4 ms·
It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known abou
by drusepth 4y ago
It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account.
Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total accounts (~290M). I don't know what the industry average is for linking phone numbers, but this seems like an exceptionally low ratio.
- junon 4y agoPhone numbers in the US. In other parts of the world, they're longer.
- newsclues 4y agoUs and Canada, remember we (Canada)helped invent the phone systems
- junon 4y agoSo?
- knolan 4y agoAnd all US numbers begin with 555, or so I’m lead to believe.
- midoridensha 4y agoIt's absolutely true. All US numbers are 555-xxxx. You can see this in any US movie or TV show, which we know to be very accurate. Similarly, any time an American car has a fender-bender, or at least one of its wheels leaves the ground, it explodes in a massive fireball.
- martin_a 4y agoThat's what's really holding me back from getting an American car. Just fearing that somebody might hit my car and then it's over.
- macksd 4y agoIndependent of Hollywood, some American cars just might do that. Maybe not in such an impressive manner, but I've been through so many Dodge transmissions and Ford's reputation here is even worse.
- 867-5309 4y agojoking aside, the 5M figure probably came from targeting like this, such as choosing a few area codes with high tech populations and testing the ~10M phone numbers for each area
- fy20 4y agoInternational phone numbers can be up to 15 digits, but in most places the rules narrow them down further. For example in the UK the country code is 44, all mobile phone numbers start with 7, with 9 digits after that.
- deleted 4y ago[deleted]
- cdash 4y agoMaybe Musk is right, they are all bots.
- suction 4y agoMaybe Musk is behind this to weasel out of the contract?
- FBISurveillance 4y agoYes he certainly is; he also reported it afterwards via HackerOne to get that $5k bounty. Two birds one stone.
- ReadTheLicense 4y agoIf Musk is right, it's not weaseling out of contract.
- munchler 4y ago5,000,000 seconds is about two months. The attackers simply might not have had enough time to check more numbers than that. (Assumption: They were checking only one number per second, either to avoid detection or because they were rate-limited.)
- onionisafruit 4y agoWhat percent of mobile numbers do you think are associated with twitter accounts? I don’t know, but it wouldn’t surprise me to find out they had to try 500M or more numbers to find 5M accounts.
- herbst 4y agoWe'd need to actually test it. But I believe the finding ratio would be even lower than 1 in 100.
- rolivercoffee 4y agoAs of Dec 2020 only 2.3% of active accounts had any form of 2FA enabled [1] [1] https://www.bleepingcomputer.com/news/security/twitter-reveals-surprisingly-low-two-factor-auth-2fa-adoption-rate/ https://www.bleepingcomputer.com/news/security/twitter-revea...