5 ms·

Trump Twitter Was Hacked

22 points by ksajadi 6y ago

Pick-A-Hill2019 6y ago
For reference: HN thread from 55 days ago when this story first broke. Nice to find out for sure that it was/is true. https://news.ycombinator.com/item?id=24859217 https://news.ycombinator.com/item?id=24859217
pmoriarty 6y ago
"Twitter has refused to answer direct questions from BBC News, including whether the account had extra security or logs that would have shown an unknown login." No matter what answer they gave, they'd look incompetent.
- albertgoeswoof 6y ago
  Why? He literally guessed the password. The only fools here are trump, his administration and the American population that voted him in.
  - pmoriarty 6y ago
    Why didn't Twitter refuse to let him (and any of their other users, but especially him) use a stupid password? Why didn't they require 2FA (especially from him)? Why didn't they have even more security precautions for his account that wouldn't have let just anyone even with his pw and 2FA log in? Why didn't they have some way to detect and prevent a login from an unexpected location? And if they did have these, it shows they were incompetent in devising or using these precautions. Of course, if this intrusion actually happened, it's not just Twitter to blame. Whoever's on Trump's cybersecurity team also messed up, as they should have had extra precautions way above and beyond anything Twitter had.
    - mike503 6y ago
      Rudy (pocket dialing a reporter, uploading wrong video clips, being locked out of his phone multiple times) Giuliani was his cybersecurity czar at one point. They clearly care about it. This is the issue with the whole situation - Twitter is not an extension of the government. People can enable 2FA or not. That’s on them. The fact that Trump uses it as his official podium is the problem, ultimately. I was worried that we’d see a declaration of war come from him announced on Twitter. The same service where I can see explicit porn right after it and where millions of keyboard warriors talk shit and troll.
      - pmoriarty 6y ago
        You'd think the fact that someone who hacked Trump's account could literally start a war or cause some other serious incident would make Twitter reconsider their apparently lax security policy, at least for extremely sensitive accounts like his. But no, apparently washing their hands of it is more important than saving lives.
NicoJuicy 6y ago
This does not mean he hacked Trump! They checked that, according to his actions, he was within the bounds of the "coordinated vulnerability disclosure". A protective legal measure for whitehat hackers. If he wasn't, then he could be sued for "hacking" and with malicious intent. Source of my info was a dutch article ( the hacker is also dutch): https://tweakers.net/nieuws/175822/ethisch-hacker-wordt-niet-vervolgd-na-hack-op-twitter-account-van-donald-trump.html https://tweakers.net/nieuws/175822/ethisch-hacker-wordt-niet...
- jsnell 6y ago
  Thanks for finding a better source. Something along these lines was kind of my suspicion. Given Twitter is claiming this didn't happen, it's hard to see what kind of evidence he would have that would convince the police. All the stuff like alleged screenshots from inside the account are fakeable and unverifiable without the cooperation of Twitter.
  - NicoJuicy 6y ago
    True, but the hacker himselve is not just "a wannabe" though. He found and disclosed more than 5400 online vulnerabilities, so I would just say that the article doesn't prove any point ( if it's true or false). ( https://tweakers.net/partners/meet-up2020privacysecurity/1278/victorgevers/ https://tweakers.net/partners/meet-up2020privacysecurity/127... ) More information about some of his findings are listed here https://gdi.foundation/#/news/README https://gdi.foundation/#/news/README Small extract: > WeWork’s weak Wi-Fi security leaves sensitive documents exposed > A huge database of Facebook users’ phone numbers found online > China Intercepts WeChat Texts From U.S. And Abroad > Over 90 Million Records Leaked by Chinese Public Security Department > Unsecured MongoDB databases expose Kremlin’s backdoor into Russian businesses
    - jsnell 6y ago
      The original story was wildly implausible. None of it holds up under a moment's thought. He might have a track record, but the burden of proof is still on him. And that is just as true after this article as before. Given Twitter is a broadcast medium, it would have been incredibly simple for him to provide incontrovertible proof rather than screenshots and a claim that he posted a tweet that is indistinguishable from the average Trump tweet.
derision 6y ago
The screenshot proves nothing. Anyone could grab the same images and set the same name and bio
- iamnotarobotman 6y ago
  Exactly. A screenshot is not convincing enough as they can 'inspect element' this 'hack'. Simply show me a video logging into the account in real time with the given password and the 'hacker' can eliminate this skepticism. Quite funny how people can quickly believe this stuff on the internet without thinking again, especially from... BBC online news... sigh.
  - derision 6y ago
    It's even simpler than that, both of the fields in the screenshot are editable fields, so they had to do nothing more than create a new account, upload the same banner and profile picture, and put the text in the boxes
  - jxramos 6y ago
    hey inspect element tricks and developer tools have been put to great effect in the realm of scammers transferring excess refund funds into folks bank accounts.
- anoonmoose 6y ago
  > Mr Gevers had told officers he had substantially more evidence of the "hack". It is very possible that this is just an article with limited info and not much has been released publicly because of privacy/security concerns.
- JohnBooty 6y ago
  Hmmm, yeah. From the linked article, Mr Gevers had told officers he had substantially more evidence of the "hack". An earlier article gives a little more detail, but nothing substantial. From https://www.bbc.com/news/technology-55019858 https://www.bbc.com/news/technology-55019858 -- He did not post any tweets or change any settings, but said he took screenshots of some parts of the president's account. If he has screenshots of private messages, etc, that would certainly prove he had access... but only if Trump or somebody with legit access to Trump's account was able and willing to verify them. Of course, I don't blame this researcher for lacking more concrete proof. He could easily have proved his access by changing something in Trump's account, sending a tweet/DM, etc. But by doing so he likely would have brought some serious legal issues down onto himself.
the_arun 6y ago
And MFA was not enabled?
- wavefunction 6y ago
  Too complicated for people like Trump, who doesn't even read email but instead has them printed out for example, annotates them and sends a reply as a pdf. https://www.politico.com/story/2016/12/donald-trump-technology-luddite-233067 https://www.politico.com/story/2016/12/donald-trump-technolo...
  - ASalazarMX 6y ago
    AMLO, our Mexican President, for some time had a picture of him working at his desk in the official presidency's website. Zooming in on the papers it was evident that they were printed Facebook pages. I couldn't find the image now, this was a year ago.
Zaheer 6y ago
Quite pathetic that our head of state's password was as simple as "MAGA2020!. Twitter should impose complexity requirements for passwords of verified accounts.
- nodesocket 6y ago
  I’m sorry I am not buying this story. No way his password was that and guarantee the presidents account has two-factor. Congratulations Victor on getting world wide press coverage but I am calling BS.
hertzrat 6y ago
“Hacked” seems like a strong word. A security researcher guessed the password and notified people of his findings
binarymax 6y ago
How is this even possible. How can twitter not force MFA for arguably the most important social attack vector of our time.
paledot 6y ago
First thought: Scary, lucky someone more malicious didn't get there first. Second thought: But then, it's hard to think of something that an attacker could do with Trump's account that's worse than what he already does on a daily basis.
s9w 6y ago
not true back then, not true today :)

22 points by ksajadi 6y ago

Pick-A-Hill2019 6y ago

For reference: HN thread from 55 days ago when this story first broke. Nice to find out for sure that it was/is true. https://news.ycombinator.com/item?id=24859217 https://news.ycombinator.com/item?id=24859217

pmoriarty 6y ago

"Twitter has refused to answer direct questions from BBC News, including whether the account had extra security or logs that would have shown an unknown login." No matter what answer they gave, they'd look incompetent.

albertgoeswoof 6y ago
Why? He literally guessed the password. The only fools here are trump, his administration and the American population that voted him in.
- pmoriarty 6y ago
  Why didn't Twitter refuse to let him (and any of their other users, but especially him) use a stupid password? Why didn't they require 2FA (especially from him)? Why didn't they have even more security precautions for his account that wouldn't have let just anyone even with his pw and 2FA log in? Why didn't they have some way to detect and prevent a login from an unexpected location? And if they did have these, it shows they were incompetent in devising or using these precautions. Of course, if this intrusion actually happened, it's not just Twitter to blame. Whoever's on Trump's cybersecurity team also messed up, as they should have had extra precautions way above and beyond anything Twitter had.
  - mike503 6y ago
    Rudy (pocket dialing a reporter, uploading wrong video clips, being locked out of his phone multiple times) Giuliani was his cybersecurity czar at one point. They clearly care about it. This is the issue with the whole situation - Twitter is not an extension of the government. People can enable 2FA or not. That’s on them. The fact that Trump uses it as his official podium is the problem, ultimately. I was worried that we’d see a declaration of war come from him announced on Twitter. The same service where I can see explicit porn right after it and where millions of keyboard warriors talk shit and troll.
    - pmoriarty 6y ago
      You'd think the fact that someone who hacked Trump's account could literally start a war or cause some other serious incident would make Twitter reconsider their apparently lax security policy, at least for extremely sensitive accounts like his. But no, apparently washing their hands of it is more important than saving lives.

NicoJuicy 6y ago

This does not mean he hacked Trump! They checked that, according to his actions, he was within the bounds of the "coordinated vulnerability disclosure". A protective legal measure for whitehat hackers. If he wasn't, then he could be sued for "hacking" and with malicious intent. Source of my info was a dutch article ( the hacker is also dutch): https://tweakers.net/nieuws/175822/ethisch-hacker-wordt-niet-vervolgd-na-hack-op-twitter-account-van-donald-trump.html https://tweakers.net/nieuws/175822/ethisch-hacker-wordt-niet...

jsnell 6y ago
Thanks for finding a better source. Something along these lines was kind of my suspicion. Given Twitter is claiming this didn't happen, it's hard to see what kind of evidence he would have that would convince the police. All the stuff like alleged screenshots from inside the account are fakeable and unverifiable without the cooperation of Twitter.
- NicoJuicy 6y ago
  True, but the hacker himselve is not just "a wannabe" though. He found and disclosed more than 5400 online vulnerabilities, so I would just say that the article doesn't prove any point ( if it's true or false). ( https://tweakers.net/partners/meet-up2020privacysecurity/1278/victorgevers/ https://tweakers.net/partners/meet-up2020privacysecurity/127... ) More information about some of his findings are listed here https://gdi.foundation/#/news/README https://gdi.foundation/#/news/README Small extract: > WeWork’s weak Wi-Fi security leaves sensitive documents exposed > A huge database of Facebook users’ phone numbers found online > China Intercepts WeChat Texts From U.S. And Abroad > Over 90 Million Records Leaked by Chinese Public Security Department > Unsecured MongoDB databases expose Kremlin’s backdoor into Russian businesses
  - jsnell 6y ago
    The original story was wildly implausible. None of it holds up under a moment's thought. He might have a track record, but the burden of proof is still on him. And that is just as true after this article as before. Given Twitter is a broadcast medium, it would have been incredibly simple for him to provide incontrovertible proof rather than screenshots and a claim that he posted a tweet that is indistinguishable from the average Trump tweet.

derision 6y ago

The screenshot proves nothing. Anyone could grab the same images and set the same name and bio

iamnotarobotman 6y ago
Exactly. A screenshot is not convincing enough as they can 'inspect element' this 'hack'. Simply show me a video logging into the account in real time with the given password and the 'hacker' can eliminate this skepticism. Quite funny how people can quickly believe this stuff on the internet without thinking again, especially from... BBC online news... sigh.
- derision 6y ago
  It's even simpler than that, both of the fields in the screenshot are editable fields, so they had to do nothing more than create a new account, upload the same banner and profile picture, and put the text in the boxes
- jxramos 6y ago
  hey inspect element tricks and developer tools have been put to great effect in the realm of scammers transferring excess refund funds into folks bank accounts.
anoonmoose 6y ago
> Mr Gevers had told officers he had substantially more evidence of the "hack". It is very possible that this is just an article with limited info and not much has been released publicly because of privacy/security concerns.
JohnBooty 6y ago
Hmmm, yeah. From the linked article, Mr Gevers had told officers he had substantially more evidence of the "hack". An earlier article gives a little more detail, but nothing substantial. From https://www.bbc.com/news/technology-55019858 https://www.bbc.com/news/technology-55019858 -- He did not post any tweets or change any settings, but said he took screenshots of some parts of the president's account. If he has screenshots of private messages, etc, that would certainly prove he had access... but only if Trump or somebody with legit access to Trump's account was able and willing to verify them. Of course, I don't blame this researcher for lacking more concrete proof. He could easily have proved his access by changing something in Trump's account, sending a tweet/DM, etc. But by doing so he likely would have brought some serious legal issues down onto himself.

the_arun 6y ago

And MFA was not enabled?

wavefunction 6y ago
Too complicated for people like Trump, who doesn't even read email but instead has them printed out for example, annotates them and sends a reply as a pdf. https://www.politico.com/story/2016/12/donald-trump-technology-luddite-233067 https://www.politico.com/story/2016/12/donald-trump-technolo...
- ASalazarMX 6y ago
  AMLO, our Mexican President, for some time had a picture of him working at his desk in the official presidency's website. Zooming in on the papers it was evident that they were printed Facebook pages. I couldn't find the image now, this was a year ago.

Zaheer 6y ago

Quite pathetic that our head of state's password was as simple as "MAGA2020!. Twitter should impose complexity requirements for passwords of verified accounts.

nodesocket 6y ago
I’m sorry I am not buying this story. No way his password was that and guarantee the presidents account has two-factor. Congratulations Victor on getting world wide press coverage but I am calling BS.

hertzrat 6y ago

“Hacked” seems like a strong word. A security researcher guessed the password and notified people of his findings

binarymax 6y ago

How is this even possible. How can twitter not force MFA for arguably the most important social attack vector of our time.

paledot 6y ago

First thought: Scary, lucky someone more malicious didn't get there first. Second thought: But then, it's hard to think of something that an attacker could do with Trump's account that's worse than what he already does on a daily basis.

s9w 6y ago

not true back then, not true today :)