Trump Twitter Was Hacked | Hacker News Reader

Trump Twitter Was Hacked

bbc.co.uk

22 pointsksajadi28 comments

For reference: HN thread from 55 days ago when this story first broke. Nice to find out for sure that it was/is true.

https://news.ycombinator.com/item?id=24859217

The screenshot proves nothing. Anyone could grab the same images and set the same name and bio

> Mr Gevers had told officers he had substantially more evidence of the "hack".

It is very possible that this is just an article with limited info and not much has been released publicly because of privacy/security concerns.

Exactly. A screenshot is not convincing enough as they can 'inspect element' this 'hack'.

Simply show me a video logging into the account in real time with the given password and the 'hacker' can eliminate this skepticism.

Quite funny how people can quickly believe this stuff on the internet without thinking again, especially from...

BBC online news... sigh.

It's even simpler than that, both of the fields in the screenshot are editable fields, so they had to do nothing more than create a new account, upload the same banner and profile picture, and put the text in the boxes

hey inspect element tricks and developer tools have been put to great effect in the realm of scammers transferring excess refund funds into folks bank accounts.

Hmmm, yeah. From the linked article,

    Mr Gevers had told officers he had substantially 
    more evidence of the "hack".

An earlier article gives a little more detail, but nothing substantial. From https://www.bbc.com/news/technology-55019858 --

    He did not post any tweets or change any settings, but 
    said he took screenshots of some parts of the 
    president's account.

If he has screenshots of private messages, etc, that would certainly prove he had access... but only if Trump or somebody with legit access to Trump's account was able and willing to verify them.

Of course, I don't blame this researcher for lacking more concrete proof. He could easily have proved his access by changing something in Trump's account, sending a tweet/DM, etc. But by doing so he likely would have brought some serious legal issues down onto himself.

> But by doing so he likely would have brought some serious legal issues down onto himself.

The problem with that theory is that he did heavily insinuate having posted a tweet from Trump's account.

> only if Trump or somebody with legit access to Trump's account

...or the sender.

By that logic anyone could impersonate anything. Dutch prosecutors have accepted it, the bbc are a reputable organisation, it almost certainly happened.

"Twitter has refused to answer direct questions from BBC News, including whether the account had extra security or logs that would have shown an unknown login."

No matter what answer they gave, they'd look incompetent.

Why? He literally guessed the password. The only fools here are trump, his administration and the American population that voted him in.

Why didn't Twitter refuse to let him (and any of their other users, but especially him) use a stupid password?

Why didn't they require 2FA (especially from him)?

Why didn't they have even more security precautions for his account that wouldn't have let just anyone even with his pw and 2FA log in?

Why didn't they have some way to detect and prevent a login from an unexpected location?

And if they did have these, it shows they were incompetent in devising or using these precautions.

Of course, if this intrusion actually happened, it's not just Twitter to blame. Whoever's on Trump's cybersecurity team also messed up, as they should have had extra precautions way above and beyond anything Twitter had.

Rudy (pocket dialing a reporter, uploading wrong video clips, being locked out of his phone multiple times) Giuliani was his cybersecurity czar at one point. They clearly care about it.

This is the issue with the whole situation - Twitter is not an extension of the government. People can enable 2FA or not. That’s on them.

The fact that Trump uses it as his official podium is the problem, ultimately. I was worried that we’d see a declaration of war come from him announced on Twitter. The same service where I can see explicit porn right after it and where millions of keyboard warriors talk shit and troll.

You'd think the fact that someone who hacked Trump's account could literally start a war or cause some other serious incident would make Twitter reconsider their apparently lax security policy, at least for extremely sensitive accounts like his.

But no, apparently washing their hands of it is more important than saving lives.

How is this even possible. How can twitter not force MFA for arguably the most important social attack vector of our time.

This does not mean he hacked Trump!

They checked that, according to his actions, he was within the bounds of the "coordinated vulnerability disclosure". A protective legal measure for whitehat hackers.

If he wasn't, then he could be sued for "hacking" and with malicious intent.

Source of my info was a dutch article ( the hacker is also dutch): https://tweakers.net/nieuws/175822/ethisch-hacker-wordt-niet...

Thanks for finding a better source. Something along these lines was kind of my suspicion. Given Twitter is claiming this didn't happen, it's hard to see what kind of evidence he would have that would convince the police. All the stuff like alleged screenshots from inside the account are fakeable and unverifiable without the cooperation of Twitter.

True, but the hacker himselve is not just "a wannabe" though. He found and disclosed more than 5400 online vulnerabilities, so I would just say that the article doesn't prove any point ( if it's true or false).

( https://tweakers.net/partners/meet-up2020privacysecurity/127... )

More information about some of his findings are listed here https://gdi.foundation/#/news/README

Small extract:

> WeWork’s weak Wi-Fi security leaves sensitive documents exposed

> A huge database of Facebook users’ phone numbers found online

> China Intercepts WeChat Texts From U.S. And Abroad

> Over 90 Million Records Leaked by Chinese Public Security Department

> Unsecured MongoDB databases expose Kremlin’s backdoor into Russian businesses

The original story was wildly implausible. None of it holds up under a moment's thought. He might have a track record, but the burden of proof is still on him. And that is just as true after this article as before.

Given Twitter is a broadcast medium, it would have been incredibly simple for him to provide incontrovertible proof rather than screenshots and a claim that he posted a tweet that is indistinguishable from the average Trump tweet.

That would bring him at risk for the protection as a whitehat hacker

“Hacked” seems like a strong word. A security researcher guessed the password and notified people of his findings

And MFA was not enabled?

Too complicated for people like Trump, who doesn't even read email but instead has them printed out for example, annotates them and sends a reply as a pdf.

https://www.politico.com/story/2016/12/donald-trump-technolo...

AMLO, our Mexican President, for some time had a picture of him working at his desk in the official presidency's website. Zooming in on the papers it was evident that they were printed Facebook pages. I couldn't find the image now, this was a year ago.

Quite pathetic that our head of state's password was as simple as "MAGA2020!. Twitter should impose complexity requirements for passwords of verified accounts.

I’m sorry I am not buying this story. No way his password was that and guarantee the presidents account has two-factor. Congratulations Victor on getting world wide press coverage but I am calling BS.

First thought: Scary, lucky someone more malicious didn't get there first.

Second thought: But then, it's hard to think of something that an attacker could do with Trump's account that's worse than what he already does on a daily basis.

Reply on news.ycombinator.com