3 ms·

Account access is one thing, yes, and a hardware 2FA key can help with that. But - what is the reason to allow support personnel to pose as specific users and

by IncRnd 6y ago

Account access is one thing, yes, and a hardware 2FA key can help with that. But - what is the reason to allow support personnel to pose as specific users and send tweets from their accounts? There is more than a security issue here. There is a complete security breakdown.

Thorrez 6y ago
I don't believe there was a tool allowing support personnel to pose as users. I believe the tool allows support personnel to reset emails on accounts. Then the attackers used did password resets on the accounts then logged into the accounts and tweeted.
- IncRnd 6y ago
  I didn't see that in the page for this article. But, that's a good point. The specific text is, "Using the credentials of employees with access to these tools, the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7." So, this doesn't say what actually happened. If it was employees posing as users in order to post, that is an permission which should not be granted. If it was as you suggest, a password reset, then there is a separate issue with 2fa that would be expected on these accounts. Either way, there are serious security issue. This is similar to Oracle calling itself "Unbreakable" and then getting broken. If Twitter cannot safeguard against so many accounts getting injected with tweets, then something is broken with Twitter's security model.
  - Thorrez 6y ago
    >separate issue with 2fa that would be expected on these accounts. I believe the tool also allowed deleting 2FA from the account. > But because the attackers were able to change the email address tied to the @6 account and disable multi-factor authentication, https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e...
    - IncRnd 6y ago
      In other words, there was a tool that allowed posing as users.

by IncRnd 6y ago

Thorrez 6y ago

I don't believe there was a tool allowing support personnel to pose as users. I believe the tool allows support personnel to reset emails on accounts. Then the attackers used did password resets on the accounts then logged into the accounts and tweeted.

IncRnd 6y ago
I didn't see that in the page for this article. But, that's a good point. The specific text is, "Using the credentials of employees with access to these tools, the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7." So, this doesn't say what actually happened. If it was employees posing as users in order to post, that is an permission which should not be granted. If it was as you suggest, a password reset, then there is a separate issue with 2fa that would be expected on these accounts. Either way, there are serious security issue. This is similar to Oracle calling itself "Unbreakable" and then getting broken. If Twitter cannot safeguard against so many accounts getting injected with tweets, then something is broken with Twitter's security model.
- Thorrez 6y ago
  >separate issue with 2fa that would be expected on these accounts. I believe the tool also allowed deleting 2FA from the account. > But because the attackers were able to change the email address tied to the @6 account and disable multi-factor authentication, https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e...
  - IncRnd 6y ago
    In other words, there was a tool that allowed posing as users.