7 ms·

If this turns out to be true, then we can conclude two things: 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full a

If this turns out to be true, then we can conclude two things: 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. 2. This also explains why the profit of the hack was 'only' ~$100k. Many speculated about how incredibly valuable such a hack could be and how much more a group could have profited from this hack. Using it for two hours of bitcoin scamming seemed very amateurish. I suppose this explains it.

happytoexplain 6y ago
Frankly, I don't take "a teenager did it" as an extra mark against hacked systems any more. It's the details that matter - the difference between one teenager and multiple adults being able to hack something is not large unless the context is government hacking.
- lima 6y ago
  Maybe in terms of raw skills, but adults are likely to have more experience, better judgement and better opsec.
  - dagmx 6y ago
    Not to mention likely have better access to hardware and other resources
  - cle 6y ago
    This works against them in many ways. They're also more likely to say "that wouldn't work", and to be otherwise biased by their prior experience.
    - jayrice257 6y ago
      But having no experience also can work against you in giant ways like leading to dead ends and hurdles you don't know how to overcome. Overall there's not a good argument that it's a better position for an individual to be in for success.
    - tornato7 6y ago
      Yes, a teenager, especially one stuck at home and not going to school, might just spend weeks and weeks poking around to see what he can hack, and is much less afraid of the consequences
YinglingLight 6y ago
What does the hack provide? Credible deniability for all VIPs involved for all DM's they've ever made. "I was hacked back in July 2020!"
hentrep 6y ago
My initial thought was that the bitcoin move was a red herring. DMs associated with the compromised accounts could be very well worth much more than $100k.
- letier 6y ago
  https://twitter.com/twittersupport/status/1286088135525318656 https://twitter.com/twittersupport/status/128608813552531865... https://www.theguardian.com/technology/2020/jul/23/twitter-hackers-accessed-dms-of-up-to-36-accounts https://www.theguardian.com/technology/2020/jul/23/twitter-h... "We believe that for up to 36 of the 130 targeted accounts, the attackers accessed the DM inbox, including 1 elected official in the Netherlands." You might be on to something.
nonsapreiche1 6y ago
never underestimate the intelligence of a teenager!
- pcunite 6y ago
  Imagine what a russian could do.
  - Ericson2314 6y ago
    nyt 2025: Chinese-russian teenager gets donald trump elected in every single country using birth certificate 2fa
  - logicslave 6y ago
    That you nancy pelosi?
- chasd00 6y ago
  Never overestimate the intelligence of teenager either. I say this as a former teenager
  - unishark 6y ago
    How are we supposed to get an exact estimate of their intelligence then?
ggggtez 6y ago
The Krebs article says that prior to the bitcoin hack, they were selling accounts such as @6 for $2000. They probably had a rapidly shrinking window and the bitcoin scam was the last ditch effort before whatever admin account they hijacked got discovered.
imgabe 6y ago
People did say things like you could have made a fortune shorting stock by tweeting something insane from Elon Musks account. I don't buy that as necessarily better than a Bitcoin account. Stock transactions are heavily regulated and monitored. You'd leave a pretty large paper trail of any stock manipulation you hoped to profit from. Of course Bitcoin is highly traceable as well, so maybe the lesson is hacking into high-profile Twitter accounts just isn't as profitable as you'd hope?
- woutr_be 6y ago
  If they knew up front they would be doing this, they could’ve shorted Tesla in smaller positions, over multiple accounts. There’s tons of people shorting Tesla, would it really be traceable to any of those?
  - vkou 6y ago
    Yes, because the SEC isn't stupid, and would trawl through the data, until they found: * A set of freshly opened accounts. * That only shorted a single stock. * Right before a major hack. * That cashed out all at once. * That never traded again. And then they'd start calling the owners of those accounts, and asking questions. Most of those accounts would be legitimate traders, but that's fine - there's not that many accounts that satisfy four of those five criteria. A few sql queries can narrow it down to the point that basic detective work can solve the rest. The problem with playing stupid games on the stock market is that there's a very clear paper trail that will link you, as a human being, to the money that you're hoping to make. At least with bitcoin, you can theoretically isolate yourself from the source of the funds, through tumblers, transferring money in and out of shady exchanges, etc. This is also exactly how the SEC catches insider-traders. By analyzing the flow of trades, and following up on suspicious ones. If the first and only trade you've ever done in your life is a $200,000 short[1] on your employer twenty minutes before a disastrous earnings, you might soon be talking to a very nicely dressed man who would love to get another conviction under his belt. [1] If you think you're playing 34-d chess, and have done a bunch of other options trades surrounding it, to disguise it, you're just as likely to piss away all of your money before you even get a chance to insider-trade. That's the beauty of options - they will part a fool from their money before they can spit.
2OEH8eoCRo0 6y ago
Wasn't social engineering involved? It could simply be a numbers game. Twitter is no doubt probed daily by attackers and one managed to get through.
syshum 6y ago
I would add 3. People need to stop using "Trust <<insert large company>> instead of self hosting because they have teams of security "experts" and will have far better security than you ever could on your own"
ehsankia 6y ago
Wasn't there one more person involve (Kirk#5270) who apparently did most of the work and let these kids do the work? Sounds like a MafiaBoy situation, where more experienced hackers did the work and let younger script kiddies take the fall for it.
- dyslexit 6y ago
  It's implied that the 17 year old is kirk
dehrmann 6y ago
> 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. Someone else spoke to him being a teenager as not especially relevant, and I agree; it dismisses teenagers somewhat. You're also falling for a selection bias. Twitter is a big target and likely stops attacks like this daily. This is just the one that got through, and probably more because of luck than skill.
peroporque 6y ago
...and 3) if a teen can do it, then so can every intelligence service in the world. Just that they would probably stay quiet for years and years and gather data of "interesting" people.

happytoexplain 6y ago

Frankly, I don't take "a teenager did it" as an extra mark against hacked systems any more. It's the details that matter - the difference between one teenager and multiple adults being able to hack something is not large unless the context is government hacking.

lima 6y ago
Maybe in terms of raw skills, but adults are likely to have more experience, better judgement and better opsec.
- dagmx 6y ago
  Not to mention likely have better access to hardware and other resources
- cle 6y ago
  This works against them in many ways. They're also more likely to say "that wouldn't work", and to be otherwise biased by their prior experience.
  - jayrice257 6y ago
    But having no experience also can work against you in giant ways like leading to dead ends and hurdles you don't know how to overcome. Overall there's not a good argument that it's a better position for an individual to be in for success.
  - tornato7 6y ago
    Yes, a teenager, especially one stuck at home and not going to school, might just spend weeks and weeks poking around to see what he can hack, and is much less afraid of the consequences

YinglingLight 6y ago

What does the hack provide? Credible deniability for all VIPs involved for all DM's they've ever made. "I was hacked back in July 2020!"

hentrep 6y ago

My initial thought was that the bitcoin move was a red herring. DMs associated with the compromised accounts could be very well worth much more than $100k.

letier 6y ago
https://twitter.com/twittersupport/status/1286088135525318656 https://twitter.com/twittersupport/status/128608813552531865... https://www.theguardian.com/technology/2020/jul/23/twitter-hackers-accessed-dms-of-up-to-36-accounts https://www.theguardian.com/technology/2020/jul/23/twitter-h... "We believe that for up to 36 of the 130 targeted accounts, the attackers accessed the DM inbox, including 1 elected official in the Netherlands." You might be on to something.

nonsapreiche1 6y ago

never underestimate the intelligence of a teenager!

pcunite 6y ago
Imagine what a russian could do.
- Ericson2314 6y ago
  nyt 2025: Chinese-russian teenager gets donald trump elected in every single country using birth certificate 2fa
- logicslave 6y ago
  That you nancy pelosi?
chasd00 6y ago
Never overestimate the intelligence of teenager either. I say this as a former teenager
- unishark 6y ago
  How are we supposed to get an exact estimate of their intelligence then?

ggggtez 6y ago

The Krebs article says that prior to the bitcoin hack, they were selling accounts such as @6 for $2000. They probably had a rapidly shrinking window and the bitcoin scam was the last ditch effort before whatever admin account they hijacked got discovered.

imgabe 6y ago

People did say things like you could have made a fortune shorting stock by tweeting something insane from Elon Musks account. I don't buy that as necessarily better than a Bitcoin account. Stock transactions are heavily regulated and monitored. You'd leave a pretty large paper trail of any stock manipulation you hoped to profit from. Of course Bitcoin is highly traceable as well, so maybe the lesson is hacking into high-profile Twitter accounts just isn't as profitable as you'd hope?

woutr_be 6y ago
If they knew up front they would be doing this, they could’ve shorted Tesla in smaller positions, over multiple accounts. There’s tons of people shorting Tesla, would it really be traceable to any of those?
- vkou 6y ago
  Yes, because the SEC isn't stupid, and would trawl through the data, until they found: * A set of freshly opened accounts. * That only shorted a single stock. * Right before a major hack. * That cashed out all at once. * That never traded again. And then they'd start calling the owners of those accounts, and asking questions. Most of those accounts would be legitimate traders, but that's fine - there's not that many accounts that satisfy four of those five criteria. A few sql queries can narrow it down to the point that basic detective work can solve the rest. The problem with playing stupid games on the stock market is that there's a very clear paper trail that will link you, as a human being, to the money that you're hoping to make. At least with bitcoin, you can theoretically isolate yourself from the source of the funds, through tumblers, transferring money in and out of shady exchanges, etc. This is also exactly how the SEC catches insider-traders. By analyzing the flow of trades, and following up on suspicious ones. If the first and only trade you've ever done in your life is a $200,000 short[1] on your employer twenty minutes before a disastrous earnings, you might soon be talking to a very nicely dressed man who would love to get another conviction under his belt. [1] If you think you're playing 34-d chess, and have done a bunch of other options trades surrounding it, to disguise it, you're just as likely to piss away all of your money before you even get a chance to insider-trade. That's the beauty of options - they will part a fool from their money before they can spit.

2OEH8eoCRo0 6y ago

Wasn't social engineering involved? It could simply be a numbers game. Twitter is no doubt probed daily by attackers and one managed to get through.

syshum 6y ago

I would add 3. People need to stop using "Trust <<insert large company>> instead of self hosting because they have teams of security "experts" and will have far better security than you ever could on your own"

ehsankia 6y ago

Wasn't there one more person involve (Kirk#5270) who apparently did most of the work and let these kids do the work? Sounds like a MafiaBoy situation, where more experienced hackers did the work and let younger script kiddies take the fall for it.

dyslexit 6y ago
It's implied that the 17 year old is kirk

dehrmann 6y ago

> 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. Someone else spoke to him being a teenager as not especially relevant, and I agree; it dismisses teenagers somewhat. You're also falling for a selection bias. Twitter is a big target and likely stops attacks like this daily. This is just the one that got through, and probably more because of luck than skill.

peroporque 6y ago

...and 3) if a teen can do it, then so can every intelligence service in the world. Just that they would probably stay quiet for years and years and gather data of "interesting" people.