Hacker News Reader

Comment by toyg | Hacker News Reader

> the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7

So much effort for so little gain... With proper preparation (i.e. a simple app ready to download everything from an account), they could have made out with the whole data of 130 accounts, silently, before tweeting the hopeless scam message. Instead, this seems like a mostly-manual effort, done in haste.

Just dumb thieves pulling off the scam of their life, or cover for a targeted attack of one or two of those 7 they actually siphoned properly? I hope US authorities will figure stuff out beyond the usual "it was a Chinese/Russian/Eastern European gang", which is just code for "fuck knows".

View on HN

I wish I knew why security does this character assassination routine with low-skill hacks. They clearly got in, bumbled attempt or not. Is it somehow helping everyone to know they fucked up? Whose expectations are we changing here?

Who is “security” here? In my experience, if you ask most working security professionals, they would agree that social engineering is by far their largest vulnerability. All the cryptography stuff is fun and cool but really the work is all about preventing phishing, so I don’t know any working security engineers who would call this a low-skill hack.

Well, I see 2 reasons here: 1/ when an attack is deemed a low-profile one, it is a way to say that the targeted company might be to blame, at least in part, for not having adequate security protocols; 2/ in this instance, some people might be frustrated that the DM of high profile people won't leak on the internet because of a lack of preparation from the attackers.

Most of the time, the "character assassination routine" is to emphasize the first point.

I imagine that the limited damage the attackers did will help them evade being caught. Ultimately, they just stole some 100k$ in Bitcoin and that's it, so investigations by the FBI et al. will probably not go to great lengths to locate the hackers. On the other hand, attempts to blackmail someone like Tim Cook or Elon Musk would probably be riskier. For the same reason, I suspect the attackers may have intentionally avoided breaching or tweeting from Trump's account, too much risk of attracting serious FBI and Secret Service attention.

As it is, the only people who actually lost something are a bunch of Bitcoin owners that got scammed, and it's just not a big deal.

In the great scheme of things, knowing what Trump (or any other US politician) says to other people is worth relatively little.

Having insider knowledge of what certain billionaires say to whom, though, can be immensely valuable. It might well be that a few of them will lit a fire under FBI and friends. We'll see.

Most of those famous people don't manage their own accounts though. Some do, like Musk. That's why I'd consider stealing his DMs to be more dangerous than running a Bitcoin scam - it could easily upset Musk enough that he bugs the FBI to investigate seriously or, more likely, uses his own considerable resources to run an investigation. See how Bezos hired investigators when his data was leaked, and they did get to the bottom of it.

Trump is a bit of a special case because he's POTUS. I'm pretty sure there are no remotely interesting DMs on his account, but if there's one thing the US doesn't like, it's anyone even perceived of messing with national security. An attacker merely logging into Trump's account could be seen as a national security issue, and attract an entirely different level of law enforcement attention.

Reply on news.ycombinator.com