Chamath Twitter scammer at it again using hacked verified accounts | Hacker News Reader

Chamath Twitter scammer at it again using hacked verified accounts

4 pointshamiltonians6 comments

Targeting Chamath Palihapitiya instead of Elon musk

https://twitter.com/JCarew10/status/1358316583228219392

blog landing page

https://chamath-events-btcs.blogspot.com/

lots of $ coming in

1DDVVNdkFegwDHgycoHz42tamRwftGDouM

easy $ ($100+k/day profits) for anyone who can figure out how to get these verified accounts and then spam them

3 years now of verified accounts being hacked to promote crypto scams and twitter is unable to do much despite considerable media coverage and millions dollars lost. I have seen this one hacker group steal as many as 5 verified accounts/day and 1000+ non verified accounts/day. I don't know how they are doing this but I suspect it is bruteforcing because some of these verified accounts have been inactive for a long time, so it probably not a cookie or other credential issue. Bug reports are useless because I unable to identify a problem, only that there is some sort of vulnerability allow this to happen. afik Facebook does not have this problem.

Previously: https://news.ycombinator.com/item?id=26020117

Not sure the verified accounts are required. Volume can make up for potency.

verified ones rank higher in comments and look more authoritative.

Sure, but if you are going to automate the whole thing, 100 accounts might be just as good as 1 verified. Interesting that they bother to get the verified accounts.

Could be they're just going after just a large volume of accounts that they find themselves with some verified and some non-verified. I suspect new account generation is locked down tighter than the method they're using to take over these accounts.

Note the generated replies. Some of them are completely off-topic.

The automation is in the harvesting of accounts, which I still have little idea how they are getting so many, although I am looking into it deeper. They are possibly able to scrape a huge list of verified accounts and then bruteforce it, possibly with an AWS cluster to prevent rate limiting by having access to large pools of IPs. Likely they have a list of 1000+ accounts they go through each one with a simple password, the same password for each account, and then work their way up to strings of numbers, words, and other characters. The posting process is not automated though. Verified accounts do not get filtered as easily if you change the profile pic. Notice how it changed it to Chamath, but without a verified account, likely twitter's algos would ghost any posts made by the account or suspend it. Upon gross inspection it really does look like the real Chamath, hence why it is so effective.

The easiest, least specialized route would be for them to simply buy the account credentials.

Socks5 residential proxies are similarly sold in the same place.

As are password dumps. In the case of password reuse, I believe Twitter may still provide a way to find users by email address. Therefore, if the user's email and password are known, then the user's Twitter account can be found. From there a login can be attempted.

There could also be a malicious mobile app for account hijacking.

Regardless, they could most probably buy the Twitter accounts.

Reply on news.ycombinator.com