14 ms·
Twitter data breach exposes contact details for 5.4M accounts; on sale for $30k
- deleted 4y ago[deleted]
- andrew_ 4y agoThis is especially problematic as Twitter doesn't allow people to use numbers from Google Voice and other digital phone number services.
- judge2020 4y agoThis is common practice, as a mobile number can be a good signal for determining whether or not an account is a bot; blocking virtual numbers means any would-be fake accounts need to find a dealer for good non-voip numbers, likely increasing the cost of creating these accounts.
- jasonladuke0311 4y agoYeah, good thing too. Wouldn’t want Twitter to be overrun with bots.
- djbusby 4y agoIs this ^^^ grey cause it's wrong or cause it silly?
- Sebb767 4y agoThey are right, but people really hate to give out their real phone number - especially since they get leaked this way and then abused, so in the end they have the bot problem.
- bcrosby95 4y agoTrying to justify not letting people do what they can to protect their phone number on an article about a data breach that leaked phone numbers - yeah, you're gonna get downvoted.
- splonk 4y agoIt's entirely correct. Note that the comment doesn't claim it stops all bot traffic, just that it increases the cost of creating fake accounts. Nor does it make any judgment on the morality or efficacy of such measures. People likely downvote such comments because they're reading something into it that isn't actually there.
- barbazoo 4y agoWell, it's clearly not working since there are millions of bot accounts.
- eli 4y agoHow does that prove it's not working?
- pc86 4y agoIs this a serious question? If your justification for requiring non-VOIP numbers is "it decreases the number of bots on the service" and the service is overrun with bots, clearly requiring non-VOIP numbers hasn't done much of anything to decrease the number of bots.
- che_shirecat 4y agoJust because a service isn't overrun with bots already doesn't mean it couldn't be 10x worse to the point where twitter becomes usable if existing mechanism like blocking non-VOIP numbers didn't exist. If they got rid of that constraint I could easily spin up a million bot accounts (captcha bypass is trivial) if I wanted to.
- 0xedd 4y agoI only killed 10 people, officer, not 100; therefore, I'm not a criminal.
- eli 4y agoThe justification for wearing seatbelts is they save lives in a crash and yet fatal car crashes are common. Does this prove seatbelts don’t work?
- solarkraft 4y agoWhich is so terrible. They're proving again and again that virtual numbers (or generally any proxy for PII) are the only ones that they can be trusted with.
- atyppo 4y agoI can spend $2 to get a number on a website that will pass anything, including Google itself. Not going to name the site but it's not exactly difficult to locate
- pedro2 4y agoToo many copycats, never found such site. Is it a shared number?
- zhfliz 4y agoif it's the same one i'm thinking of, the number is shared in the sense that you can buy a verification for google while someone else can buy a verification code for twitter on the same number. iirc they had a guarantee that the number won't be reused for the same service for at least 6 months from order.
- rr808 4y agoIts an interesting problem, is the real reason to use this as you have to pay to get a phone so is less likely to be a bot. I'd rather use GV or similar and avoid the risk of hacking my phone company account.
- e-clinton 4y ago>Twitter doesn't allow people to use numbers from Google Voice Untrue. Source: my Twitter account uses a Google voice number.
- X-Istence 4y agoHow old is your account?
- rajman187 4y agoI certainly use a GV number
- lazaruzLong 4y agois this how Elon is gonna raise the $
- rvz 4y agoSo much for signing up and adding your phone number. Not really a very clever idea now is it since this attack was able to link people's Twitter IDs with their email addresses and most importantly, their phone numbers. So if another company had a previous breach somewhere which linked both the email and the phone number and then a physical address came up... Then it's game, set and they're fully doxxed and that's that.
- TheJoeMan 4y agoBig impact too on the “coveted” twitter handles I bet. I think it’d be ironic to receive a physical letter wanting to buy your twitter account.
- blooalien 4y agoAlso, just one more reason it's not wise to use SMS / phone number as your "second factor" in 2FA (two factor authentication). Always prefer a proper 2FA app or USB key type device over SMS. For a lotta these folks, these "hackers" (and whoever they sell the data to) now have enough information to steal these people's accounts (in many cases not just their Twitter accounts, either, but probably most of their accounts across multiple services).
- Jordrok 4y agoYet another reason why requiring phone numbers for account creation/verification is an awful, user-hostile idea. I've always hated services that do this.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- richbell 4y agoFacebook pressured people into adding their phone number under the guise of account safety, however, their true motive was to harvest phone numbers. As far as I'm concerned it's not only user-hostile, but deliberately malicious. Moreover, there's no excuse for services to use phone numbers for 2FA.
- pid_0 4y agoIt’s actually to reduce trolls, bots, etc. the easier it is to make an account the lower quality most accounts will be.
- EddySchauHai 4y agoYep. “Suspicious activity detected, please add a mobile number to confirm you’re account” 24h after creating a new account like clockwork.
- smolder 4y agoMicrosoft did this when I signed up to play Halo Infinite. I had a few hours of play time doing nothing at all suspicious and deleted the game rather than give them my phone number.
- cronix 4y agoNot nearly as bad in my book as the despicable people who haphazardly give access to their contacts. I don't care if you dox yourself.
- ProjectArcturis 4y agoAnd before too long that data will be floating around on a torrent for free.
- palijer 4y agoCorrect me if I'm wrong, but Twitter knew about this vulnerability back in January, and they either didn't check to see if it was exploited, or they didn't disclose that it was, or they didn't have enough observability/audit controls in place to see 5.4M requests for account data that used this vulnerability? That seems like gross negligence to me no matter what the reason for that is, but I play in a much smaller pond and maybe I just don't understand that the cost to do things ethically at scale is always greater than cleanup.
- bloodyplonker22 4y agoI believe you're correct, and remember, this is a grossly mismanaged company at all levels, from the top down.
- eastbound 4y agoThat could explain Elon Musk’s sudden reversal. I don’t understand his motives for proposing-then-withdrawing (the other theory is that the market crashed and he wanted to halve the price, but he’s a senior, anyone could have guessed that the market was on a downwards trend; another theory is that he didn’t expect such opposition and withdrew seeing that he was seen as the bad guy).
- benj111 4y agoOr he farted out a tweet about buying Twitter. Then woke up next day and changed his mind?
- ahtihn 4y agoDid he also fart out the merger contract and the signature he put on it? A tweet isn't a binding offer last I checked.
- black_puppydog 4y agowaiting for twitter to change their ToS to include a line "if you announce an offer to buy twitter via twitter then that offer is considered a valid contract."
- olivermarks 4y agoIt would be entertaining if all 5 million were bot and sock puppet accounts
- bloodyplonker22 4y agoIt would also be entertaining if Twitter was the one selling this info as a means to bolster their already bad earnings.
- asdff 4y agoThat probably wouldn't even be illegal knowing the state of regulatory capture in this country
- jaunkst 4y agoJokes on them 75% of them are bot accounts.
- e-clinton 4y ago100% of Twitter users are bots. Including Musk’s account.
- IIAOPSW 4y agoI'm a bot? This version of Blade Runner sucks!
- rexreed 4y agoThat's why it's selling for so cheap. Probably overpriced.
- kube-system 4y agoThat too could be interesting data for some.
- was_a_dev 4y agoA potential defence for Musk maybe? E: Disclaimer - I don't care which way the Musk vs Twitter thing goes. I just can see this being the next sticking point
- nathanvanfleet 4y agonope. Why do you think an arbitrary thing will help him slip out of his business deal?
- klyrs 4y agoI can picture the twitter board... "I know how to make this go away, let's accept his offer, pass him a spliff, and say 'wouldn't it be hilarious to do the deal without due diligence?'" [unanimous laughter]
- openthc 4y agoYea, they be laughing at how that fool hits a J.
- kevinmchugh 4y agoI'm under the impression that Musk decided entirely on his own to skip diligence. Am I wrong?
- klyrs 4y agoI think you're right, at least, that's consistent with Twitter's account of the "whirlwind bargaining session." What I said up there was 100% humor. In all seriousness, I'm really hoping that Twitter takes Musk down a notch here, and most of the legal maneuvering has filled me with childish glee. Until today, that is. If the twitter board was aware of this, I'm not sure that even signing away diligence would get them off the hook. I'm not a lawyer, so I'm not really sure what to think here
- blantonl 4y agoWell, corporate governance always has meeting minutes for this exact reason. The corporate secretary always as a fiduciary responsibility to record in written form what was discussed at a board meeting.
- ISL 4y agoIs this in HIBP yet?
- 55555 4y agoThe data from Twitter isn’t but the phone numbers and emails likely are, as this db is basically the result of credential stuffing. The simplest answer is No. HIBP doesn’t know whether you are in this db, but it also isn’t a true breach.
- irrelative 4y agoHopefully “for sale”, not “on sale”
- solarkraft 4y agoHey, 30k is pretty cheap
- 0x_rs 4y agoThis isn't the first time Twitter users' PII is on for sale [0]. I think it's legitimate to badmouth this company because—other than their popularity—there's no redeeming quality but a terrible reputation and a massive toxicity and lack of (real) moderation problem. People who like to dox others will have a lot of fun with this database, regardless. And another point in favor of mandatory phone number based verification for online websites, I wonder how long it'll take for us to get past it, a privacy threat for clueless users and a trivial obstacle for bad actors. [0]. https://www.eff.org/deeplinks/2019/10/twitter-uninentionally-uses-your-2fa-number-targeted-advertising https://www.eff.org/deeplinks/2019/10/twitter-uninentionally...
- m-p-3 4y agoWhat's even more terrible is that if Twitter deems one of your tweet breaks their terms of services (even if incorrectly), they'll ask you to provide some PII and delete the tweet, effectively doxxing yourself in case of a security breach.
- blooalien 4y agoFrom screenshots I've seen from some users this has happened to, the "Delete this Tweet" button they offer you in those circumstances comes with a statement attached saying something to the effect of (paraphrased, but not too far off from the actual text) "Deleting this tweet amounts to an admission that it violates our terms of service" or somesuch similar, basically saying that they're incapable of mistakenly flagging a tweet.
- jfoutz 4y agooh gawd. I signed up for twitter back in the day, and foolishly allowed access to my gmail contact list - of course they emailed everyone. And a few friends reached out to shame me (as they should). they still send a lot of email to that address, but I haven't been able to login for 10 years, maybe more more? I've made a few half hearted attempts. oh well. I suppose having a jurassic era account is helpful. It was either compromised years ago, or not even twitter can access the data. :shrug:
- acidburnNSA 4y agoNot great. I have considered my Twitter DMs to be 'future public information' for a few years now. Same with Facebook. Likelihood of them all being leaked someday seems to be extremely high. I put a lot more trust in Signal, especially disappearing messages.
- smsm42 4y agoThe New York Times principle - never send out anything that you couldn't tolerate being published in the New York Times next to your name. All Big Social are covered by this, including "private" messages.
- benevol 4y agoThe problem - it bears the risk of becoming self-censorship.
- bluehatbrit 4y agoSelf-censorship is a pretty good idea if you're putting your words in the hands of someone else.
- blooalien 4y ago> "Self-censorship is a pretty good idea if you're putting your words in the hands of someone else." Strangely, this sort of thinking used to be "common knowledge" / "common sense" back before everyone started self-publishing every detail of their private lives on world-wide public forums like Facebook and Twitter… Amusing side note; The "Grumpy Old Farts" back in the day where I grew up used to refer to "common sense" as "horse sense", and when asked why, they'd respond "Because every horse has it, even if every person don't!"
- ivank 4y agoA (protected) tweeter mentioned the existence of this issue in June 2020 without exploit details, and it seemed pretty easy for them to discover, so it's possible that other parties scraped this data as well for over a year.
- Thorrez 4y agoInteresting, Twitter $5,040 bounty to the vulnerability reporter. I've heard it said that website vulnerabilities aren't valuable and thus don't merit large bounties. But if a single copy of the database can be sold for $30k (I'm not sure it actually will), then this is a case of a bounty for a website vuln being much too small.
- spoonjim 4y agoThere are a lot of ways to monetize it. Run 2FA attacks on celebrity accounts' phone numbers, dox anon accounts that post racist stuff or follow gay porn and blackmail them, etc etc.
- nickcox 4y agoHow would one make money out of doxing racists?
- spoonjim 4y agoCall them, tell them you'll publish an expose with their real name and get them fired from their job unless they pay you $5k.
- ALittleLight 4y agoI don't think that would work. You only get cancelled if you catch the eye of a social media mob. If it's just some random person complaining that X is a racist then I'd bet X's employer would side with X. "No, trust me - I hacked into Twitter and this anime avatar who says racist things is totally your employee. Hello? Hello?" You could threaten to call up a random person's employer and call them a racist unless they paid you. Seems as likely to work as this would be. You would need someone high profile enough to get the attention of a social media mob to really threaten people.
- spoonjim 4y agoYou don't need to get the person fired - you need to get them afraid of potentially being fired. Not everyone will do a rational takedown like this, and if they do, you have millions of accounts to dox.
- stereoradonc 4y agoThere's a likelihood that 99% of accounts will be bots :-)
- paulpauper 4y agothis is probably how scammers were hacking into accounts to promote crypto scams. you set up some proxies or ec2s to try twitter logins with common passwords but if you fail too many times or wrong country, it will ask for the email. knowing the email or phone bypasses this
- throeaweighs 4y agoI wonder if this is linked to Mudge’s firing in December?
- blooalien 4y agoAnd yet people still ridicule me as "paranoid" and accuse me of having "trust issues" for using an online pseudonym / "handle" and refusing to trust these corporations with any of the private data that so many of these service want to insist upon collecting these days… As if there's some valid reason why I should trust them with data that they repeatedly prove that they cannot keep safe from exactly this sort of "breach"… I just cannot understand how so many people can keep getting burned by these companies and still somehow manage to trust them with reams of private / personal data.
- koonsolo 4y agoCan someone explain to me what all those 7500 employees are doing at twitter? Because I'm totally unimpressed by that. Whatsapp had 55 employees when it was sold, which sounds about right. But 7.5k for just pushing some data around? GTA was developed by 1000 people, and I mean both programatically and content wise it's way more challenging. So what are those 7500 people working on?
- NHQ 4y agocensorship and "moderation"
- rr808 4y agomicroservices architecture lol
- rawoke083600 4y agoHaha
- ushakov 4y agoyou need to hire more people to show “growth”
- johannes1234321 4y agoSelling ads, doing political lobby work, create fancy reports about ad effectiveness, evaluate if there are companies to acquire, ...
- MR4D 4y agoThey manage and run the bot network. /s
- kwere 4y agotwitter says bot detection is done "manually"[0], maybe thats a good chunk of their workforce... [0] https://twitter.com/ajtourville/status/1547265025345216515 https://twitter.com/ajtourville/status/1547265025345216515
- xbar 4y agoData breaches are horrific. But I like the way this headline reads like a sponsor link on 9to5mac.com.
- mromanuk 4y agohow do we check what accounts has been exposed?