4 ms·
My Twitter account was hacked recently as well. A seemingly impossible hack: randomly generated password stored in a self hosted password manager accessible onl
by _lvbh 1y ago
My Twitter account was hacked recently as well. A seemingly impossible hack: randomly generated password stored in a self hosted password manager accessible only from my wireguard network. I log everything and no signs of access from an IP outside my normal range. The email is also self hosted with a randomly generated password stored on an external device (not password manager since email is more important).
I suspect a third party app has been compromised. https://help.x.com/en/managing-your-account/connect-or-revoke-access-to-third-party-apps https://help.x.com/en/managing-your-account/connect-or-revok...
Specifically, the only app authorized on my account was Twitcasting (https://en.m.wikipedia.org/wiki/TwitCasting https://en.m.wikipedia.org/wiki/TwitCasting).
The attacker seemed to have used it to add additional apps onto my account and control it without having my password.
- scottydelta 1y agoHey I have a pretty similar setup. Bitwarden/vaultwarden hosted behind wireguard and openvpn, 2 vpns to provide redendency. It works very nicely for me. Although not having split tunnel was an issue for me on the wireguard Mac OS client but I hacked that by writing a custom client with a mix of bash script and xbar mac app.
- KomoD 1y agoAuthorizing an app won't let that app add more apps, at least as far as I know.
- _lvbh 1y agoI'd think so too but removing all the apps stopped my problems. Maybe a vuln with Twitter at some point. I can't think of any other way to hack an account I don't even use