7 ms·

Report on Investigation of Twitter’s July 15, 2020 Cybersecurity Incident

102 points by lelf 6y ago

hmate9 6y ago
Still pretty hilarious that they only managed to get some $100k worth of Bitcoin. Imagine if instead they tweeted from Musk saying something along the lines of Tesla batteries being faulty and they all need to be recalled. Buy some Tesla puts beforehand and that right there is instant millions. Heck, even selling the rights to this hack would have gotten them millions.
- xuki 6y ago
  $100k is a huge amount for a 17 years old kid.
- bisRepetita 6y ago
  Yes, but don't you think that your proposed scheme it is very easily traceable and reversible?
  - paulgb 6y ago
    I think you're right, but it's funny (scary?) to think about how “newbie trader makes big options trade on TSLA” is probably not exceedingly rare in the age of Robinhood and WallStreetBets.
  - bryanrasmussen 6y ago
    well, it was easily traceable what they did anyway. Some schemes can be more easily hidden than others. If you were smart enough to think hey, wait instead of stealing bitcoin I could just use this to cause some stocks to have problems then I can short them. At the point you are smart enough to switch from the dominant way of making money in your enterprise you can probably think up multiple ways to make money that would be even sneakier, and think of ways to hide it, keep the money even if you get caught.
- Kiro 6y ago
  Sell what? They called Twitter employees pretending to be from the IT department. > Armed with these personal details, the Hackers successfully convinced several Twitter employees that they were from Twitter’s IT department and stole their credentials.
- polote 6y ago
  > Coinbase blocked approximately 5,670 transfers, valued at approximately $1,294,000.
  - cageface 6y ago
    Wasn’t the whole point of crypto that some centralized authority couldn’t do things like this?
    - mrtksn 6y ago
      That feature is a bug. Exchanges are providing a bug correction service. Fraud protection and reversibility are actually massive features of the classical banking helping the markets tik. It could become a feature in a post apocalyptic world where the society doesn’t function. Until that day, a system based on social contract will prevail due to massively better user experience.
      - cageface 6y ago
        A post apocalyptic world where mining farms and the internet still function?
        saalweachter 6y ago
        Honestly? Depends on the apocalypse. Imagine a climate change apocalypse rather than the nuclear wasteland of Fallout or Mad Max. Let the sea levels rise enough to displace everyone who is within 30 feet of sea level, add in some famines (also brought on by climate change) and since it's the theme this year, a plague or two exacerbated by a billion climate refugees in camps and slums being ignored by anyone still prosperous. You could end up in a situation fairly apocalyptic, but still have the scavenged resources to assemble an internet, assuming there wasn't some sort of anti-tech uprising among the survivors, angry at technology for causing the disaster and determined to smash any surviving technology (and technologists) to prevent it from happening again.
        6y ago
- rocqua 6y ago
  Bitcoin is a bit traceable. Massively out of the money puts are incredibly traceable, and quite well monitored.
- norswap 6y ago
  Some insight as to why it's had to make money from the hack: https://fortenf.org/e/security/2020/07/15/twitter-hack.html https://fortenf.org/e/security/2020/07/15/twitter-hack.html
- nobody9999 6y ago
  >Heck, even selling the rights to this hack would have gotten them millions. IIUC, the crackers did sell access to the hacked accounts[0]: "Sheppard’s alleged alias Chaewon was mentioned twice in stories here since the July 15 incident. On July 16, KrebsOnSecurity wrote that just before the Twitter hack took place, a member of the social media account hacking forum OGUsers named Chaewon advertised they could change email address tied to any Twitter account for $250, and provide direct access to accounts for between $2,000 and $3,000 apiece." But that didn't net anyone millions, but apparently that wasn't the point of the hack[1]: "People within the SIM swapping community are obsessed with hijacking so-called “OG” social media accounts. Short for “original gangster,” OG accounts typically are those with short profile names (such as @B or @joe). Possession of these OG accounts confers a measure of status and perceived influence and wealth in SIM swapping circles, as such accounts can often fetch thousands of dollars when resold in the underground." [0] https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/ https://krebsonsecurity.com/2020/07/three-charged-in-july-15... [1] https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e...
odomojuli 6y ago
I literally felt the hand of the Doomsday Clock move closer to midnight, and all these hackers were interested in was making a bunch of traceable transactions to a few accounts linked to Gmail. For shame, we need to be teaching our youth better dystopian hacker ethics.
- Kaveren 6y ago
  you spend too much time online if you think you can start any war over twitter
  - odomojuli 6y ago
    Respectfully, I don't think I'm spending too much time online to be cognizant of the fact that we have an administration that is very much capable of doing so. https://www.theguardian.com/us-news/2018/sep/10/trump-almost-sent-tweet-north-korea-imminent-attack https://www.theguardian.com/us-news/2018/sep/10/trump-almost...
    - luckylion 6y ago
      Wait, on the one hand there's the perception of "Trump just tweets whatever comes to his mind", and on the other hand he/whoever actually runs it is drafting tweets, they're purposefully leaking these drafts to NK to gather what they'd feel like if that was sent? That doesn't seem to fit together.
      - odomojuli 6y ago
        "That doesn't seem to fit together" is what I have been feeling for 4 years.
      - ben_w 6y ago
        I don’t have the means (or time or interest) to do this analysis myself, but it has been claimed that half that accounts’ tweets are him personally and the other half are a team: http://varianceexplained.org/r/trump-tweets/ http://varianceexplained.org/r/trump-tweets/
himinlomax 6y ago
> In monetary value, the Hackers stole over $118,000 worth of bitcoin Did they, really? I mean anyone stupid enough to fall for that ploy was going to lose it some other way shortly anyway.
- SirHound 6y ago
  Via theft?
- throw_m239339 6y ago
  Fraud is illegal, wire fraud is a federal crime. You didn't really demonstrate a shred of intelligence yourself by praising scammers defrauding people, scammers that eventually got caught because of their complete stupidity.
  - himinlomax 6y ago
    That was a joke. An obvious one, too.
    - curiousllama 6y ago
      idk didn't read like a joke to me. Poe's law I guess
- moritonal 6y ago
  Don't be cruel to the desperate.
obilgic 6y ago
The language of this release feels rather off...
AzzieElbab 6y ago
10 to 1, it was somebody at Twitter outsourcing their work to wrong person
junon 6y ago
> Twitter plays a central role in how we communicate and how news is spread. The fact a government agency has said this in an official report is saddening.
- tudelo 6y ago
  Can you expand on why it's sad? As someone who doesn't have a twitter account or participate much in social networking sites, it still seems like a true statement at face value for a large part of the population.
  - junon 6y ago
    It is indeed true. I suppose it's more the juxtaposition of Twitter, which many people (including myself) have come to despise, with the government, which should be impartial about private endeavors (arguably), in the same report about Twitter's security deficiencies related to the election. It's just a strange pairing, and to me a bit sad that Twitter of all things has become America's backbone of formal communication. It feels like it could be in Idiocracy. That's all.
yavanim 6y ago
Step 1: Call up Twitter employees and say you're Twitter's IT department and ask the employee to visit a page to troubleshoot a connection problem they're having, and that page asks for a username, password, and MFA code Step 2: With that password, log in to the internal website Twitter employees use to moderate accounts, change jack's account password to "password", log in to twitter.com with username "jack" and password "password" (and repeat for every user you want to login as) Step 3: Make a tweet saying "send Bitcoin to [address] and I'll send double back"

102 points by lelf 6y ago

Still pretty hilarious that they only managed to get some $100k worth of Bitcoin. Imagine if instead they tweeted from Musk saying something along the lines of Tesla batteries being faulty and they all need to be recalled. Buy some Tesla puts beforehand and that right there is instant millions. Heck, even selling the rights to this hack would have gotten them millions.

xuki 6y ago
$100k is a huge amount for a 17 years old kid.
bisRepetita 6y ago
Yes, but don't you think that your proposed scheme it is very easily traceable and reversible?
- paulgb 6y ago
  I think you're right, but it's funny (scary?) to think about how “newbie trader makes big options trade on TSLA” is probably not exceedingly rare in the age of Robinhood and WallStreetBets.
- bryanrasmussen 6y ago
  well, it was easily traceable what they did anyway. Some schemes can be more easily hidden than others. If you were smart enough to think hey, wait instead of stealing bitcoin I could just use this to cause some stocks to have problems then I can short them. At the point you are smart enough to switch from the dominant way of making money in your enterprise you can probably think up multiple ways to make money that would be even sneakier, and think of ways to hide it, keep the money even if you get caught.
Kiro 6y ago
Sell what? They called Twitter employees pretending to be from the IT department. > Armed with these personal details, the Hackers successfully convinced several Twitter employees that they were from Twitter’s IT department and stole their credentials.
polote 6y ago
> Coinbase blocked approximately 5,670 transfers, valued at approximately $1,294,000.
- cageface 6y ago
  Wasn’t the whole point of crypto that some centralized authority couldn’t do things like this?
  - mrtksn 6y ago
    That feature is a bug. Exchanges are providing a bug correction service. Fraud protection and reversibility are actually massive features of the classical banking helping the markets tik. It could become a feature in a post apocalyptic world where the society doesn’t function. Until that day, a system based on social contract will prevail due to massively better user experience.
    - cageface 6y ago
      A post apocalyptic world where mining farms and the internet still function?
      - saalweachter 6y ago
        Honestly? Depends on the apocalypse. Imagine a climate change apocalypse rather than the nuclear wasteland of Fallout or Mad Max. Let the sea levels rise enough to displace everyone who is within 30 feet of sea level, add in some famines (also brought on by climate change) and since it's the theme this year, a plague or two exacerbated by a billion climate refugees in camps and slums being ignored by anyone still prosperous. You could end up in a situation fairly apocalyptic, but still have the scavenged resources to assemble an internet, assuming there wasn't some sort of anti-tech uprising among the survivors, angry at technology for causing the disaster and determined to smash any surviving technology (and technologists) to prevent it from happening again.
        6y ago
rocqua 6y ago
Bitcoin is a bit traceable. Massively out of the money puts are incredibly traceable, and quite well monitored.
norswap 6y ago
Some insight as to why it's had to make money from the hack: https://fortenf.org/e/security/2020/07/15/twitter-hack.html https://fortenf.org/e/security/2020/07/15/twitter-hack.html
nobody9999 6y ago
>Heck, even selling the rights to this hack would have gotten them millions. IIUC, the crackers did sell access to the hacked accounts[0]: "Sheppard’s alleged alias Chaewon was mentioned twice in stories here since the July 15 incident. On July 16, KrebsOnSecurity wrote that just before the Twitter hack took place, a member of the social media account hacking forum OGUsers named Chaewon advertised they could change email address tied to any Twitter account for $250, and provide direct access to accounts for between $2,000 and $3,000 apiece." But that didn't net anyone millions, but apparently that wasn't the point of the hack[1]: "People within the SIM swapping community are obsessed with hijacking so-called “OG” social media accounts. Short for “original gangster,” OG accounts typically are those with short profile names (such as @B or @joe). Possession of these OG accounts confers a measure of status and perceived influence and wealth in SIM swapping circles, as such accounts can often fetch thousands of dollars when resold in the underground." [0] https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/ https://krebsonsecurity.com/2020/07/three-charged-in-july-15... [1] https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e...

odomojuli 6y ago

I literally felt the hand of the Doomsday Clock move closer to midnight, and all these hackers were interested in was making a bunch of traceable transactions to a few accounts linked to Gmail. For shame, we need to be teaching our youth better dystopian hacker ethics.

Kaveren 6y ago
you spend too much time online if you think you can start any war over twitter
- odomojuli 6y ago
  Respectfully, I don't think I'm spending too much time online to be cognizant of the fact that we have an administration that is very much capable of doing so. https://www.theguardian.com/us-news/2018/sep/10/trump-almost-sent-tweet-north-korea-imminent-attack https://www.theguardian.com/us-news/2018/sep/10/trump-almost...
  - luckylion 6y ago
    Wait, on the one hand there's the perception of "Trump just tweets whatever comes to his mind", and on the other hand he/whoever actually runs it is drafting tweets, they're purposefully leaking these drafts to NK to gather what they'd feel like if that was sent? That doesn't seem to fit together.
    - odomojuli 6y ago
      "That doesn't seem to fit together" is what I have been feeling for 4 years.
    - ben_w 6y ago
      I don’t have the means (or time or interest) to do this analysis myself, but it has been claimed that half that accounts’ tweets are him personally and the other half are a team: http://varianceexplained.org/r/trump-tweets/ http://varianceexplained.org/r/trump-tweets/

himinlomax 6y ago

> In monetary value, the Hackers stole over $118,000 worth of bitcoin Did they, really? I mean anyone stupid enough to fall for that ploy was going to lose it some other way shortly anyway.

SirHound 6y ago
Via theft?
throw_m239339 6y ago
Fraud is illegal, wire fraud is a federal crime. You didn't really demonstrate a shred of intelligence yourself by praising scammers defrauding people, scammers that eventually got caught because of their complete stupidity.
- himinlomax 6y ago
  That was a joke. An obvious one, too.
  - curiousllama 6y ago
    idk didn't read like a joke to me. Poe's law I guess
moritonal 6y ago
Don't be cruel to the desperate.

obilgic 6y ago

The language of this release feels rather off...

AzzieElbab 6y ago

10 to 1, it was somebody at Twitter outsourcing their work to wrong person

junon 6y ago

> Twitter plays a central role in how we communicate and how news is spread. The fact a government agency has said this in an official report is saddening.

tudelo 6y ago
Can you expand on why it's sad? As someone who doesn't have a twitter account or participate much in social networking sites, it still seems like a true statement at face value for a large part of the population.
- junon 6y ago
  It is indeed true. I suppose it's more the juxtaposition of Twitter, which many people (including myself) have come to despise, with the government, which should be impartial about private endeavors (arguably), in the same report about Twitter's security deficiencies related to the election. It's just a strange pairing, and to me a bit sad that Twitter of all things has become America's backbone of formal communication. It feels like it could be in Idiocracy. That's all.

yavanim 6y ago

Step 1: Call up Twitter employees and say you're Twitter's IT department and ask the employee to visit a page to troubleshoot a connection problem they're having, and that page asks for a username, password, and MFA code Step 2: With that password, log in to the internal website Twitter employees use to moderate accounts, change jack's account password to "password", log in to twitter.com with username "jack" and password "password" (and repeat for every user you want to login as) Step 3: Make a tweet saying "send Bitcoin to [address] and I'll send double back"