Report on Investigation of Twitter’s July 15, 2020 Cybersecurity Incident
dfs.ny.gov
dfs.ny.gov
Imagine if instead they tweeted from Musk saying something along the lines of Tesla batteries being faulty and they all need to be recalled. Buy some Tesla puts beforehand and that right there is instant millions.
Heck, even selling the rights to this hack would have gotten them millions.
If you were smart enough to think hey, wait instead of stealing bitcoin I could just use this to cause some stocks to have problems then I can short them.
At the point you are smart enough to switch from the dominant way of making money in your enterprise you can probably think up multiple ways to make money that would be even sneakier, and think of ways to hide it, keep the money even if you get caught.
> Armed with these personal details, the Hackers successfully convinced several Twitter employees that they were from Twitter’s IT department and stole their credentials.
It could become a feature in a post apocalyptic world where the society doesn’t function. Until that day, a system based on social contract will prevail due to massively better user experience.
Imagine a climate change apocalypse rather than the nuclear wasteland of Fallout or Mad Max.
Let the sea levels rise enough to displace everyone who is within 30 feet of sea level, add in some famines (also brought on by climate change) and since it's the theme this year, a plague or two exacerbated by a billion climate refugees in camps and slums being ignored by anyone still prosperous.
You could end up in a situation fairly apocalyptic, but still have the scavenged resources to assemble an internet, assuming there wasn't some sort of anti-tech uprising among the survivors, angry at technology for causing the disaster and determined to smash any surviving technology (and technologists) to prevent it from happening again.
So the thing about PoW is that it doesn't matter how much is actually spent on the "work" part as long as you can't feasibly do more.
So let's add onto our climate change apocalypse some light nuclear war -- not enough that it dominates the end of the world as we know it, but enough that it destroys the infrastructure needed to produce the most specialized mining hardware, and maybe some of the larger datacenters.
Now you have plenty of scavenged ordinary hardware to keep the internet running, plentiful power (since in this hypothetical the population has shrunk dramatically without much infrastructure loss) and a finite supply of mining hardware.
This last would prevent the runaway problem of PoW -- you could string thousands of regular PCs together to compete with the good hardware, but the return would be low enough that it wouldn't be worth while to try to expand the mining pool until the old hardware started to fail completely or the new infrastructure was built to fab new hardware -- you might have a few decades before the old incentives to grow the pool kicked back in.
Granted, this is all pretty far-fetched, not the least the social component of people wanting to use cryptocurrency as a widespread unit of exchange, but hey, I'm work-shopping a story set in a dystopian future here, not trying to sell Bitcoin.
The best I can come up with is "well, if some critical mass of people adopt it early for quirky reasons it could take off", but that doesn't distinguish it from bottle caps.
Don't trust, verify. Not your keys, not your crypto.
The “whole point of crypto” was that you didn’t have to use a service like Coinbase if you didn’t want to. And you don’t.
IIUC, the crackers did sell access to the hacked accounts[0]:
"Sheppard’s alleged alias Chaewon was mentioned twice in stories here since the July 15 incident. On July 16, KrebsOnSecurity wrote that just before the Twitter hack took place, a member of the social media account hacking forum OGUsers named Chaewon advertised they could change email address tied to any Twitter account for $250, and provide direct access to accounts for between $2,000 and $3,000 apiece."
But that didn't net anyone millions, but apparently that wasn't the point of the hack[1]:
"People within the SIM swapping community are obsessed with hijacking so-called “OG” social media accounts. Short for “original gangster,” OG accounts typically are those with short profile names (such as @B or @joe). Possession of these OG accounts confers a measure of status and perceived influence and wealth in SIM swapping circles, as such accounts can often fetch thousands of dollars when resold in the underground."
[0] https://krebsonsecurity.com/2020/07/three-charged-in-july-15...
[1] https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e...
The fact a government agency has said this in an official report is saddening.
It's just a strange pairing, and to me a bit sad that Twitter of all things has become America's backbone of formal communication.
It feels like it could be in Idiocracy. That's all.
For shame, we need to be teaching our youth better dystopian hacker ethics.
https://www.theguardian.com/us-news/2018/sep/10/trump-almost...
If Trump tweeted just that or something similar, it would have been removed instantly. But this one and others from the supreme leader of Iran are still publicly available for all to see.
But nothing violent here or anything to worry about I guess?
[0] https://twitter.com/khamenei_ir/status/1263749566744100864
that tweet threat isn't even an immediate threat.
https://mobile.twitter.com/realdonaldtrump/status/1213593975...
But it seems the 'rules' are enforced more on one person over another. You probably can guess why that is.
Downvoters: So these tweets are not signs of threatening behaviour and shouldn't be flagged or don't violate Twitter's ToS? Explain your case.
[0] https://help.twitter.com/en/rules-and-policies/violent-threa...
north korea would absolutely never initiate a war over a tweet, they're fully rational.
also nice link to an article about a tweet that the president actually wanted to send, as opposed to a hacker tweeting, which would be denied by the white house within 15 minutes.
Stuxnet can/should start wars, your social media app is just that, a social media app, let's not blow too hard.
Step 2: With that password, log in to the internal website Twitter employees use to moderate accounts, change jack's account password to "password", log in to twitter.com with username "jack" and password "password" (and repeat for every user you want to login as)
Step 3: Make a tweet saying "send Bitcoin to [address] and I'll send double back"
Did they, really? I mean anyone stupid enough to fall for that ploy was going to lose it some other way shortly anyway.