3 ms·

Monday Morning Madness

15 points by bootload 18y ago

seldo 18y ago
I'm really glad they point out that implementing OAuth would have done nothing to prevent either the phishing attack earlier or this breach. People keep waving OAuth around like it's some kind of panacea for security.
bootload 18y ago
"... @coda I don't sympathise with @al3x. Twitter is basically walking around bent over with no clothes on right now. They can fix that. ..." ~ http://twitter.com/blaine/status/1096877937 http://twitter.com/blaine/status/1096877937 Knocked off for the night reading this message timely message by Blaine Cook . Woke up reading the headline above by Biz Stone.
axod 18y ago
"We'll put them back only when they're safe and secure." I know it's easy to say it, but wouldn't it have been worth making sure those admin tools were 100% secure to start with? Do they even need to be accessible to anyone outside the company lan?
- tptacek 18y ago
  How do you know if something is "100% secure"? It looks like they did exactly the right thing, which was to make the support tools out-of-band until they can resolve how to secure them long term.
  - axod 18y ago
    If the admin tools are behind a firewall, then I'd say they are 100% secure, apart from obviously someone breaking in and using a machine in the company, and assuming no other machine has been compromised. If external access is required, then of course some sort of secure vpn, locked down to certain IPs etc etc. Of course we don't know the full facts of how they were able to access the admin system, so it's all pure speculation. It just struck me as a funny statement.
- rcoder 18y ago
  Actually, there's an even easier fix: don't put those tools outside the firewall. Use VPN, or even just a tunneling proxy or SSH to protect your admin console. This is a classic security failure, and their response was both typical and appropriate: take the tools offline, restore the affected accounts, and admit your mistake (in that order).
omarchowdhury 18y ago
The hacking seems like it was motivated by profit. See: http://d.ioj.com/209937/pxkr3qeg24ds.jpg http://d.ioj.com/209937/pxkr3qeg24ds.jpg The perpetrator posted a link to a website where users fill out a simple survey and enter their email address to get a prize. The perpetrator would get $1.50 for each person that completes the survey. Seeing as how this was done from Obama's legitimate Twitter account, it would be very easy for people to believe it. However, the advertising company that runs the survey has banned the hacker. It really was a dumb thing to do: the URL itself contains his affiliate ID on that advertising network - enough to get his name, full address, social security number with simple cooperation from the advertising company (Copeac).
NabweeklyCanada 18y ago
Nabweekly.ca wrote a warning about a University in Alberta Canada who teaches their students to hack computers, this an actual course. I feel this course is teaching their students to not follow privacy rules and that hacking is a criminal offense. Read more on Nabweekly.ca http://nabweekly.ca/?p=2635 http://nabweekly.ca/?p=2635
tptacek 18y ago
You think someone might want to rename this story "Twitter's official response to security breach"?
- omarchowdhury 18y ago
  +1 for alliteration though.

15 points by bootload 18y ago

seldo 18y ago

I'm really glad they point out that implementing OAuth would have done nothing to prevent either the phishing attack earlier or this breach. People keep waving OAuth around like it's some kind of panacea for security.

bootload 18y ago

"... @coda I don't sympathise with @al3x. Twitter is basically walking around bent over with no clothes on right now. They can fix that. ..." ~ http://twitter.com/blaine/status/1096877937 http://twitter.com/blaine/status/1096877937 Knocked off for the night reading this message timely message by Blaine Cook . Woke up reading the headline above by Biz Stone.

axod 18y ago

"We'll put them back only when they're safe and secure." I know it's easy to say it, but wouldn't it have been worth making sure those admin tools were 100% secure to start with? Do they even need to be accessible to anyone outside the company lan?

tptacek 18y ago
How do you know if something is "100% secure"? It looks like they did exactly the right thing, which was to make the support tools out-of-band until they can resolve how to secure them long term.
- axod 18y ago
  If the admin tools are behind a firewall, then I'd say they are 100% secure, apart from obviously someone breaking in and using a machine in the company, and assuming no other machine has been compromised. If external access is required, then of course some sort of secure vpn, locked down to certain IPs etc etc. Of course we don't know the full facts of how they were able to access the admin system, so it's all pure speculation. It just struck me as a funny statement.
rcoder 18y ago
Actually, there's an even easier fix: don't put those tools outside the firewall. Use VPN, or even just a tunneling proxy or SSH to protect your admin console. This is a classic security failure, and their response was both typical and appropriate: take the tools offline, restore the affected accounts, and admit your mistake (in that order).

omarchowdhury 18y ago

The hacking seems like it was motivated by profit. See: http://d.ioj.com/209937/pxkr3qeg24ds.jpg http://d.ioj.com/209937/pxkr3qeg24ds.jpg The perpetrator posted a link to a website where users fill out a simple survey and enter their email address to get a prize. The perpetrator would get $1.50 for each person that completes the survey. Seeing as how this was done from Obama's legitimate Twitter account, it would be very easy for people to believe it. However, the advertising company that runs the survey has banned the hacker. It really was a dumb thing to do: the URL itself contains his affiliate ID on that advertising network - enough to get his name, full address, social security number with simple cooperation from the advertising company (Copeac).

NabweeklyCanada 18y ago

Nabweekly.ca wrote a warning about a University in Alberta Canada who teaches their students to hack computers, this an actual course. I feel this course is teaching their students to not follow privacy rules and that hacking is a criminal offense. Read more on Nabweekly.ca http://nabweekly.ca/?p=2635 http://nabweekly.ca/?p=2635

tptacek 18y ago

You think someone might want to rename this story "Twitter's official response to security breach"?

omarchowdhury 18y ago
+1 for alliteration though.