia.org/wiki/User_Data_Header
- rutthenut 6y agoFor SMPP, there is the option to add further data using 'TLV' (Tag/Length/Value) parameters, not only UDH properties.
- manquer 6y ago
- icelancer 6y agoAlso have a Slack channel for automated bot notes of high-value targets having their passwords reset, or something similar.
- babesh 6y agoThat just won’t work. Just target the attack in the middle of the night or lunch hour. Furthermore, the next attack will probably be automated and be against far, far more accounts.
- laughinghan 6y agoYeah, response time might be slower in the middle of the night, but a falsified tweet on a celebrity account in the middle of the night is also likely proportionally less damaging. Response time during lunch hour might be slower initially, but after responding to the first compromised account I don't think they'd be any slower. If an admin account is only supposed to be for use by a human employee, it should have a rate-limit tripwire that automatically suspends the account and alerts the security team.
- bigiain 6y ago> ... a falsified tweet on a celebrity account ... A Hollywood celebrity? A bay area techbro "celebrity"? Or a Bollywood celebrity? Or a British Royal family celebrity? Or a KPop celebrity? Or a Russian oligarch celebrity? The middle of who's night??? Twitter does exist on the other side of the Bay Bridge you know...
- laughinghan 6y agoAll of those sound like fairly harmless Twitter accounts to lose control of for a few minutes once in a decade?
- deleted 6y ago[deleted]
- exdsq 6y agoTwitter is a big company - they’ll have someone available 24/7
- donkeyd 6y ago> Just target the attack in the middle of the night Define 'middle of the night'. Is that Eastern US, Western US, GMT, or CET? If I assume it's 2 AM pacific (since Twitter HQ is in SF), that's 11 AM in most of Europe, which makes it middle of the day for about 700 million Europeans, many of whom speak English and are interested in US celebrities. And that's still ignoring the majority of the World. Anything on the internet is 24/7. Musk regularly tweets in the 'middle of the night' and I see those tweets come in while drinking a cup of coffee. Also, Twitter has offices around the world and people don't collectively log out for lunch at a specific time, so there should always be people available to handle this type of incident. Provided they get the training and tools to do so.
- AmericanChopper 6y agoThere are already organisations that have to control employee access to ‘customer’ data very tightly. Law enforcement. Law enforcement agencies have access to large databases full of people along with a huge amount of very sensitive data (both confidential personal data, and stuff like information about ongoing and typically covert investigations). I’ve worked with several of these types of organisations and the ones that actually want to manage that access well, typically do a pretty good job (though some of them actually want to do it badly, or just don’t care). Locking down access to sensitive admin consoles isn’t tremendously difficult, requiring additional approval workflows for highly sensitive operations isn’t particularly difficult, and in that context non-repudiation is rather simply to address.
- jameshart 6y ago> There are already organisations that have to control employee access to ‘customer’ data very tightly. How about... anybody who has customers in the EU?
- AmericanChopper 6y agoThe EU doesn’t provide any standards at all relating to information security. It only specifies that security controls must be ‘appropriate’, but no definition or precedent for what that means. Customer service and community moderation staff accessing customer data, or having administrative control over their accounts would certainly not be a violation of EU law.
- throwaway744678 6y agoParent was probably referring to GDPR, which (IIRC) mandates that employees only have access to the information strictly necessary for their position. You doctor's secretary should only have access to your appointment schedule and phone number, not your medical condition.
- C1sc0cat 6y ago
- jliptzin 6y agoHow about we don’t start wars based off a twitter feed?
- delecti 6y agoIn an ideal world, world leaders would all have restrained enough Twitter habits such that anything that inflammatory would be seen as an obvious signal that their account was compromised.
- praptak 6y agoIt is not about bad habits, it's a systemic problem. World leaders are also politicians that need to maintain their internal position (even dictators need to at least prevent a coup). So when they spew inflammatory rubbish it's often to appear tough to their internal audience, often at the cost of the interest of their own country. This ideal world has to figure out how to deal with this conflict of interest.
- bigiain 6y agoWhere is this "ideal world" and how do I get there?
- jameshart 6y ago‘Two people’ misses the entire problem here. If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. That chain should be documented somewhere - there must be some record in the ‘verified account management’ system that says something to the effect of ‘after we gave this actual verified human this token, this email from this address arrived on this date containing that token, establishing that this person had control over that email address on that date’. If random twitter admins can change the email address and disable 2fa on verified twitter accounts, and those accounts can still publish tweets without them going into a ‘held pending verification that the blue check mark still applies to the person now in control of that account’ queue, then twitter verification doesn’t mean much. Which might be of interest to organizations like the SEC who hold that communications over a verified twitter account count as official corporate notices, and various public safety organizations that have let it be known that messages on their twitter can be relied on as a source of official information during natural disasters... Twitter needs to get serious about blue checks.
- Thorrez 6y ago> held pending verification that the blue check mark still applies to the person now in control of that account That sounds to me like it's simply having a 2nd person verify the email change is correct. So your suggestion and the article's suggestion ("should at least need two people to change key settings") seem to be very similar if not the same as each other.
- jameshart 6y agoProcess can be automated depending on how the account needs to be verified. Might be that say for a brand account it is connected to a domain ownership/verification model, where 1) email address must be in a particular domain, and 2) email must be able to complete a challenge/response process that demonstrates they control the company website - eg some random value is sent to the email address and they have to make it available via an https resource on the company domain. For personal celebrity accounts maybe verification is just that the email address must send in a scan of a government photo Id, and sure maybe that triggers a manual check, but it’s not just a ‘two keys’ solution - it’s a verification process. Sure, the same admin console might be able to go in and change the verification mode and rules on a verified account - but that’s something that would happen rarely, and a flurry of activity changing the verification process for a bunch of accounts would definitely merit a red flag.
- SifJar 6y ago> this sounds expensive and unnecessary to me Should we be OK with what has become a significant communication platform being run with sub-par security because it's "expensive" to do it properly?
- bigiain 6y agoPersonally I think we need to step back and work out why the fuck anyone is OK with Twitter "accounts that could start a war"? And yet here we are.
- throwaway744678 6y agoThere may be a bit of an hyperbole in the expression "accounts that could start a war": there are indeed accounts of people who could start a war, yet I fail to imagine how a single tweet, or a few tweets, by some hacker could actually start a war. Escalate tensions, sure. But I assume world leaders and their advisors don't rely (solely) on tweets before calling the cavalry.
- bigiain 6y agoSure, how about we dial the hyperbole down a bit, to "accounts universally known to be a primary mechanisms for announcement of international policy by the leader of a country which has started 12 'armed conflicts' in the last 20 years (or 14 if you count them doing it twice in Iraq and Lybia)"? I find it quite horrifying that elected officials are legally allowed to use totally unaccountable social media platforms to communicate policy to the public.
- 0-O-0 6y agoWhat are our options here? Some *.gov website that public isn't going to read?
- necovek 6y agoThat's on the public, ain't it? Next thing, some will demand that all communications with the government happen over twitter too (or another private entity), thus forcing people to have accounts on them.
- dudul 6y agoHow would a Twitter account start a war?
- michaelt 6y agoI don't know if it's possible. But people who do think it's possible probably think it would happen something like this: https://twitter.com/realdonaldtrump/status/1213919480574812160?lang=en https://twitter.com/realdonaldtrump/status/12139194805748121...