Hacker News Reader

Comment by slg | Hacker News Reader

This makes things sound even fishier. I think there has to be something else going on we don't yet know about. The amount of money this scam will actually earn the hacker is tiny compared to the potential of this hack and yet they still have enough money left over to bribe a presumably highly paid Twitter employee? Or maybe the Twitter employee is a low paid person which leads back to a question I raised elsewhere in this thread[1], how many people at Twitter have the power to take over these accounts unsupervised? Whatever the number is, this hack is probably an indication that it is too high.

[1] - https://news.ycombinator.com/item?id=23855328

View on HN

Lots of uncertainty, but I could see it being relatively mundane.

It wouldn't surprise me if a lot of Twitter support people had access to these tools and that they often worked with larger (more valuable) accounts.

It also wouldn't surprise me if some employee had a bad 1:1 and then responded to a spear fish just because they were disgruntled. To take payment for it is particularly stupid.

Of course, could also be something more serious - but if it's really just the BTC piece and the people are dumb enough to talk to the press, it may not be a group of criminal masterminds.

I hope for the employee's sake they have communication that can help the feds catch the BTC group. Either way, an incredibly stupid thing to do on their part and I don't see a good ending for them.

If this turns out to be true, they'd be lucky not to go to prison.

I’m not saying there isn’t one, but curious what you think is the imprisonable offense?

I’m not a lawyer, but I’d guess something related to wire fraud: https://www.justice.gov/archives/jm/criminal-resource-manual...

It seems to generally be a crime to access a computer system you aren't supposed to, regardless of how you came by the login info (phishing, guessing passwords, etc).

But the disgruntled employee may have had legitimate access to the system, even if this specific act was illegitimate

I'm no lawyer either, but I imagine that the definition of authorisation is key here.

If you're a sysadmin on a company email system, then you do technically have access to everyone's data on that system.

However, you're generally limited by company policy that you are not permitted to access/modify that data without direct authorisation, say from the employee themselves or from HR.

So, therefore, if you go and read the email of your boss, you're still in breach because you didn't have the authorisation.

But that's gross misconduct or some other fireable offense - a civil matter at best.

The only item I can see here is fraud (impersonating the people whose accounts have been taken over), of which the mole would be complicit.

No, using a computer system in a manner other than explicitly authorized is a federal offence under the CFAA.

That's been exceptionally controversial, as it can turn contract breach into a federal criminal offence in the US.

> That's been exceptionally controversial, as it can turn contract breach into a federal criminal offence in the US.

Doesn't something similar happen with employer-provided accommodation and burglary laws?

Terry Childs...

This is likely a violation of the Computer Fraud and Abuse Act of 1986 (CFAA) which allows for federal prison sentences.

Impersonating a member of the military?

It would surprise me if a lot of Twitter support people had access to tools that allowed them to post tweets as another user. That's not functionality that should be available to a Twitter support person.

No, that's easy.

People's accounts get hacked all the time. To help them recover is often a manual process, because the true owner of the account can become unclear. To be able to do that a support worker must be able to change the email address on an account, undo 2FA settings and make other changes because hackers will typically change the email address and add 2FA of their own phone as the first step in an account takeover.

But why would the support worker need to be able to post a tweet?

If you can change the owner of an account you don't need a special interface to post a tweet.

They way I understand it based on the article is that they were only able to change the email address, then used that to reset the password and log in.

Having worked at large tech companies - it would not surprise me at all if many did. ...at least through unofficial channels or not-entirely-secure processes.

Weird that they didn't require any MFA from a second support // Admin account when dealing with account security settings for prominent accounts. That's not that hard to set up and makes these sort of things harder to pull off. Not to mention severe rate limitation on internal accounts. How many prominent accounts does one support person need to reset password or email per day? Not that many, I'd wager.

Imagine the potential damage if an attacker tweeted something on behalf of the US President (let's say Biden in 2022), that China or Iran or Russia ships could be sunk at any moment if they didn't withdraw (due to some ongoing real incident)... The other side might fire on US ships before the tweet could be corrected.

Twitter is a disaster waiting to happen.

Right, because all these other parties would totally not think Twitter might be hacked? I'm truly baffled by this kind of hysteria.

As you say, it would probably not work on foreign governments, but would be very effective on the general population. They could have used that to cause political turmoil (hopefully not enough to change something like elections results?) or influence stock prices etc. This just looks so uninspired...

> As you say, it would probably not work on foreign governments, but would be very effective on the general population

I can't think of any serious risk posed by 'the general population'. Maybe particular stocks would dip a bit?

> If this turns out to be true, they'd be lucky not to go to prison.

I’m not sure what you’d charge them with?

Fraud, theft, aiding and abetting, surely some digital wiretapping laws

The CFAA makes it a federal crime to access a computer in excess of authorization. The employee was unlikely to be authorized to use Twitter's customers' accounts to collect money from their followers, so it sounds like an open and shut case.

I know HN doesn't believe in laws, but the rest of the world does, and they're the ones with prosecutors.

But surely they didn't access the system and post these messages themselves.

They could argue, with the advent of remote working getting more and more predominant, that they simply left their computer unattended for a second while logged in.

Beyond that, they could argue they simply clicked on a link and something might have happened they aren't aware of. Or that they didn't know what running that one executable would do.

They don’t sound like a criminal mastermind, it’s very likely they left some trace either locally or in Twitter’s system that will contradict that story.

Vaguely plausible excuses will not dissuade prosecutors in possession of contrary evidence.

“I was working remotely at a coffee shop and my computer was swiped while I went to the toilet“ isn’t even plausible given take-out only as well...

I matched with someone on Tinder and she rocked my night... and I woke up to see my laptop was gone!

1st 2 sentences: good comment! +1

Parting shot: unnecessary, obnoxious. -1

Net: 0

CFAA, but if that doesn't work try out conspiracy, wire fraud, possibly money laundering.

The most logical conclusion is that this probably wasn't about money. Plenty of better ways to make money than telling people to give you BTC. I'm expecting a huge data drop on wikileaks/pastebin/wherever of private DMs, images, who knows what else.

Plus there was no way they knew beforehand they'd only make 12BTC. People always overestimate the value of twitter and conversion rates when an actual action is required - even with targeted audiences like cryptocurrency people in this case.

People seem to assume everyone takes tweets at face value and won't do a double take when it doesn't sound like something they would normally say.

Even here there was plenty of people on HN who were claiming outlandish possibilities while it was happening.

I’m surprised they pulled off that much.

I can't help but make the obvious observation here. It's bitcoin... The space has a prior for people who are willing to rush head first into something they don't understand in order to attempt to make a quick buck. I'm surprised it was only 12 BTC.

They used several different BTC addresses and even some Monero and other crypto ones. It's not just 12 BTC.

I hope Twitter's report includes a list of all the attacker's tweets.

But there's also a precedent of scams like this being posted on twitter, esp. from accounts impersonating e.g. Elon Musk. Just because it's tweeted by an official account doesn't suddenly make it less scammy - sure some people clearly fell for it, but I reckon most people using twitter with an interest in cryptocurrency would immediately recognise these tweets as a scam, regardless of the source

I could go for 12 BTC right about now

They may not have: It's normally for various cons to pay themselves to some extent to add legitimacy to their actions and generate more attention.

I'm surprised they didn't get more.

Poorly executed, frankly. The tweet just wreaked of spam.

12 BTC could be retirement level money in some countries.

Not really, when you factor in inflation, unless you're planning on living in abject poverty your whole life or not planning on living very long.

e.g., Vietnam is a livable place and GDP per capita is ~$2600. That'd get you a very modest living. GDP/capita is also up 2x from 10 years ago and 10x from 20 years ago. You could maybe squeak out 20 years with very modest living and few unplanned expenses and assuming the economy and thus cost of living doesn't grow tremendously (like it likely will).

Somalia would give you a little more value for your money. But I think if someone suddenly had that much money in Somalia, they'd probably be getting out of Somalia or hoping nobody found out.

I could easily survive and be happy on 12 BTC for the rest of my life and I live in one of the most expensive countries in the world.

$110k for the rest of your life? $500/month for 18 years? That wouldn’t cover health insurance plus rent (even though I’m sharing rent with a partner) here in Berlin, and Berlin is cheap compared to the UK or the bits of the USA I’ve visited.

Seems more likely that they expected to get more.

Joe Biden was one of the hacked accounts, Trump was not. It's like 2016 all over again.

I’m guessing after the last time Trump was hacked internally, some new control went in place specific for his account.

I am struggling to think of any better system than BTC.

Almost anything else I can think of would require either (a) substansal amount of starting cash (for example trying to crash Tesla's stock price), or (b) be almost impossible to pull off without getting caught (blackmail, or again stock manipulation if you do it in a big enough way to make some decent money).

In terms of risk/reward, assuming someone found some easy trick and wanted to cash out ASAP, this feels like the best option.

I don’t think it would take very much starting cash at all to make money off a Tesla crash. Options can be pretty cheap for moonshots.

Alternatively, is it possible they bought options on twitter itself? It’s down 4% in after-hours (which is less than I expected, but still enough delta to make some cash).

The most reasonable explanation might be that they’re lying to sound cool. Bribery is a thing, but any twitter employee would know that their employment (and future career prospects) would be terminated.

On the other hand, $1M in BTC might do the trick. Interesting thought experiment...

There’s bribery but I think blackmail is even likelier. This is such a huge breach that no one should think they could get away with leaking their credentials or opening a backdoor. Plus Twitter employees are really well paid. Now some life-ruining online behavior material is another type of a motivator.

Are twitter support contractors in third world countries really well paid?

I doubt they would have global production access like this

Unless the employee helped in a way that they didn't realize could be used for such a hack.

And/or they just thought it couldn't be traced back to them.

You're thinking of an engineer, not a low paid worker in the tech company equivalent of a call center working on repetitive tasks for low pay in India or some other country where labor is cheap.

And you're also making the assumption that the accomplice thought about it rationally. All the attacker has to do is find someone who doesn't realize that they will get caught.

If they wanted to get as much money as possible without being caught what else could they have done?

If that was the case they could only deal with bitcoin. Blackmailing with bitcoin may be smarter but maybe they figured that would be investigated more or treated more harshly? They could have released fake financial tweets and shorted the market - but that still would be investigated much faster.

I'm sure the 100k or whatever they got isn't as much as it could be - but for a random dude who paid 10k to a disgruntled employee it is pretty good.

Buy shares in a small publicly traded company. Pump/dump shares. One tweet from musk stating he was adding such and such to all Teslas would send the target company through the roof.

The post you're replying to is suggesting that manipulating the market like that draws the attention of some very powerful organizations. It'll likely be investigated swiftly and they'll come down on you harshly when compared to the consequences of some Bitcoin scamming.

US federal agencies actually investigate market activity around big events like 9/11. Very likely to be caught doing that unless you have some way of shuffling money in and out of the market anonymously.

Though I was the one who suggested this would be easily catchable - Tesla is probably the one company where you could get away with this. There is no shortage of random Robin Hood users making pretty big plays on it constantly.

The same guy used to use his connection/social engineering to overtake "nice" twitter handles and resell them for money. He just got too greedy.

I don't think there is something super nefarious involved. Probably some unpaid intern in a third world country where Twitter outsources tech support.

I think it's unlikely someone working on "mass" tasks like account recovery is highly paid.

> The amount of money this scam will actually earn the hacker is tiny compared to the potential of this hack

If the attackers had a big short position in TWTR, they may have made a lot more money than they received from BTC.

Shorts get caught. Easier to have Elon Musk tweet "I'll buy Hertz at $69 a share to make all their cars autonomous".

Shorts don't get caught, they'd blend right into the WSB crowd.

Also, if you had Elon tweet that, I am not sure if the price will go up or down like you expect. :)

Is this really true though? If you ramp up multiple short positions under a few weeks from a lot of different accounts, how would you tell? I'm assuming TWTR is a pretty busy stock.

To be honest, there's a study out there that says the average employee will their out their employer for $500... I wonder what the skew would be on tech companies.... 10k? 30k?

Reply on news.ycombinator.com