2 ms·

I'm sure more than 2 people at twitter have production access. And identifying the senior staff isn't probably that hard, they probably have quite visible twit

by 0x0 14y ago

I'm sure more than 2 people at twitter have production access. And identifying the senior staff isn't probably that hard, they probably have quite visible twitter accounts. As someone mentioned in a completely different thread, it'd be enough to have a vulnerable rails running on localhost:3000 on your laptop and "accidentally" being hit with a CSRF, for example. Get a shell on some staffers laptop and stay dormant, I'm sure you'll catch a live ssh session soon enough [with access to that ssh client's process memory] (in fact you'd get quite far just with a copy of the id_rsa + known_hosts files)

mikegioia 14y ago
Yea you really only need the contents of ~/.ssh and you could access every server the laptop could. Even if they didn't have production access, a lot of times servers are configured to easily hop from one to another. They could have connected to a development server and then just hopped to the DB server with the accounts it seems they were looking for.
- knweiss 14y ago
  That's why you should use ssh-agent and protect your private key with a passphrase.
  - 0x0 14y ago
    It's useful, but if an attacker got a shell on the dev laptop, I assume he could just coredump the ssh-agent process and steal the unlocked key from there.