12 ms·
“I’m selling data of 400M Twitter users that was scraped via a vulnerability”
- 2bluesc 4y ago> Twitter or Elon Musk if you are reading this you are already risking a GDPR fine over 5.4m breach imaging the fine of 400m users breach source Your best option to avoid paying $276 million USD in GDPR breach fines like facebook did (due to 533m users being scraped) is to buy this data exclusively,
- moralestapia 4y agoHeh, a bug bounty in disguise.
- 2bluesc 4y agoSounds more like extortion
- GlitchMr 4y agoPaying the criminals wouldn't help here. First, there is no guarantee that they wouldn't release the data anyway, second, the data already got leaked - criminals who were responsible for it have access to it, third, they publicly posted the information they have access to it. Instead, the proper solution is after verifying legitimacy of the leak to immediately (within 72 hours) notify supervisory authority and users about personal data breach according to Articles 33 and 34 of GDPR.
- bawolff 4y agoPretty sure that's not how gdpr fines work.
- cypress66 4y ago> Twitter patched this in early 2022 so breach data is 2021 to 2022
- schappim 4y agoThe inclusion of Scott Morrison (ex Australian Prime Minister) as "ScottMorrisonMP" instead of "ScottMorrisonPM" could date things to after 23 May 2022 (when he was voted out of office).
- jcims 4y agoThat account was created in 2009? https://mobile.twitter.com/scottmorrisonmp https://mobile.twitter.com/scottmorrisonmp
- schappim 4y agoAustralian PMs often think they're smart by changing their account name from @xyzmp → @xyz*pm* → @xyzmp. I couldn't remember if Scott Morrison did so, but Google results seem to indicate it[1]. [1] https://www.google.com/search?q=%22%40scottmorrisonpm%22 https://www.google.com/search?q=%22%40scottmorrisonpm%22
- boomboomsubban 4y agoWayback doesn't show he changed his name, it only cached the site twice. Once redirects to the home page, another says account suspended. http://web.archive.org/web/20210801000000*/Twitter.com/ScottMorrisonPM http://web.archive.org/web/20210801000000*/Twitter.com/Scott... Meanwhile ScottMorrisonMP has no dip in caches. http://web.archive.org/web/20210801000000*/Twitter.com/ScottMorrisonmp http://web.archive.org/web/20210801000000*/Twitter.com/Scott...
- ThrowawayTestr 4y ago[flagged]
- jesterman 4y ago[DELETED BY USER] The below commenter is correct.
- nerdawson 4y agoRegardless it’s inappropriate to republish that email address unless he displays it publicly himself
- jesterman 4y agoYou are correct, I’ve edited and removed it. Thank you for pointing that out.
- smcl 4y agoI am guessing that this was relating to certain individuals having Hotmail accounts, rather than more official sounding email addresses? I won't repeat any addresses here, but it did strike me as odd too. Hell even I have a @mylastname.org email address and I'm a nobody.
- simonw 4y agoHaving an email address at your own domain is incredibly risky for most people - because it requires them to reliably renew that domain name every year for the rest of their lives.
- PuffinBlue 4y agoFUD - No it doesn’t. Just renew it every 10 years or whatever max renewal is available. Absolutely no requirement to do it every year. You will also get multiple minders and grace periods if you forget too. That’s not to say ‘most people’ should have their own domain, but renewal is one of the least tricky aspects of domain ownership.
- smcl 4y agoSo there is a risk to some extent - if you forget to renew and ignore any reminders you receive you'll lose your domain and access to anything attached to it. But that's like saying you shouldn't get a mortgage and buy a house, because if you stop paying your mortgage at some point and ignore your bank's increasingly anxious and strongly-worded letters then you'll lose your house.
- thefounder 4y agoThe link is not working anymore. Did Elon buy the exclusive rights? Edit: works again.
- Jamie9912 4y agoWorks for me. What error are you seeing?
- jesterman 4y agoFrom a cursory look the 1000 sample names seems legit, if it’s fake they at least did research to get plausible area codes for phones and some plausible domain names for some celebrities email addresses.
- mundiff 4y agoMore than a couple people are going to need new email addresses.
- greesil 4y agoSome previous commentary https://news.ycombinator.com/item?id=34123707 https://news.ycombinator.com/item?id=34123707 It's not just real email addresses, but this leak (if real) could have also de-anonymized a bunch of people if they were foolish enough to use their real name, or their email address that has this info
- keewee7 4y ago>The seller told me they scraped the data using the same set of weaknesses in Birdsite APIs that allowed the scraping (and publishing) early this year of profile data on 5.4M Twitter users. Sigh... So many of the massive social media leaks are just people taking advantage of their publicly documented APIs. I fear more services will stop providing public APIs and maybe even use constantly changing obfuscation like Snapchat and TikTok to make it harder to use their internal APIs.
- fathyb 4y agoIt's using a vulnerability, you should not be able to get emails and phone numbers for any profile except yours using any Twitter API.
- psnehanshu 4y ago> constantly changing obfuscation like Snapchat and TikTok to make it harder to use their internal APIs. That sounds interesting. Can you point me to some resources to learn more about this?
- keewee7 4y agoSnapchat's API call obfuscation: https://hot3eed.github.io/snap_part1_obfuscations.html https://hot3eed.github.io/snap_part1_obfuscations.html This one about TikTok was recently on the HN front page: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1 https://www.nullpt.rs/reverse-engineering-tiktok-vm-1
- fredgrott 4y agoI submit due to this and other compliance deadlines in Jan 2023 that Twitter will be filing bankruptcy in Jan 2023. If you use twitter as an auth point for other websites you should switch now as a bankruptcy filing might also include a twitter site shut down.
- bboygravity 4y agoI'll take that bet at 10k EUR and I'm dead serious. Easy money.
- smcl 4y agoIf you're offering to bet randos on HN 10k euros, I don't think you are dead serious. edit: oh god there are two more people doing the "Oh I'll bet! How much?" - I've seen this hundreds of times before. Someone states their honest opinion on here, and a handful of others chime in trying to goad them into staking money on it. When they obviously don't (because why on earth would they?) they get accused of being insincere, not being willing to stake "real" money on it (with perhaps the implication that they're small-fry, and do not have the means to do so unlike the wealthy, high-rolling proposer of the wager), or whatever. It's childish, nobody thinks you're cool and nobody believes you'd actually make a frivolous 10k bet with a pseudonymous person.
- bboygravity 4y agoI would actually. There are online escrow services for that. Also I didn't goad anybody into doing anything: they offered to bet and I took the bait (and then edited their post to remove the request for betting). Not the other way around. If you're not willing to bet, then don't create a post on the internet stating that you're willing to bet? simple.
- smcl 4y agoEh I didn't see any offer to bet anything, but in any case if someone on HN says "I bet that XXX happens" then it's safe to say they don't mean "I will bet anything that XXX, name your terms and I will match them, otherwise I concede since you have bested me using logic!" This is not a betting platform and tbh I think dang et al would get in trouble if it turned out HN was facilitating some form of gambling. In reality trying to make someone put money behind their predictions is a way to try to make them back down, look silly/small/cheap and as I said originally, it is childish. Don't do it.
- Liquidor 4y agoThe linked post just seems odd in general. 1) I've seen s lot of leaks being ransomed by hackers and hacker groups before and this post seem a bit amateurish (terms, payment, reference to GDPR, name calling Elon etc) 2) That's not how GDPR fines work (the numbers referenced in the post regarding 400m users). The previous fines were given because of the lack of notifying the EU regulators. Not because of the size of the breach. If Twitter is only made aware of this leak now, they can send the reports now and then work on their internal investigation and no fines will be given.
- infinitedata 4y agoIs that Alex’s Morgan real phone number?
- fifteencharuser 4y agoGuesses... Seller is or was Twitter employee at some point this year. Multiple users on the thread are the same user (the OP). This has been planned since the Elon takeover as a plan B in case things got sour...they got sour.
- noxer 4y agoThis is why I dont register with real data ever anywhere. They do not need my email or phone number for anything but they will store it and likely are not capable of protecting it more than a few years.
- ranguna 4y ago> This is why I dont register with real data ever anywhere Meaning you don't have a twitter account or do you use a burner phone?
- sebzim4500 4y agoI don't think I ever gave twitter my phone number. Was that ever a requirement or is that just in case you need to reset your password?
- frx 4y agoIt is not a requirement but if you don't provide it your account gets suspended as soon as you tweet. This happened to me multiple times.
- noxer 4y agoI was not required back when I registered on twitter. And yes I do have some burner phone numbers too if I need one but I generally just dont use services that need it.
- jb3689 4y agoThere’s a limit to this though. What about shipping and billing addresses? Credit card numbers? Do you just not buy anything at all online?
- noxer 4y agoIf it serves a purpose then that's a different thing and must be evaluated case by case. But if it serves you nothing then just dont enter your real data ever.
- cm2187 4y agoA lot of the sample phone numbers seem to be some dummy number "+0000 2009". Is that a secret way around phone number requirement for twitter accounts?
- jacekpoz 4y agoI think it's part of the account creation date, not all accounts have a phone number.
- deleted 4y ago[deleted]
- cnowacek 4y agoThat’s the time zone offset and year of the “created at” timestamps.
- O__________O 4y agoThat’s just a date value, “+0000” means UTC and 2009 is the year. If the value is in the phone field, might be a glitch or hidden value stored in the phone field that has a meaning that is undocumented; for example that the account was created prior to the phone field being added, though that seems unlikely, since my understanding is Twitter started out as phone-based.
- whywhywhywhy 4y agoNo the phone requirement came way later. You used to be able to sign up with just an email address then they started forcing phone number verification by lying and saying they caught your account acting like a bot so you needed to verify you’re human using phone number (you got the message even if you did nothing or just followed a few people, total lie)
- Eisenstein 4y agoHow did twitter start as an sms system without requiring phone numbers?
- RandomWorker 4y agoThis really shows the importance of apples hide my email feature. I’ve been using it where ever possible. However, I think I might go back through my online accounts and make sure I’ve got it setup. Generally, my phone number has been with spam centres for a while now. I’m not changing it, because it’s so much friction to change it. Right now, I hardly ever take calls because of the massive spam influx. I’m not sure getting a new number will fix this because they cycle numbers and you may just get the spam from a different person. Right now my phone is pretty good at blocking most spam I get through the phone. Not sure how it does this..
- cm2187 4y agoIf you hide your email but can't hide your phone number and companies like twitter or google will not let you create an account without, that does nothing to your privacy.
- sangnoir 4y ago> Right now, I hardly ever take calls because of the massive spam influx. Perhaps Apple ought to follow Google into the AI-assistant-powered call screening business.
- RandomWorker 4y agoI feel like it’s already doing this but I’ve set it up in a weird way. I’ve changed my notifications to make a sound when it’s from my contact list ( or can be found in a footer in an email inlever received) and else it will be silent. I hardly ever get an unknown important call that doesn’t fall in those categories. This has me not picking up the phone for spam calls, but I hardly ever miss an important call. There are other things I’ve setup that I don’t want to go into because they can be solved by the spam callers and I’d like to keep it a secret ;)
- einpoklum 4y agoThis reminds me of how some people these days don't publish an email address on their website, but rather a twitter handle, expecting you to send them 'direct messages' them.
- nottorp 4y agoHmm if i made a twwitter account 7-10 years ago (iForgot when exactly, haven't used it in ages) did they require a phone number then, or it only leaked my email which is already leaked anyway? Edit: thanks, all the reasons listed to give them a phone # dont apply to me so Im safe
- Crosseye_Jack 4y agoThy have never required a phone number for account sign up. So unless you either a) used it as a form of 2FA, b) you got put into a “time out” for what ever reason and Twitter required a phone number to unlock the account, you didn’t have to give them your number.
- MereInterest 4y agoTwitter required a phone number to use the API.
- Crosseye_Jack 4y agoBut not all users are API users. I would say API users are the minority of users.
- tluyben2 4y agoThere was a bug for a while (not sure how long) when account signup with email didn't work. It was going through fine but after everything was set up, you couldn't continue without phone number and it would not activate your account. I'm not even sure if it was a bug or just a test how many people would continue?
- ashwagary 4y agoFlagged IPs probably get different levels of scrutiny.
- johndough 4y agoFor many years now, twitter automatically shadowbans new accounts if they did not supply a phone number during sign up. This is of course just a ploy to collect phone numbers. The reason they give for the ban is is that their terms of service have somehow been violated, even if the account has never posted anything, but the violation magically goes away if you provide a phone number. In the past, you could also write a mail to some support email address, but that took a few weeks even before most twitter employees got fired.
- wkat4242 4y agoI know this was from before the takeover. But this is only going to happen more now that the remaining staff at twitter are overworked and burning out.
- guestbest 4y agoI’m assuming maliciousness on the part of an exemployee
- 93po 4y agoIf you'd read the link it's clear it's from a vulnerability
- 93po 4y agoThere's no meaningful evidence of remaining staff being overworked or burning out
- wkat4242 4y agoIt's a logical extrapolation from the 80-hour work weeks and huge number of people fired. If they're not burning out yet they will be. You can't gut that much of an organisation in one go and expect it to still function.
- 93po 4y agoThey've made performance improvements since the layoffs. It's clearly functioning fine.
- halfmatthalfcat 4y agoYou know this how?
- QuietWatchtower 4y agoLook at the users comment history, literally the whole first page is only him nonstop defending musk in different threads. Wish I could post that pic of weird nerds protecting elon and his companies from valid criticism
- kossTKR 4y agoIf this db contains phonenumbers everyone has effectively been doxxed. All sites requiring phonenumbers should be outlawed or get shut down if they have any breaches, this is potentially a privacy catastrophe and potentially dangerous for thousands of individuals.
- keewee7 4y agoDiscord is the worst offender because it only allows one phone number to validate one account. Meanwhile I have multiple Google and twitter accounts validated through one phone number.
- whywhywhywhy 4y agoMakes absolutely no sense now lots of businesses are using Discord so how are you supposed to have a business Discord account.
- theCrowing 4y agoYou don't need to verify.
- whywhywhywhy 4y agoI can't remember why but I had to switch my phone number from my personal discord to my work discord, either to get it to allow me to login from my iOS Discord or something else asinine. I remember it took me maybe 40 minutes to get into the thing, haven't seen anything like it. So yeah, essentially you do need to verify.
- newsclues 4y agoFor many communities on Discord you must verify to gain entry.
- theCrowing 4y agoThat's the community's choice not discords... https://support.discord.com/hc/en-us/articles/216679607 https://support.discord.com/hc/en-us/articles/216679607
- keewee7 4y agoIs the leaker from India? The sample includes high profile US accounts (who are globally known) and high profile Indian accounts (that are not globally known).
- 323 4y agoLeaker probably wanted to prove it's not just US accounts. It's pretty easy to google "big India twitter accounts" or "big China twitter accounts" - there is a China newspaper on the list, a France Gov agency, ...
- evan_ 4y agoSeems likely that they just did ORDER BY RANDOM rather than picking and choosing.
- drumhead 4y agoDo we know when this happened? Pre or Post Elon?
- brutusborn 4y agoKrebs article was published today so I’d bet it’s post Elon.
- partiallypro 4y agoPeople are saying it's from 2021, I don't even see a Krebs are article on this yet.
- jjulius 4y agohttps://infosec.exchange/@briankrebs/109569533436686804 https://infosec.exchange/@briankrebs/109569533436686804
- rndgermandude 4y agoAs others have mentioned, the time range of when the data was scraped seems to be end of 2021 to start of 2022, maybe into mid 2022. If correct, that was certainly before Elon Musk took over, probably even before he made his initial offer.
- Febra33 4y agoSame, I need to know if I should enter damage control mode and deflect this from Elon or if to simp for him if this happened before. Very important information
- brutusborn 4y agoWho else suspects this is retaliation for Twitter files?
- hackernewds 4y agoNo one
- _kbh_ 4y ago> Who else suspects this is retaliation for Twitter files? There’s literally nothing to retaliate about in the Twitter files it’s entirely a nothingburger dressed up for outrage points. This data is also from 2021 to early 2022 before Twitter files was even a thing.
- brutusborn 4y agoHow can you tell it’s from 2021? Even if it’s a nothingburger, putting out bad PR for FBI and CIA has got to make you some powerful enemies.
- cmeacham98 4y agoFrom the seller in a reply: > Twitter patched this in early 2022 so breach data is 2021 to 2022
- eternalban 4y agoThe strawman of using the date of breach here is asserting that the breach was in response to another event. Timeline of releasing the breached data can be correlated with another event, but the date that they obtained the loot is irrelevant. They could have simply purchased this from an unknown 3rd party themselves. We simply don't know.
- cmeacham98 4y agoIt does matter, because it represents the difference between two different scenarios that don't have the same chance of occurring: 1. The FBI/CIA hacked Twitter and leaked their database in retaliation for the "Twitter files" 2. The FBI/CIA hacked Twitter (or someone else did and they obtained the data) back in early 2022 (for an unknown reason), and are now leaking the data in retaliation for the "Twitter files"
- baryphonic 4y agoI never trusted the Twitter backend, so have always used an anonymized phone number, birthday and email I'm glad I did Just need to change my phone number and I'm set.
- dhsysusbsjsi 4y agoSame I just checked and I have completely fake details and a throw away email. I love it when my past self does cool stuff !
- keewee7 4y agoWhat services do you use for anonymized phone number?
- baryphonic 4y agoI used Google Voice with a couple layers of indirection. Some day I may get a burner prepaid phone if I'm even more concerned about my identity.
- firstSpeaker 4y agoIf real, some people may basically face the death penalty in countries like Iran with the current situation. Anyone with anti-regime content and identifiable attributes in the leaked database is very stressed now.
- sacnoradhq 4y agoTrue, also enabled by state actors apps/servers like Palantir. For recovery and nonrepudiation purposes, storing a salted hash of the phone number would be the wiser course. If using SMS for notification, services like Twitter should have API callbacks and delegate the problems of multi-platform notifications to a trusted third-party similar to credit card processing.
- guwop 4y agoCan you expand a bit on how apps like Palantir could be used for this?
- koolba 4y agoA salted hash of a phone number is both useless and pointless. You can easily brute force the narrow key space if you’re trying to verify if it’s “known”. And if you want to send an actual message you need the full value. Sounds more like you want to outsource user verification and receive an opaque token for future validation.
- sacnoradhq 4y agoCan't brute or rainbow table a salted HMAC, even if the keyspace were 10^10-10^13 because 1. nonces and 2. sufficient number of iterations, mem/cpu/gpu/asic-hard, scrypt-style.
- evan_ 4y agoYou could turn the verification around. Instead of texting a value to a phone number and asking you to toe it in, you say “Text this number to 40404: 123456” Then, wait until someone texts that number in, and salt/hash the caller ID number and compare it to what you’ve got stored. If there’s a match, then you’re authenticated. Probably lots of issues with this from ux perspective…
- ttyyzz 4y agoAssuming this is real, how much could this data be worth?
- irthomasthomas 4y agoI may be wrong, but I believe this is information that was already available to you using the API. The only difference being that they have downloaded all the data and compiled it into an easy to use CSV. So I could see a lot of small-time spammers wanting a copy, but I don't see it being terribly valuable, like actual privative data might be.
- trifurcate 4y agoThere was a publicly available API endpoint to query email addresses and phone numbers given a Twitter handle?
- Febra33 4y agoI'm genuinely curious about this too. I've never heard about such a thing to exist.
- cmeacham98 4y agoThey used an exploit in the public API. You're not supposed to be able to get this data about any twitter account (except your own).
- ailef 4y agoI believe this is not correct. You are definitely not able to get random people's (including government officials) phone numbers and email address using the API.
- Gasp0de 4y agoThey were through a bug in the API.
- deleted 4y ago[deleted]
- discordance 4y agoI wonder if they be fined 4% of their revenue under GDPR
- e12e 4y agoThey can be breached and in compliance with GDPR. Basically you need to do 'best effort', avoid holding on to data you do not need (data required for verifying logins, password recovery would typically be 'data you need') - and report breaches to the authorities and end users. The GDPR does not make impossible demands like "never have a security breach".
- whywhywhywhy 4y agoGee I sure love being forced to enter my phone number into every app I use so there is a nice big single point of failure that apparently can be taken from me with basic social engineering of phone company employees.
- sacnoradhq 4y agoIt's like the fail of using a social security number or email as a primary key, except it's also a potential listening and tracking device.
- graderjs 4y agoPlot twist-Elon actually authorized the leak to create more drama-distraction / leverage: deceptive indication & warning.
- 323 4y agoElon refused to pay $50k to the ElonJet owner and we all saw how that turned out, ... The smart move here might be to pay the hacker.
- ben_w 4y agoI think that makes the reference class "Buy Saint Vincent and the Grenadines, yes the country, to gain control of the TLD that this forum is hosted on". Probably cheaper than Twitter, Saint Vincent and the Grenadines' GDP[0] is about half of SpaceX's revenue. [0] yes I know that's not the same thing as "net worth", and also countries are not generally for sale, despite things like the Alaska and Louisiana purchases.
- printf_alex_ 4y agoBreached did get taken down some months ago when it was on the .to TLD. Elon might have been ahead of his time?
- 93po 4y agoRefusing to be extorted is now worth criticizing?
- deleted 4y ago[deleted]
- evan_ 4y agoShould be able to use the follower counts to pinpoint the exact date and time of the leak, if anyone cares to do so
- evan_ 4y agoAlso if you want to verify the data is legit you can pick a random verified user and try to send them $25 with Venmo. It will ask you to confirm their phone number. Sure looks legit to me though.
- hdjjhhvvhga 4y agoI'm happy I haven't given in and didn't agree to hand them over my phone number, in spite of all grey patterns they used. In the end, I just consume Twitter, and for that Nitter is not only enough, but far superior than the original.
- deepzn 4y agoIt's interesting how celebs use just their plain names @ gmail.com as the username, just like most people. Wait, celebs are people too I guess, right? Ha ha....and I saw one even adding their birth year at the end of the username/email, or just the 2 digits. That became a thing especially for early 90's kids. I did it, and I still see many with that, and I cringe. Like, please realize you are giving your birth year away and that should remain private.
- paul7986 4y agoI was excited about Musk buying Twitter and his supposed free speech agenda. Yet lol free speech when it only suits him as well the constant changing his mind and broken promises. I once again deleted Twitter off my phone. If this hack is true Musk buying Twitter shows he is no genius or ever was. He's just another ego maniac Trump type which the majority of the public is tired of
- Noujin 4y agoWhat does this even have to do with elon?
- CottonMcKnight 4y agoIronically, this data dump could prove particularly useful for me. I have a Twitter account for which I no longer remember the username, and have lost the password. It is, and has been for years, impossible to recover the account, because of a circular dependency in the lost password / account recovery form. I've been tweeting at Twitter Support for years with no avail. Looks like I can just search this data for my email address and find out what the account name is.
- SergeAx 4y agoWow, Steve Wozniak has a really nice phone number!
- theicfire 4y agoThere's a simple zero knowledge proof to show that you actually have the data. Have a CSV of username + salt + hashed(salt + email) + hashed(salt + phone number) , etc. Users can check their own email/phone/etc to verify that the attacker has the data, without the attacker revealing the data. I'm surprised this doesn't happen more.
- deleted 4y ago[deleted]