Dutch Ethical Hacker Logs into Trump’s Twitter Account | Hacker News Reader

Dutch Ethical Hacker Logs into Trump’s Twitter Account

volkskrant.nl

96 pointshuijzer73 comments

> Twitter, however, denied the report. “We’ve seen no evidence to corroborate this claim, including from the article published in the Netherlands today. We proactively implemented account security measures for a designated group of high-profile, election-related Twitter accounts in the United States, including federal branches of government,” a Twitter spokesperson said in a statement. [0]

[0] https://www.theguardian.com/us-news/2020/oct/22/trump-twitte...

Yes, there are some conflicting statements in the media. The Dutch reporters claim to have seen proof. Of course Twitter has nothing to lose from admitting that it did happen. Also, this guy has a reasonably good reputation here, and would stand to lose his career from making a claim that was found out to be false.

I wouldn't dismiss it out of hand just yet.

>Twitter has nothing to lose from admitting that it did happen

Um, what? That would be exceptionally bad press for Twitter.

Sorry, missing /s

They could phrase it like please use complex passwords + 2fa, though. It's not their fault if people are stupid.

> On Friday morning, almost absentmindedly, Gevers tries a number of passwords and their variations. On the fifth attempt: bingo! He tries ‘maga2020!’ (short for make America great again) and suddenly finds himself in the Twitter account of the American President. He is flabbergasted. Gevers: ‘I expected to be blocked after four failed attempts. Or at least would be asked to provide additional information.’ None of that.

Are you seriously saying the President of the United States' Twitter a/c hasn't been secured by a strong password, or better yet, managed for him by his PA??

This is frankly not believable. Doesn't the Secret Service have a digital wing to secure such things?

Well @realDonaldTrump isn't @POTUS, it's his personal account as far as I know. So that could be why, maybe.

I recall there being a story about Obama either not being able to use his first choice of phone or else there having had to have been made some sort of accommodation to allow him to at the beginning of his first term.

(I think it was an iPhone vs Blackberry thing)

I haven’t looked into this story too deeply but I find it incredible on its face. If it is true then it’s an absolute shock and a wonder of wonders why it wasn’t compromised sooner.

“Too inconvenient”

https://www.theguardian.com/technology/2018/may/22/donald-tr...

IIUC at the beginning of Trump's term he refused to agree to the arrangements that the Secret Service made for Obama and insisted on continuing to use his regular phone instead. And there wasn't a whole lot they could do about it. After all, he's the boss.

I'm not sure why you are getting down voted. That is 100% a true story unfortunately.

Here's a story supporting your statement.

> But Trump wanted to be able to tweet and call people at will—neither of which is a feature of either DMCC-S device. So initially, he stuck to using his personal phone. … But he continued to resist using a secure phone for calls, because that would have meant routing those calls through the WHCA switchboard, and reportedly continued to place calls from his own Android phone from the White House residence after hours.

But, he's currently using a dedicated iPhone for twitter.

https://arstechnica.com/information-technology/2018/05/trump...

When the twitter bitcoin attack happened; the attackers deliberately avoided going after the president.

Most people know better than to try and kick that beehive.

After the last four years and everything you learned about Trump, is it really THAT hard to believe? How many 74 year olds do you know who are tech savvy enough to enable 2FA or use a random password?

He is a stable genius!

But when trump says "no", what can they do?

Donald actively fights measures of reason and anyone who opposes him doesn't stay in their position for long.

This is such an obvious password that that you'd think there are hundreds of attempts a day using it!

Are they seriously suggesting Twitter didn’t require 2FA for the president?

Twitter doesn’t exactly require 2FA for us serfs, but still in a lot of cases requires SMS confirmation.

(To answer the question, if we take as a basis that people excuse Hillary for not knowing an SMTP server under her desk wasn’t secure enough for email exchange with diplomats, we need to exclude the user in any case and make technology auto-secure by default).

Also, I’d claim any attempt to log on the Twitter account of the president should have been investigated like any guy who walks up to The White House and tries their home key on it. Although I don’t agree with USA’s extreme approach to security, I’m surprised the police was so lax on attempts at cracking the president’s passwords.

How would his PA log him into twitter when he's sitting on the toilet @ 2am sharing his deep wisdom? Can you imagine the hissy-fit he would throw if required to use a strong password, or getting a guy who has his email printed and dictated to use a pw manager?

...Or did you think his social media team sent all those tweets? There's a few obvious ones but I believe the vast majority are straight from the orange mind itself!

Are you seriously saying the President of the US didn’t wear a mask and had close personal contact with a lot of people during a pandemic, landing himself in hospital on experimental drugs?

I mean, he’s not one to either be careful or listen to expert advice, so it doesn’t really sound that out there.

Normal blue ticks have 2FA, _but they can turn it off if they want to_.

He also stared directly into a solar eclipse after being warned not to.

He's the sort of guy who, if you warned him not to touch a hot stove, would immediately slam both hands down on it because he thought you were insulting his manhood.

Is there any verification of this claim?

It is hard to imagine someone wouldn't have guessed that password before.

I would love to see verification of this claim or video evidence too. Even a letter from the White House to confirm saying 'Thanks' for your work.

Unfortunately that screenshot alone can be edited to be faked and it is the only screenshot used as 'proof' that he was 'hacked'.

It that's the case then this can be easily dismissed as fake news. Such a shame it was spread from 'news sites' like the Guardian. Who checks the Factcheckers eh?

I don't know the order of their stories was or what was said when but the guardian at least did get a 'um nope' style quote up from Twitter.

Are there any other sources that back this up? It wouldn't surprise me if this was true, but given just how insane this is I'd like some confirmation before I start spreading it as truth to anyone.

The original story is by the Dutch magazine 'Vrij Nederland': https://www.vn.nl/trump-twitter-hacked-again/ . Most Dutch news media run the story currently, including broadcasters NOS and RTL, news sites nu.nl and Tweakers, and (the websites of) newspapers Volkskrant, Parool, Telegraaf.

As andlarry writes in another comment, The Guardian seems to have a quote from Twitter denying the story, though: https://www.theguardian.com/us-news/2020/oct/22/trump-twitte...

I wonder when he changed it from 'maga2016!'?

In 2016, it was actually "yourefired". I believe that one was discovered because of a hashlist leaked in 2012.

nah, i was `yourefired`

Link is unreadable. Archive mirror: https://archive.ph/Kkb58

Also, this story is unbelievable. As in I literally do not believe it.

>"He tries ‘maga2020!’ (short for make America great again) and suddenly finds himself in the Twitter account of the American President."

And then everyone clapped!

This seems odd to me. I would assume that people would try to break into Trump's account hundreds or thousands of times a day - it's a high-profile (maybe the highest profile) account that billions of people are aware of and have the capability to attack.

If his password was that obvious, one would assume it would be guessed almost instantaneously. Maybe it had just been changed from something un-guessable minutes before, or some glitch disabled 2FA?

I would love for this to be true, but I agree, it does seem way too unlikely that no one else would have tried that password....

The guy showed tremendous restraint. Most of us would've posted something that wouldn't have been flattering.

This is mind-boggling, but it also makes you think why no one has tried it before.

To the point that I'm pretty skeptical.

Or they did and told nobody.

It seems like Twitter should require 2fa for certain accounts, if not for the damage it could do to the US if Trump's account were compromised (personal endorsements, inventing crises like the fake Hawaiian missile crisis, scam links to solicit money, etc.), then for Twitter's reputation as a platform people can trust. If they didn't want to inconsistently enforce the rules for individuals, they could have a policy like any account with at least xx million followers must implement 2fa.

What incentive do they have to not do something like this? Surely anyone with millions of followers isn't going to leave Twitter because of this requirement (new users might, hence only requiring it for accounts of a certain size)

There's nothing that account could say now that would damage the US more than it already has.

Trump will gladly accept that challenge and prove you wrong as he has so many times before. There is always a new low to be achieved.

I always had a joke theory that it was hacked long ago and keeps posting outrageous things. Rather than admit he was hacked Trump has to actually do those outrageous things.

This is a great premise to a short story

This is almost assuredly fake news, folks. (Of course this is being downvoted, because why would anyone let the truth get in the way of a good story.)

https://techcrunch.com/2020/10/22/dutch-hacker-trump-twitter...

> In a statement, Twitter spokesperson Ian Plunkett said: “We’ve seen no evidence to corroborate this claim, including from the article published in the Netherlands today. We proactively implemented account security measures for a designated group of high-profile, election-related Twitter accounts in the United States, including federal branches of government.”

> Trump’s account is said to be locked down with extra protections after he became president, though Twitter has not said publicly what those protections entail. His account was untouched by hackers who broke into Twitter’s network in July in order to abuse an “admin tool” to hijack high-profile accounts and spread a cryptocurrency scam.

> A spokesperson for the White House and the Trump campaign did not immediately comment, but White House deputy press secretary Judd Deere reportedly said the story is “absolutely not true,” but declined to comment on the president’s social media security. A spokesperson for CISA did not immediately confirm the report.

I just posted the guardian version because I didn’t see yours.

“maga2020!” and no proof, ridiculous. Easy to believe something crazy if you want to believe it, I guess.

Well they (The Guardian) did the same baseless reporting on the 'death of Kim Jong Un' and nearly all of them and Twitter falsly reported it and some users believed it (with little to no evidence.) Now, this time it's a single screenshot used as substantial 'proof' to support this Twitter hack. However, it is not good enough to suggest that it is genuine as it can be easily faked.

So it seems some choose to believe claims without the actual facts and evidence unfolding over time but what's clear on Twitter and in this comments section is the number of users having symptoms of TDS. At least wait a bit until this fully develops rather than believing unverified reports or claims. We're much better than this.

> Hunter Biden used an easy to guess password (Hunter02)

Truth* is stranger than fiction. Or at least funnier.

http://bash.org/?244321

* Apparently not truth, see below. Interesting to some degree nonetheless.

The full context:

> A hard disk owned by presidential candidate Joe Biden’s son was supposedly stolen or hacked – also because Hunter Biden used an easy to guess password (Hunter02). Gevers is familiar with leaked databases of old passwords and searched these for Hunter Biden’s data. After analysing these old databases, he felt that the information was incorrect. Hunter Biden used other passwords. Gevers: ‘I could tell that it wasn’t his password.’

So this is not truth. But what I don’t know is if Gevers just read that online from a jokester, or if Trump’s people are actually claiming this.

"oh, ok"

the internet was such a better place in the 90s. now if someone gets your password in 2020 they can basically destroy your credit and social reputation

I think the story is implying that it wasn't his actual password:

>Gevers is familiar with leaked databases of old passwords and searched these for Hunter Biden’s data. After analysing these old databases, he felt that the information was incorrect. Hunter Biden used other passwords. Gevers: ‘I could tell that it wasn’t his password.’

It's much more insane to me that the President of the United States has a twitter account with no 2FA and the password 'maga2020'.

Lots of strangeness happening in these comments.

Presumably someone found it extremely low-substance and off-topic, enough to go farther than downvoting. You could reasonably argue it's flamebait.

Trump had a hilariously bad password.

But it appears that twitter has even worse password protection policies.

The account was “hacked” by manually entering several different password ideas into Twitter’s login. The guy got it on the fifth try. Why not lock it down sooner?

Before 5 attempts? That's well within the range of a few careless typos. If he'd tried thousands of attempts then sure, but 5 seems completely reasonable.

He had a password you could guess in 5 tries and didnt have 2FA and your blaming Twitter?

I find the hacker mischievously hilarious : "The question remains why Trump was using such a weak and simple password. Gevers has a possible explanation: ‘Trump is over 70 – elderly people often switch off two-step verification because they find it too complicated."

Yes. Twitter shouldn't treat a random person's account the same way they treat someone who wields a ridiculous amount of power and influence.

Typical person: 5 tries and no 2FA, that's ok (I Guess)

President: 5 tries and no 2FA? Twitter shouldn't have applied same ol' same ol' policies.

Sometimes you need to provide differential security. After all, the president doesn't ride around in an unprotected car even though pretty much everyone else does.

If you ever had to manage a site that had user accounts, you'd have realized that locking down access before the 5th attempt is a recipe for an insane amount of user frustration.

If I got locked out from any of my accounts for just typing in the wrong password 5 times, a few seconds apart, I would get kinda pissed.

Because that's a thing that you do regularly? I would like for all of my accounts to at least start massively rate limiting me after 2 or 3 failed attempts. I honestly can't remember the last time I mistyped a password 3 times in a row, especially because it's increasingly rare that I actually have to type the password in by hand.

I think it’s hilarious Trump’s account was compromised but calling a nerd who steals accounts an ethical hacker is like calling someone who steals elections an ethical president. Hope they lock him up. Both of ‘em.

I though that too, well the part about the hacker anyway, until I ... read the article. They are ‘ethical’ hackers in the sense that they immediately informed the Trump administration.

Whether that’s actually ethical or not is a tangential discussion because the existence and application of term is not controversial.

Ethical hackers hack for fame and money, but they don't blackmail or disclose any information that could harm anybody. Lots of companies already take part in bug bounty programs with explicit rewards for hackers or implement "coordinated vulnerability disclosure" (CVD).

I read the article too, mate. It doesn't change my mind on the matter. If someone broke into my house, my righteous indignation would not be assuaged by their refusal to steal and immediate disclosure to me of how easily my lock was compromised.

Reply on news.ycombinator.com