7 ms·

When I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to ge

When I read that once they got into the account all the attacker did was post a link to a crypto giveaway scam, I briefly wondered why someone who managed to get into an account like this wouldn’t try to pivot it into something more sophisticated. Then in the next sentence we learn they made $700k off of the scam! I’ve seen these giveaway scams on hacked popular Twitter accounts for years, I’m surprised they’re still so effective. No need for an attacker to risk making $0 on a more involved attack when they can get easy cash like that, I guess.

quickthrower2 3y ago
They were probably time limited. No long games. Smash and grab.
frantathefranta 3y ago
Using the account of probably one of the few trustworthy people in crypto probably helps.
- baybal2 3y ago
  Ironically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login. If you plug SIM card into desktop, you can actually do signing with it, and TLS authentication. I recall, only Nokia S60 series, and A200 had a SIM card API exposed to apps. Ios does not give you access to SIM, Android does only for system apps.
  - londons_explore 3y ago
    Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.
    - skdk 3y ago
      The API could return different identifiers per app
      - eli 3y ago
        While it's also signing things for you? That seems rather hard to implement.
        wiml 3y ago
        It's what FIDO/U2F does, right?
      - slashdev 3y ago
        That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.
        londons_explore 3y ago
        Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.
        aleph_minus_one 3y ago
        > Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example. I doubt that: simply add two "SIM identities" (which on the mobile phone map to the same SIM card) to the account of the respective service.
    - lawlessone 3y ago
      My redmi has a sim card toolkit app, i've never used it . Reading this i am now more suspicious of it. Before you all warn me i know it is the worst possible brand to own, i am getting spied on by all the regulars that come with Android - Google/ US agencies but i also get the added bonus of China spying on the device. But i was broke.
- aleph_minus_one 3y ago
  > Using the account of probably one of the few trustworthy people in crypto probably helps. The fact that some person is trustworthy by his personality traits does not imply that he does have the (also technological) skills not to become scammed or impersonated.
- itiro 3y ago
  [flagged]
smeej 3y ago
Back in 2020, some teenage kid got access to "God mode" on Twitter and burned it on a crypto scam too. Easy money seems to be a pretty common goal. https://fortune.com/2020/07/16/hackers-blew-twitter-god-mode-on-shenanigans/ https://fortune.com/2020/07/16/hackers-blew-twitter-god-mode...
- deleted 3y ago
  [deleted]
londons_explore 3y ago
I could easily imagine the scam had 30 victims, with 29 of them losing $10 and the remaining one losing $700k.
netsharc 3y ago
$700k? I see that human idiocy is a large untapped source of wealth...
- cdchn 3y ago
  The crypto "degens" are pretty much the perfect cohort for pulling these kind of scams on. They're driven by fast money, unearned profit, and the premise of investment despite all rational signals pointing to it being a bad idea. Its a Condensation of Rubes.
- eli 3y ago
  And all those people had crypto wallets ready to go. Go figure.
cdchn 3y ago
If there is a sophisticated attack pivot that is as profitable, quick, proven and safe, I don't think anybody knows what it is.
yyyk 3y ago
$700k in NFTs I recall. Isn't that more like $70?
- yyyk 3y ago
  Downvote all you like. NFTs have no real liquidity (or usecase), the 'price' is just wash trading.
  - msm_ 3y ago
    You may or may not be right (I don't know enough about cryptocurrencies to know), but I think people don't like your snark. Some people lost a lot of money - they are victims of a scam. Now how much the attacker will actually earn from this is another matter, but your original post was not a very welcoming start of a discussion.
  - j0hnyl 3y ago
    Big ticket NFTs are worth a lot of money and highly liquid. Also drainers will siphon eth and erc20 tokens as well.
gmerc 3y ago
Crypto bros are self selecting for scams. If your world view has been degraded to see zero trust as a solution rather than a dystopian end state, meaning you’ve lost all trust in society, you’re highly vulnerable to be conned by the authority figures you secretly crave to trust. It’s much of what Elon, Trump and other populists actively foster and exploit in their fan base through relentless conspiracy theories and undermining of trust into anyone who isn’t them. There’s a paradox here - the more people have their trust violated, the more distrustful they get, the easier they get scam as the overhead of approaching every transaction / interact in life with an adversarial mindset exhausts critical capacity and drives people into desperate savior fantasies - technological miracles, charlatans. snakeoil, the twentieths coin or pump and dump. Zero trust (non security version - the inability to extend trust) is a miserable desperate state to be in as a human being and makes people highly vulnerable to getting taken advantage of and crypto signaling on social media either identifies you as a scammer or as a mark. You still believe technology can solve societies trust dilemma, you are asking for it at this point. And the longer the scamming goes on, the stronger the signal of this self identifying audience becomes. It’s like responding to Nigerian prince emails at this point. Go reddit, look at the safemoon subreddit. It’s … wild how many times you can rip off some people and have them get more militant in their belief they are smart. As a footnote, more and more tech companies explore this to prop up shrinking profit margins. By selling previously valuable trust marks such as the top result on google (there was a time you could trust this) or flat out verification marks that previously were meant to foster Trust and Safety for money, erosion of trust becomes a profitable feature. It’s good for platforms when users cannot tell placed / bought placement and fake news from actual valuable content. It’s just terminal for society - each time someone is scammed, has their trust betrayed, they slide a little bit closer into that state that is so exploitable by populists.
- bannedbybros 3y ago
  [dead]
- buildbuildbuild 3y ago
  You'd be surprised at the typical profile of a crypto scam victim. I trace cryptocurrency professionally and try to help as many victims as possible. Most that I meet are far from the "crypto bro" archetype. Often they are people who trust others easily, are not very tech-savvy, and believe what a website tells them without second guessing.
callalex 3y ago
We’re talking about people who still willingly use Twitter and pay for blue check marks here…
j0hnyl 3y ago
Given Vitalik's following this was a squandered opportunity. Just a little bit more effort could have netted many millions of dollars.

quickthrower2 3y ago

They were probably time limited. No long games. Smash and grab.

frantathefranta 3y ago

Using the account of probably one of the few trustworthy people in crypto probably helps.

baybal2 3y ago
Ironically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login. If you plug SIM card into desktop, you can actually do signing with it, and TLS authentication. I recall, only Nokia S60 series, and A200 had a SIM card API exposed to apps. Ios does not give you access to SIM, Android does only for system apps.
- londons_explore 3y ago
  Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.
  - skdk 3y ago
    The API could return different identifiers per app
    - eli 3y ago
      While it's also signing things for you? That seems rather hard to implement.
      - wiml 3y ago
        It's what FIDO/U2F does, right?
    - slashdev 3y ago
      That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.
      - londons_explore 3y ago
        Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.
        aleph_minus_one 3y ago
        > Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example. I doubt that: simply add two "SIM identities" (which on the mobile phone map to the same SIM card) to the account of the respective service.
  - lawlessone 3y ago
    My redmi has a sim card toolkit app, i've never used it . Reading this i am now more suspicious of it. Before you all warn me i know it is the worst possible brand to own, i am getting spied on by all the regulars that come with Android - Google/ US agencies but i also get the added bonus of China spying on the device. But i was broke.
aleph_minus_one 3y ago
> Using the account of probably one of the few trustworthy people in crypto probably helps. The fact that some person is trustworthy by his personality traits does not imply that he does have the (also technological) skills not to become scammed or impersonated.
itiro 3y ago
[flagged]

smeej 3y ago

Back in 2020, some teenage kid got access to "God mode" on Twitter and burned it on a crypto scam too. Easy money seems to be a pretty common goal. https://fortune.com/2020/07/16/hackers-blew-twitter-god-mode-on-shenanigans/ https://fortune.com/2020/07/16/hackers-blew-twitter-god-mode...

deleted 3y ago
[deleted]

londons_explore 3y ago

I could easily imagine the scam had 30 victims, with 29 of them losing $10 and the remaining one losing $700k.

netsharc 3y ago

$700k? I see that human idiocy is a large untapped source of wealth...

cdchn 3y ago
The crypto "degens" are pretty much the perfect cohort for pulling these kind of scams on. They're driven by fast money, unearned profit, and the premise of investment despite all rational signals pointing to it being a bad idea. Its a Condensation of Rubes.
eli 3y ago
And all those people had crypto wallets ready to go. Go figure.

cdchn 3y ago

If there is a sophisticated attack pivot that is as profitable, quick, proven and safe, I don't think anybody knows what it is.

yyyk 3y ago

$700k in NFTs I recall. Isn't that more like $70?

yyyk 3y ago
Downvote all you like. NFTs have no real liquidity (or usecase), the 'price' is just wash trading.
- msm_ 3y ago
  You may or may not be right (I don't know enough about cryptocurrencies to know), but I think people don't like your snark. Some people lost a lot of money - they are victims of a scam. Now how much the attacker will actually earn from this is another matter, but your original post was not a very welcoming start of a discussion.
- j0hnyl 3y ago
  Big ticket NFTs are worth a lot of money and highly liquid. Also drainers will siphon eth and erc20 tokens as well.

gmerc 3y ago

Crypto bros are self selecting for scams. If your world view has been degraded to see zero trust as a solution rather than a dystopian end state, meaning you’ve lost all trust in society, you’re highly vulnerable to be conned by the authority figures you secretly crave to trust. It’s much of what Elon, Trump and other populists actively foster and exploit in their fan base through relentless conspiracy theories and undermining of trust into anyone who isn’t them. There’s a paradox here - the more people have their trust violated, the more distrustful they get, the easier they get scam as the overhead of approaching every transaction / interact in life with an adversarial mindset exhausts critical capacity and drives people into desperate savior fantasies - technological miracles, charlatans. snakeoil, the twentieths coin or pump and dump. Zero trust (non security version - the inability to extend trust) is a miserable desperate state to be in as a human being and makes people highly vulnerable to getting taken advantage of and crypto signaling on social media either identifies you as a scammer or as a mark. You still believe technology can solve societies trust dilemma, you are asking for it at this point. And the longer the scamming goes on, the stronger the signal of this self identifying audience becomes. It’s like responding to Nigerian prince emails at this point. Go reddit, look at the safemoon subreddit. It’s … wild how many times you can rip off some people and have them get more militant in their belief they are smart. As a footnote, more and more tech companies explore this to prop up shrinking profit margins. By selling previously valuable trust marks such as the top result on google (there was a time you could trust this) or flat out verification marks that previously were meant to foster Trust and Safety for money, erosion of trust becomes a profitable feature. It’s good for platforms when users cannot tell placed / bought placement and fake news from actual valuable content. It’s just terminal for society - each time someone is scammed, has their trust betrayed, they slide a little bit closer into that state that is so exploitable by populists.

bannedbybros 3y ago
[dead]
buildbuildbuild 3y ago
You'd be surprised at the typical profile of a crypto scam victim. I trace cryptocurrency professionally and try to help as many victims as possible. Most that I meet are far from the "crypto bro" archetype. Often they are people who trust others easily, are not very tech-savvy, and believe what a website tells them without second guessing.

callalex 3y ago

We’re talking about people who still willingly use Twitter and pay for blue check marks here…

j0hnyl 3y ago

Given Vitalik's following this was a squandered opportunity. Just a little bit more effort could have netted many millions of dollars.