Hacker News Reader

Comment by gonehome | Hacker News Reader

Lots of uncertainty, but I could see it being relatively mundane.

It wouldn't surprise me if a lot of Twitter support people had access to these tools and that they often worked with larger (more valuable) accounts.

It also wouldn't surprise me if some employee had a bad 1:1 and then responded to a spear fish just because they were disgruntled. To take payment for it is particularly stupid.

Of course, could also be something more serious - but if it's really just the BTC piece and the people are dumb enough to talk to the press, it may not be a group of criminal masterminds.

I hope for the employee's sake they have communication that can help the feds catch the BTC group. Either way, an incredibly stupid thing to do on their part and I don't see a good ending for them.

If this turns out to be true, they'd be lucky not to go to prison.

View on HN

Weird that they didn't require any MFA from a second support // Admin account when dealing with account security settings for prominent accounts. That's not that hard to set up and makes these sort of things harder to pull off. Not to mention severe rate limitation on internal accounts. How many prominent accounts does one support person need to reset password or email per day? Not that many, I'd wager.

Imagine the potential damage if an attacker tweeted something on behalf of the US President (let's say Biden in 2022), that China or Iran or Russia ships could be sunk at any moment if they didn't withdraw (due to some ongoing real incident)... The other side might fire on US ships before the tweet could be corrected.

Twitter is a disaster waiting to happen.

Right, because all these other parties would totally not think Twitter might be hacked? I'm truly baffled by this kind of hysteria.

As you say, it would probably not work on foreign governments, but would be very effective on the general population. They could have used that to cause political turmoil (hopefully not enough to change something like elections results?) or influence stock prices etc. This just looks so uninspired...

> As you say, it would probably not work on foreign governments, but would be very effective on the general population

I can't think of any serious risk posed by 'the general population'. Maybe particular stocks would dip a bit?

It would surprise me if a lot of Twitter support people had access to tools that allowed them to post tweets as another user. That's not functionality that should be available to a Twitter support person.

No, that's easy.

People's accounts get hacked all the time. To help them recover is often a manual process, because the true owner of the account can become unclear. To be able to do that a support worker must be able to change the email address on an account, undo 2FA settings and make other changes because hackers will typically change the email address and add 2FA of their own phone as the first step in an account takeover.

But why would the support worker need to be able to post a tweet?

If you can change the owner of an account you don't need a special interface to post a tweet.

They way I understand it based on the article is that they were only able to change the email address, then used that to reset the password and log in.

Having worked at large tech companies - it would not surprise me at all if many did. ...at least through unofficial channels or not-entirely-secure processes.

I’m not saying there isn’t one, but curious what you think is the imprisonable offense?

I’m not a lawyer, but I’d guess something related to wire fraud: https://www.justice.gov/archives/jm/criminal-resource-manual...

It seems to generally be a crime to access a computer system you aren't supposed to, regardless of how you came by the login info (phishing, guessing passwords, etc).

But the disgruntled employee may have had legitimate access to the system, even if this specific act was illegitimate

I'm no lawyer either, but I imagine that the definition of authorisation is key here.

If you're a sysadmin on a company email system, then you do technically have access to everyone's data on that system.

However, you're generally limited by company policy that you are not permitted to access/modify that data without direct authorisation, say from the employee themselves or from HR.

So, therefore, if you go and read the email of your boss, you're still in breach because you didn't have the authorisation.

But that's gross misconduct or some other fireable offense - a civil matter at best.

The only item I can see here is fraud (impersonating the people whose accounts have been taken over), of which the mole would be complicit.

No, using a computer system in a manner other than explicitly authorized is a federal offence under the CFAA.

That's been exceptionally controversial, as it can turn contract breach into a federal criminal offence in the US.

> That's been exceptionally controversial, as it can turn contract breach into a federal criminal offence in the US.

Doesn't something similar happen with employer-provided accommodation and burglary laws?

Terry Childs...

This is likely a violation of the Computer Fraud and Abuse Act of 1986 (CFAA) which allows for federal prison sentences.

Impersonating a member of the military?

> If this turns out to be true, they'd be lucky not to go to prison.

I’m not sure what you’d charge them with?

Fraud, theft, aiding and abetting, surely some digital wiretapping laws

The CFAA makes it a federal crime to access a computer in excess of authorization. The employee was unlikely to be authorized to use Twitter's customers' accounts to collect money from their followers, so it sounds like an open and shut case.

I know HN doesn't believe in laws, but the rest of the world does, and they're the ones with prosecutors.

But surely they didn't access the system and post these messages themselves.

They could argue, with the advent of remote working getting more and more predominant, that they simply left their computer unattended for a second while logged in.

Beyond that, they could argue they simply clicked on a link and something might have happened they aren't aware of. Or that they didn't know what running that one executable would do.

They don’t sound like a criminal mastermind, it’s very likely they left some trace either locally or in Twitter’s system that will contradict that story.

Vaguely plausible excuses will not dissuade prosecutors in possession of contrary evidence.

“I was working remotely at a coffee shop and my computer was swiped while I went to the toilet“ isn’t even plausible given take-out only as well...

I matched with someone on Tinder and she rocked my night... and I woke up to see my laptop was gone!

1st 2 sentences: good comment! +1

Parting shot: unnecessary, obnoxious. -1

Net: 0

CFAA, but if that doesn't work try out conspiracy, wire fraud, possibly money laundering.

Reply on news.ycombinator.com