Hacker News Reader

Comment by TechBro8615 | Hacker News Reader

This is the most important point:

> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers.

My understanding is the hackers used the admin panel to change the email addresses of the accounts, which means they could reset passwords and perform full account takeover [what about 2fa?]. That means they could login as the user, and so it means they could read the user's direct messages. (Ironically, Twitter's solution of disabling posts from blue checkmarks would not have stopped exfiltration of direct messages while an account was compromised.)

View on HN

>> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers.

It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consuming and opens the risk of being caught especially if it a high profile target, with no guarantee of being paid. Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating? Paying off a blackmailer is an admission of guilt and does no good if the info is released anyway.

It also depends on how sophisticated the thief was. Did he have everything automated to dump anything everything from the inboxes while automating the posting of the spam tweets, or was he frantically doing all his postings by hand before twitter could shut it down. If the thief is not sophisticated his main priority would probably be making as much money as possible with the posts and ignore the private messages

> Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating?

Maybe? I mean I certainly don't dismiss the idea out of hand. The one strong counter-argument I can think of is that very few things would actually embarrass Musk at this point.

Yeah, Musk specifically doesn't feel likely to care, perhaps if we assume someone else, who is less, shall we say, favorable to controversy?

Dude seems to devoted to his workaholic persona to leave much time for dick pics.

My guess was frantic copy pasta. Since the reset password emails went to both him and the OG twitter user. Plus wouldn’t you need an API key per user and set that all up? I think that takes more time than spamming a tweet.

You don't need API's if you just use the web interface. Headless chrome would be a seriously easy way to automate this without having to mess with API keys.

> Do you really think someone like elon musk will pay a bitcoin ransom

A somewhat odd blog post by Jeff Bezos about blackmail from last year is quite interesting in this context. [1]

[1] https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146...

They grossly overestimated their leverage in that story though.

Anything illegal might've been actually good for black mail purposes, but dick pics? As if someone would actually look for that or even take a business decision based on that.

Dick pics are what lead a candidate for Paris Mayor election to resign this year. It is a powerful item against some people.

Indeed, it's a powerful weapon against anyone who depends on general public popularity for their power (for example many/most elected officials). This is in fact one of the things that is highly investigated for getting TS/SCI US government clearance. They don't want to employ anyone who possibly has dirt against them in the open.

For a public official I can see why it would give them some leverage, but Jeff Bezos/Elon Musk/any rich dude doesn't really have to care. Did the "fappening" damage anyone's career?

True. Considering the level of access the hackers have gained, a case can be made that the attackers themselves fabricated the content in these user accounts.

The thief did not appear to be too sophisticated. Obviously sophisticated enough to pull off the twitter hack, but we don't really know how much sophistication that required just yet (the exploit may have been trivial). But, they didn't disseminate this message anywhere other than twitter? That seems very shortsighted.

They used different approaches on different twitter accounts, some suggested a coin return, others suggested a charitable donation match, etc. But, they all used the same bitcoin address. If they were sophisticated, they would have used a different bitcoin address for each to evaluate the more profitable messages for a future scam.

If you're already logged in to a Twitter account you can deactivate 2FA by disabling the account (aka deleting with a 30 day window) and then re-enabling the account.

You don't need 2FA to deactivate 2FA? That seems like a big flaw.

twitter says hello

Yup. The interesting thing is that this 2FA exploit was posted to hacker news two days before the twitter hack. It's possible someone seized the opportunity before it was fixed.

Do you have a link to that? Didn't see it here on HN.

My apologies, perhaps my memory was failing me. I can't find what I was thinking of and may have been incorrectly remembering this as twitter instead of google: https://news.ycombinator.com/item?id=23792767

> Ironically, Twitter's solution of disabling posts from blue checkmarks would not have stopped exfiltration of direct messages while an account was compromised.

Sure helps keep down on the public effect though... feels mostly like a PR move.

Not 100% positive on this, but I believe the admin panel allowed to remove 2FA as well.

Yep or else none of this could happen. I work at a company that we need at least two methods to authenticate you to remove MFA through the admin console so this wouldn’t have happened.

Is this a part of your company’s product or internal tooling, or is this 2FA part of a software you use? If it’s the latter, please give a recommendation if it’s good!

It’s internal tooling sadly!

I'm curious about this, too. I have to believe, though, that if some bumbling sim swappers were able to get in, then it doesn't require a leap to assume sophisticated state-level actors have similar access. Granted this attack leaves a swath of evidence, but with access to internal tooling, it really is just a factor of how much information is accessible via those tools (and others like them).

We know a Twitter employee worked with Saudi Arabia to target dissents.

The wonder what they saw on the dms

Reply on news.ycombinator.com