Who’s behind Wednesday’s epic Twitter hack?
krebsonsecurity.com
krebsonsecurity.com
Back in 2013 when The Associated Press was hacked with a tweet of "Breaking: Two Explosions in the White House and Barack Obama is injured" and erased $136 billion in equity market value:
Archive: http://archive.is/8lCMV
https://www.washingtonpost.com/news/worldviews/wp/2013/04/23...
This twitter hack could have literally destroyed economies, started a war, potential for black mailing politicians and others etc.
This really needs to be looked at with much bigger eyes. This wasn't just a bitcoin scam.
We've entered a world where the lowest common denominator of information is being used as primary source for current events. That's asinine.
This is largely through their own actions. Examples are legion, but a recent one is debacle at NYT over an op-ed. The news-consuming public was able to view the shenanigans of NYT reporters and staffers, which would formerly been done being the scenes.
Many eyes were opened, and I'm certain I wasn't the only one thinking "These are the people in supposed to be trusting for my news and analysis?"
Newspapers and news outlets aren't actually "primary source". If you read a quoted tweet from Obama in the New York Times, the NYT isn't the "primary source" - Obama is. The NYT is a secondary source that is quoting from primary source.
In that sense, Twitter is actually primary source, because Obama wrote the tweet. Well, except when Twitter is hacked, which is what makes this such a significant event.
(But I agree with your general comment, especially having been interviewed a few times and seen how most reporters work. There are a handful of good ones out there though.)
Or it could be the result of a decades long effort to attack credible authoritative institutions by forces that take a dim view of transparency and accountability.
If 200 people on Twitter are angry at politician X over something trivial, we are served a news headline of Person X accused of Y - Public calls for resignation.
An anonymous person on social media recently made a claim of sexual assault against Justin Bieber with no evidence whatsoever, and the media reports it as Justin Bieber accused of sexual assault. He was fortunate to immediately whip out numerous receipts countering the claims, but what if he couldn't? We would still be reading headlines about this baseless accusation.
Is it though? According to Pew, only 20% of US adults use Twitter: https://www.pewresearch.org/fact-tank/2019/04/10/share-of-u-...
In comparison, Fox news is used as a source by 40% of the US population: https://www.pewresearch.org/fact-tank/2020/04/08/five-facts-...
The share is bigger for Facebook, though (69%)
Yes, except the FCC can forcefully suspend the operations of a radio station.
Though Art Bell said the show was "pure entertainment", anyone who tuned in without that context heard what sounded like a serious news talk program about aliens, crystal healing, reptilians, etc, etc.
>"The supposed panic was so tiny as to be practically immeasurable on the night of the broadcast. ... Radio had siphoned off advertising revenue from print during the Depression, badly damaging the newspaper industry. So the papers seized the opportunity presented by Welles’ program to discredit radio as a source of news. The newspaper industry sensationalized the panic to prove to advertisers, and regulators, that radio management was irresponsible and not to be trusted."
and
"Welles later embraced the story as part of his personal myth. "Houses were emptying, churches were filling up; from Nashville to Minneapolis there was wailing in the streets and the rending of garments," he told Peter Bogdanovich years later."
"CBS, too, found reports ultimately useful in promoting the strength of its influence. radio management was irresponsible and not to be trusted."
https://radioambulante.org/en/translation/the-extraterrestri...
Getting It Wrong: Ten of the Greatest Misreported Stories in American Journalism
https://www.amazon.com/dp/0520262093/ref=cm_sw_r_cp_api_i_y5...
https://www.miamiherald.com/news/nation-world/world/americas...
It's perfectly feasible for every trusted source of knowledge to run a web server, and they actually do it, so it's sad that consumers don't connect directly to those servers and instead use middlemen.
What people trust is generally what fits their worldview which is increasingly reinforced by the filter bubbles provided by tech companies. The increasing polarisation and tribalism is made worse by the traditional network programming and now algorithms that present what the audience is comfortable to see and hear.
I like using DDG because it doesn't filter, but at the same time I hate wading through utter crap and being the filter.
Twitter for all its flaws is pretty good at giving everyone a voice so you can read something and then the criticisms without having to aggregate that from multiple sites.
Which people? Whose people? This is not a statement of psychological truth. It may however describe a societal truth.
But it is not true that people in all countries want above all to be entertained. People struggle in undemocratic countries. Education makes democracy strong. It also breeds rebels.
Public discourse reflects education. A society conditions its citizens to think a certain way. The typical conditioning involves protecting the society. The flag, the anthem, the history, the current power structure and its wars.
It's sad to see journalism collapse in a democracy. It's sad and perhaps fatal for democracy if people have been conditioned to be infantile and their implanted desire for gratification has overwhelmed their thinking and speech.
Then you elect them.
Regardless, if anyone has a response to a bunch of websites being a worse security model than one giant platform, you can reply to me instead.
The account is likely shadow-banned or similar, so their comments are dead by default.
https://en.wikipedia.org/wiki/The_Adventures_of_Buckaroo_Ban...
And then? Doing damage control on a fake post by the CEO of Supercorp saying they're faltering financially, or whatever, when it has that green badge of crypto-authenticity, and you've spun your marketing in such a way to tell people "if that's there, it is 100% authentic, just look for that badge" ... that would be a nightmare. It's an issue with "verified" already, but cryptography is essentially magic; many in tech believe they get the nuances but don't really, and most outside of tech don't even begin to get the nuances. Would that damage people's trust in cryptography in general? Maybe?
After all, most people don't know, understand and/or care that their Whatsapp E2E is effectively broken for police and similar actors when they enable backups, because most people care about the details of these things about as much as I care about the exact things my hairdresser does to make my hair look good, which is pretty much not at all unless they want to use a chainsaw or something. If that were to be abused in a major way, that'd probably make big headlines.
I don't think that, at this point, cryptography is even generally helpful with fundamentally social problems like these, because it tends to be incredibly hard to build a product and UX around it that works for everyone and fails in a way that is somewhat understandable and actionable – the amount of work that HTTPS has required and still requires to mostly get there has been and still is huge.
But the world we live in is full of "web services that let people post whatever they want at any time". News from Twitter may be weird but many people want to get their news from the BBC website, or the New York Times, or Reuters or whatever. Or their own government's websites. Just web services that people post from - presumably with levels of editing and checking but all presumably with security flaws that could bypass them.
It's not clear exactly what you're asking for. A technological solution involving careful checking of cryptographic signatures? Or some sort of super-expensive-to-spoof source of all important news?
Company X presents the public with communications of known public figure. Company X assures the public, via a blue checkmark, that said communications are from a "verified" account.
Shouldn't company X be liable if someone other than the known figure is making public statements?
It seems logical, fair, and a societal 'good thing', that company X should either let go of the pretense of "verified" communications, or get its act together, or pay the legal price.
But it is fair to say that there is no sane channel of information. The channels of public discourse in the US, once controlled by a few "loyal, patriotic" corporate owners fed by advertising revenue, are now channels controlled by unprincipled corporatism that supports a two-party system of untalented puppets.
And the un-talent pool is bigger than ever.
Not.
https://www.whitehouse.gov/presidential-actions/presidents-e...
The hack would have been a powerful weapon if used in a more strategic way. A "shot across the bow" as a tactic is useless when the weapon can only be used a single time and never again. The code will be patched now.
>Also, the crystal clear implication that the damage done could have been far worse, would seem to indicate someone was sending a message.
That's hindsight knowledge. To me it looks more like an un-sophisticated actor that stumbled over a critical vulnerability and had to use it haphazardly before it somehow becomes obsolete with code update.
>From whom and to whom can only be the subject of speculation, but again, whoever did this must have known that the it would be interpreted as an attack from China to the USA. So either they didn't care because making that obvious was the whole point (ergo, attacker probably China), or the misdirection was the whole point (ergo, attacker probably a power that would stand to benefit from increased tension between USA and China).
Actually I don't see much speculation that China is behind the hack other than from the people who are quick to blame China anyway. The sloppy execution actually speaks against a nation-state actor. The loss of trust in Twitter only plays into Trump's hand regarding his personal feud with the platform.
Seems to me having them there is about 99% downside, 1% upside.
Disclosure: I dislike Twitter on principle.
Equity destruction: sure. War: no way.
Wars are the result of a series of escalations. It doesn't take a lot to knock over the first domino.
On the contrary, take what happened when Trump wanted to bomb Syria, and people basically didn't let him. Presidents, especially weak, un-respected ones like Trump, can't just do things like that.
Then there's reality. And in reality, not many people respect Trump and are willing to follow his orders. This happens constantly in the news. His own cabinet members openly work against him all the time.
Most recently consider how Mark Esper publically publicly rejected using the Insurrection Act, right over top of Trump.
Now you could say—what if we had some other president? Well, the same social rules would apply to that person as well. Even if they were incredibly charismatic and well-liked and respected, they'd need to clear many social and political hurdles before the airplanes took off.
https://allthingsnuclear.org/dwright/trump-and-the-nuclear-c...
Whether the military would actually carry out those orders when no one else has ICBMs in the air is debatable, but the president's defined role as the commander-in-chief and the sole arbiter of when to open the gates of hell on earth is not.
It's not merely debatable, it's highly debatable. People aren't just going to launch nuclear weapons willy nilly, no matter who the president is, muchless for Donald J. Trump, who few people in his administration take seriously.
Trump couldn't even get Mark Esper to deploy troops domestically. Now imagine the hurdles he'd face trying to deploy troops to another country.
It is important to remember how the US launch system actually works, though, and that it's theoretically possible he could.
This is ridiculous, there is ample room for criticism against Trump. This wouldn't fit at all. I guess you can blame him on Turkeys reaction in Syria, his staunch anti-Iranian policies that made talks more difficult. But the criticism of him starting random wars comes from an emotional corner beyond reality in my opinion.
It's ironic because his image today is of violence and instability and that the opponents of him don't consider violence overseas or international peace as that important.
It's things happening at home which counts politically in a present time.
Trump will kill less than Obama but Obama gets the noble peace prize.
I dont even have a twitter, facebook, instagram, or... anything i think. just you people : )
i will not. affected persons included biden, kanye, obama, musk, bezos, gates and others. this is an audience in the 100's of millions (if not over a billion, i didnt count). do you honestly think theres no possible tweet that directly leads to someone's death, and likely many deaths?
im not sure an outright war is > 50% possible, but i am sure it is > 0.0%
Its highly unlikely but far from impossible.
Wars start from smaller conflicts, which come about through escalation of smaller conflicts, lies, or misunderstandings. I think all that is necessary to start a war is a geopolitical event of sufficient severity to provoke a retaliation; once the first retaliation happens, there is high risk of further escalation.
So the question is whether a deception on Twitter could trigger a real-world event significant enough to provoke a retaliation. It might be hard to do that with a single message, but they had access to multiple accounts. These tweets were stupidly obvious scams. You could create a huge amount of panic with a series of posts from different influential accounts if they were designed to be believable.
> War seems very possible.
A salty remark on twitter that is rapidly taken-back?? I don't think so.
Get Trump's account, and tweet something like, "I've ordered a NUCLEAR STRIKE on China! The missiles are already in the air. The DEEP STATE is trying to take me out. They will try to silence me and delete these tweets and use deep fakes to say this was a hoax! The storm is here, Q is real, it's time to take up arms and kill democrats."
Then continue tweeting escalating things over the next half hour (since apparently the hackers couldn't be stopped for a while).
Even after dozens of high profile accounts were hacked many were still commenting that they didn't think it was possible for it to be a twitter vulnerability, but rather individual accounts being compromised or a 3rd party. If you only tweeted plausible things about war and corroborated it from multiple accounts at the same time you can reinforce things pretty easily.
Military is not _exactly_ ran-out-of-diazepam Dave with his hunting rifle and tinfoil hat.
With tensions already high and military maneuvers are beeing held closes to each other ... such a twitter comment for sure would have had an effect.
No one would have pushed any red button because of that, but fighter jets on both sides would have been put on alarm and in the air and close to each other(as well as submarines, warships, tanks on the border..) , with a high chance of clashes. Which could have increased the escalation to the point, that someone would feel forced to put the red button.
It's lucky that those kinds of things never go wron...
"On 26 September 1983, the nuclear early-warning system of the Soviet Union reported the launch of multiple intercontinental ballistic missiles from bases in the United States."
...oh.
https://en.wikipedia.org/wiki/1983_Soviet_nuclear_false_alar...
> My fellow Americans, I'm pleased to tell you today that I've signed legislation that will outlaw Russia forever. We begin bombing in five minutes.
Conspiracy nuts don't need much to set them off, see 'pizzagate'.
>Reactions
>Soviet
>By August 14, the recording of Reagan's joke had become world news. On August 15, someone who the National Security Agency described to US Representative Michael D. Barnes as "a wayward operator in the Soviet Far Eastern command" sent a coded message from Vladivostok that said, in part, "We now embark on military action against the U.S. forces." Japanese and US intelligence decoded the message and raised the alert state in that part of the world; Soviet naval vessels in the North Pacific, on the other hand, contacted Vladivostok in confusion. The US never saw any evidence of Soviet attack preparations, and the alert status as promulgated by Vladivostok was canceled within 30 minutes.[3]
>Initially, on August 13, the deputy minister of Soviet foreign affairs (Valentin Kamenev) told reporters, "I have nothing to say."[5] By the next day, though, President Reagan's leaked comments were denounced by the Soviet government, Pravda, Izvestia, and TASS as "unprecedentedly hostile," as evidence of the United States' insincerity at trying to improve Soviet Union–United States relations, and as abuse of the office of the president. "Western diplomats" described the Soviet response as over-the-top, suggesting it was an effort to give themselves more collateral at the negotiating table with the US.[7] US officials were compelled to mollify the Soviet Union and assure the United States' Cold War adversary that "Reagan’s offhand remark did not reflect White House policies or U.S. military intentions."[8]
http://www.msnbc.com/transcripts/rachel-maddow-show/2016-12-...
https://www.theguardian.com/world/2014/aug/14/ronald-reagan-...
https://www.politico.com/story/2010/08/reagan-jokes-about-bo...
Audio and news coverage:
https://www.youtube.com/watch?v=CFCABnWlN8E
Bonzo Goes To Washington - B-B-B Bombing In 5 Minutes (Jerry Harrison, Bootsy Collins)
https://www.youtube.com/watch?v=0k4TNtUZnM4
https://en.wikipedia.org/wiki/Five_Minutes_(Bonzo_Goes_to_Wa...
In the meanwhile Trump would appear after some minutes on TV, youtube, and whatever other channel they have around, proofing that he is not sending the tweets, while twitter would do their stuff.
1. https://en.wikipedia.org/wiki/List_of_nuclear_close_calls
Twenty years later, a substantial part of American society is still insisting Moab really was nuked, drives around with "Remember Moab" bumper stickers, and considers the purported continued existence of Moab to be something like a Deep State plot.
>Get Trump's account...
Tweets from Stable Genius are now just grist for a media-industrial complex of outrage.
Only few people have Twitter accounts, it's a walled garden. Almost nobody cares what people shout in 140 chars, and likewise nobody cares about people streaming video on Twitch or YouTube in 20 min, what could be written publicly and read in 10 seconds.
Let’s not speculate war here. We’re on HN:)
Tweets were about bitcoin, therefore broad public was not the target of the attack.
Hence Twitter just prevented verified accounts from posting and deleted some messages. Had president's account been hijacked and threats of imminent nuclear strike etc. were thrown around, DoD would have been quick to contact to Twitter and they would have been disabled the whole account, put notifications about hijack for everyone to see (like these COVID notifications) or maybe even take the whole platform offline until they fix it.
You would click a link to go to the said tweet, but you'd only see president's account is not there, and there's a huge warning saying it has been hijacked, and devs are working to get it back. That's it.
Now please try to convince me otherwise, I'd love to be challenged on this.
No. Bitcoin was used because it's the only way to get money without being tracked (hence why drug dealers and even hitmen use it).
The rest of your argument is all speculation. Nobody knows what would've happened, so you can't convince anyone you're right, just like no one can convince you you're wrong.
I will just say that with the current distrust of Russia/China and in recent years, the US becoming an "unreliable" ally for Europe, a few tweets from a President and perhaps some other senior members of Government could easily have started a disastrous series of events (if unlikely to cause war directly).
This hack had been going on for over two hours, with new high-stakes accounts being steadily taken over (and possibly have their DMs siphoned) and their only action was to disable posting for verified accounts. I think we can safely say that IF Twitter had the possibility to effectively pull the plug, we would've seen that on Wednesday.
Could a Trump tweet (real or fake) cause a pivotal escalation in a series or escalations leading to war? I think probably yes.
May be different for internal politics. Since people are often irrational.
Something like this right before the election or after could wreak havoc if targeted to the right accounts. I imagine certain state sponsors would pay handsomely for that.
To be clear, that value wasn’t erased. The market makers just lowered their willing bid during the uncertainty.
https://en.wikipedia.org/wiki/2018_Hawaii_false_missile_aler...
https://en.wikipedia.org/wiki/Jyllands-Posten_Muhammad_carto...
And, with conspiracy theorists, imagine the consequences of Trump's account tweeting a distress message that he was attacked and replaced by a clone controlled by QAnon.
I'm happy whoever did this wanted money.
No they don't.
The platform derives power from the audience. Stop giving it your power.
[0]: https://www.statista.com/statistics/274565/monthly-active-in... [1]: https://www.omnicoreagency.com/twitter-statistics/
I have to regularly stop and check that "ha, yes, that's a very USA-centric take on things and does not represent reality outside of it".
https://www.statista.com/statistics/617136/digital-populatio...
Twitter is very US-centric.
As for the blackmail and war starting you probably couldn't do much with public tweets (nobody is going to go to war over a tweet without fact checking it) but access to private messages is an entirely different story.
Depends how tense the situation already was. A well-timed tweet could be enough to tip things over the edge if both sides were already on the edge, and I don't think we're too far away from that.
Those tweets can make them more itchy than they already are in a tense situation and nervous persons make more mistakes.
Bismarck released his carefully worded readout in the evening of Thursday, 14 July 1870. Assuming the french were "making the bridge" for Bastille Day, they would have had one working day (Monday, 18 July 1870) to fact check, but I don't know if they took even that, because according to https://en.wikipedia.org/wiki/Causes_of_the_Franco-Prussian_... , on 19 July 1870 "Le Sourd, the French Chargé d'Affaires, delivered Napoleon [III]'s declaration of war at the Foreign Office" in Berlin.
https://scholar.dominican.edu/cgi/viewcontent.cgi?article=11... suggests the french were already mobilising on 14 July itself, and that while telegraph use may technically have been possible, US diplomats were still communicating by snail mail with State.
That emotion won over fact checking is supported by Ch. I p.3
> Washburne dismissed the accuracy of the Ems telegram because it had been challenged by King Wilhelm. "There is no truth in the reports concerning the indignity which the King of the North German Confederation offered to Benedetti, the Envoy of France." Washburne based this statement on a published denial by the King which he had read in Cologne while returning to Paris. Though he questioned the veracity of the Ems telegram, Washburne still credited it with arousing the French Chamber of Deputies to vote for war.
(the war vote was Friday, 15 July. It might be interesting to see if any french papers had carried Wilhelm's version of events.)
It would be interesting to know what percentage of journalists/new people, are active on Twitter. I would expect them to be over represented given the amount of reports based or citing tweets, but I don’t know.
The "muh stock market" argument is stupid; there are punters who take it seriously, and obviously, it's a great vola signal for automated traders. So what? Rumors were propagated before twitter and will be propagated long after it goes the way of other useless companies like pets dot com.
This would potentially add a lot of friction for those users, but maybe that is a fine thing.
Unless we hear more details, it sounds like this attack was able to get around the 2fa for the authentication, so it seems likely they could get around it for posting. Not sure how much would be added with this 2nd level 2fa.
I think there is a big organisational difference between the AP and Twitter, but that's just me. Twitter does not employ journalists. Twitter is not the press.
At least when Twitter is secure, you see the exact words that were typed, and not through the filter of a reporter who may have misread.
I've personally been misquoted in media interviews. Not a major thing, but I could now use that newspaper article to claim I've done more than I really have, because hey, the newspapers said I did! It must be true!
(I didn't downvote you though, I think the downvotes are unfair.)
Thankfully, his account is under special 'lock and key' protection, so a regular CS rep can't hijack it.
> This twitter hack could have literally destroyed economies, started a war [...etc.]
It's not hackers which are the true danger, "legit" people abusing media (whatever it may be) are the threat, a good example would be the Stable Genius.
1. https://www.history.com/news/6-wars-fought-for-ridiculous-re...
We are very far from a stray remark triggering a war unless either/both sides are already heavily primed and itching for one in the first place.
> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers.
My understanding is the hackers used the admin panel to change the email addresses of the accounts, which means they could reset passwords and perform full account takeover [what about 2fa?]. That means they could login as the user, and so it means they could read the user's direct messages. (Ironically, Twitter's solution of disabling posts from blue checkmarks would not have stopped exfiltration of direct messages while an account was compromised.)
Sure helps keep down on the public effect though... feels mostly like a PR move.
It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consuming and opens the risk of being caught especially if it a high profile target, with no guarantee of being paid. Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating? Paying off a blackmailer is an admission of guilt and does no good if the info is released anyway.
It also depends on how sophisticated the thief was. Did he have everything automated to dump anything everything from the inboxes while automating the posting of the spam tweets, or was he frantically doing all his postings by hand before twitter could shut it down. If the thief is not sophisticated his main priority would probably be making as much money as possible with the posts and ignore the private messages
Maybe? I mean I certainly don't dismiss the idea out of hand. The one strong counter-argument I can think of is that very few things would actually embarrass Musk at this point.
A somewhat odd blog post by Jeff Bezos about blackmail from last year is quite interesting in this context. [1]
[1] https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146...
Anything illegal might've been actually good for black mail purposes, but dick pics? As if someone would actually look for that or even take a business decision based on that.
They used different approaches on different twitter accounts, some suggested a coin return, others suggested a charitable donation match, etc. But, they all used the same bitcoin address. If they were sophisticated, they would have used a different bitcoin address for each to evaluate the more profitable messages for a future scam.
I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world.
The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug problems and help our clients. None of it is accessible from the Internet.
This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.
I could be wrong, but I think they mean that access to the internal site should have been behind VPN (whether at the IP network level or via an HTTP proxy) even when accessed over the internal network. That is, the internal network should not be trusted any more than the network at the cafe down the street.
Yes, in a perfect world everyone would have an army of SecOps ninjas pentesting and patching all systems 24/7, but this is the Real World™
Defence in depth.
If you have the means, certainly use a corporate/smb/personal vpn. It is one layer in a multitude of layers you should be using to protect your network.
Its not as if once you achieve vpn access you have no other authz gates to internal applications. Its a "great filter" to help narrow the possible avenues of attack and it works. If your inner layer of authz fails its not the vpn's fault.
Whats your alternative? Just make every application and network endpoint publicly accessibly on the internet?
Yes, basically you should consider all networks untrusted including your internal network. You can still have a VPN but it shouldn't be the thing that protects the services inside your corp net because if it is then any breach means the intruder gets access to all your stuff.
The purpose of a VPN was never supposed to be the authentication layer to internal services. It's just a layer of security that makes it more difficult to carry out some types of attacks; thus increasing security defenses of an organization. Assuming that it has been breached is good practice, but doesn't mean that there's no point to it.... Unless layered security has been overturned?
VPN can be a security tool, as long as it is not your only security tool.
For these big companies (FAANG, Twitter too), please spend all those money on your security instead of market please.
Sorry, but what? I've worked in multiple small companies where the we where less than 5 system administrators and inside the vpn we had encrypted traffic and ldap auth on everything. It's a few days job for a single person to set everything up this way with open source tools that are extremely well known and documented.
My visceral reaction was "you got to have a VPN" as well but the more I thought about it the more I was convinced you don't _need_ a VPN.
Not sure if it still doesn't work effectively for that.
I'm all for debate but some things are close and shut. Yes, don't trust your user just because they are in the internal network, but no, that doesn't mean everything has to be visible from the outside.
Yes, yes we (more accurately "they") did. I don't know which schmuck with a blog came up with this idea that VPN is a thing of the past and a lot of people followed suit.
I bet there are IT shops out there that rely solely on VPN and the schmuck worked there, but that's like seeing somebody not lock their door and concluding doors are bad model for security and we should get rid of them.
your beyondcorp link has nothing to do with a well implemented vpn solution + standard access controls to network endpoints like the link suggests. Your clearly supporting a false dichotomy in which having a well constructed vpn solution is "wrong" and does not add to your overall security posture. Shenanigans.
vpn or not you still need to authorize/authenticate your network endpoints. But hey, you don't want a vpn so give me a list of your internet accessible ssh hosts and well see how well your "zero trust" gets you if you can't keep up with best practices. Good luck!
You can safely ignore anyone that unironically uses "anti-pattern" or "dark-pattern".
"Defense in depth" is not an anti-pattern. Using an VPN as the only layer is, certainly, but that is a straw man.
> If the account with VPN access is compromised, then the attacker has full access to these sensitive systems.
No. Logging in the VPN is one thing, logging into the internal systems requires an extra login
This is not hard
VPN and IP restrictions in general is a very good tool to limit the attack surface. That does not mean that Karen from accounting should be able to log into the production environment servers.
How do you jump from "VPN is not authorization" to "VPN is an anti-patern"? It's at a completely different layer than authorization ffs! You don't give up on seat-belts because they don't stop bullets coming through the windshield.
By whom? It's another layer of security, nobody claimed it should be the sole defense.
It's a part of security, along with other multi-faceted authentication routes.
Additionally, TLS1.3 is better than most VPNs from a cryptographic standpoint.
Now, we see the potential of social media to be a tool for coordinated attacks against the western world. Just imagine this attack during the protests last month in the same narrative that started civil wars in other parts of the world. When tens of people start shooting and killing eachother, nobody would discuss what triggered the chain of events.
This is a simple test that reveals how fragile is society in contrast to how much attention they pay to Twitter. The worst, the value we get from social media is also unclear. Low quality, unreliable bits of information turned millions to pigeons jumping from there to there and those who own the seeds can control the mass.
It exacerbated it first in the middle east, maybe because those societies were close to conflict to start with, but the western world doesn't seem that far behind.
Added to which he has somebody in the comments essentially calling for the death penalty over this. If he has this personal information and evidence, pass it to the relevant authorities and don’t sensationalise it on a blog. Technical details fine, but people’s personal information feels like it’s crossing a line on something like this.
What small step is that? Looks like a textbook case of doxxing to me.
Yeah this is definitionally doxxing
https://itwire.com/security/infosec-researchers-slam-ex-wapo...
https://krebsonsecurity.com/2020/03/annual-protest-to-fight-... (see comments)
The users of said image board do a yearly fundraiser to protest against the unnecessary doxxing. The first one was started by a random user.
Doxxing someone because of a bad book review? I guess I shouldn't be surprised he's now doxxing someone based on a loose thread with no evidence.
I would have thought someone who has been swatted before would realize the dangers of releasing someones personal address to outrage-hungry vigilantes.
1. https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-d...
2. https://twitter.com/cyberingcc/status/1252460981546090496
Zero tolerance policies don't make any sense to me.
Don't think you can say that with certainty. It looks like a fairly solid series of deductions.
I'm not sure I understand your comment actually.
Three examples from the front page of the NY post right now.
I am having a hard time figuring out how to distinguish this and the OP doxxing. The organizationS fact-checking process? Solidness of the evidence?
> Allegations were made against longtime radio broadcaster Larry Michael (retired Wednesday), director of pro personnel Alex Santos (fired last week), assistant director of pro personnel Richard Mann II (fired last week), former COO Mitch Gershman (left in 2015) and former president of business operations Dennis Greene (left in 2018).
> Chanice Reyes, 24, was busted around 5 a.m. Thursday, sources said, when cops investigated a strong smell of marijuana coming from a car near City Hall, where anti-police activists have been gathering in recent weeks.
> Tory Lanez, whose real name is Daystar Peterson, was the person who allegedly shot Megan Thee Stallion following a dispute inside his vehicle Sunday morning, Page Six has learned.
The number of lives ruined by false allegations that have been amplified through press/journalists is disgusting.
I look at the media as a counter to the power of the state. So I worry about an arrangement where media can’t name people without state approval. But perhaps my view is archaic?
So does the NY Times, cf. the whole Slate Star Codex failure...
Doxxing can be a good thing only when authorities can't be trusted, which is the case for example of police violence and racism, where they're clearly protected by a corrupt system; in this case making their actions public becomes a public service. But in the above and other similar cases, think twice before publishing information that could undermine an investigation, even though they're properly checked and accurate.
See https://en.wikipedia.org/wiki/Sunil_Tripathi for an example that should make your blood boil
After the Boston marathon bombing, Redditors thought they found one of the responsible terrorist. He wasn't.
If Krebs got it wrong, well, he can suffer the consequences of that, too.
And, if he got it wrong, the innocent person he doxxed has to suffer the (potentially much more harsh) consequences of someone else's irresponsible actions. While Krebs begins working on his next story, and if we're lucky, posts an "oopsie" comment.
How can you justify that as okay?
But regardless, harassment is harassment. If the public starts harassing the dude, even if he is guilty, they're just as guilty of their own offenses. Two wrongs don't make a right.
This is irrelevant, how can you have a fair justice system if the mob has already condemned the defender.
It just happens that their last actions affected powerful figures and the US government so they might actually be some real international effort to arrest them now.
People's home addresses and names should not be released to the public until a legal conviction has been ascertained. This has nothing to do with "innocent narrative". It has everything to do with due process, which is a foundation many countries entire law systems are founded upon.
The legal process is innocent until proven guilty. You seem to be advocating for guilty until proven innocent, with a side of public vigilante justice as the punishment.
If doxxing innocent (reminder: you are innocent until /proven/ guilty) people is the norm... And allowing vigilante justice is okay... We are in a very dangerous place.
You don't have to look far for numerous cases of innocent people having their lives ruined, or sometimes literally snuffed out, due to situations exactly like this.
If what Krebs is doing in this case impacts the dude in any tangible and negative way he should sue Krebs for liable. That would be interesting.
what does the public or kerp gain by putting it out in public when you dont know.
yes he (kerp) can be held accountable (and should be hit immediately with a defamation lawsuit if hes wrong) but not everyone has the resources to do that.
look at reddit and boston bomber the person they accused killed himself..
Do we know this was due to the Reddit misidentification? His body was found on April 23, after being accused on April 18, but he had been missing since March 16. I've never seen a definitive order of events given.
(I've no doubt such accusations _could_ lead to such horrible outcomes, but I'm not sure if we know they did here with certainty)
A recent example was the biker misidentified as a man who assaulted a child putting up posters.
Sure, people _shouldn't_, but they overwhelmingly _do_, which has real, tragic consequences. People with platforms must take care or they cause tangible harm to others.
Once you look at Lucky225's Ham then you get an address. Of course, what is somewhat interesting is their listed address actually is located at Colorado's Division of Central Services building, which very interestingly is a way to obtain a confidential mail forwarding address. It says it is only to be used by victims of stalking/violence/harassment but who knows how well that is enforced: https://www.colorado.gov/pacific/dcs/acp-faq
Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed.
The ham license process itself is the doxxing, not a vector to it. The FCC is the one doing the public publishing of identifying information.
Don't feed the trolls. If anything we've seen a lot of praise for this person. That has probably been the most responsible hack when you think about it.
serious media outlets generally don't name suspects untill they are convicted.
This is a rule that we as a society have established after generations of experience with how media works.
Then we get "social media", and all the old rules get thrown out... So, how long will it take to reinvent the same rules for this new platform?
The first one I saw was a Rip of a SpaceX livestream. I watched it for a bit then noticed all the BitCoin references and got confused then realized it was a scam account. How they get promoted basically to the front page is the issue.
"Bitcoin"
edit: the layout/graphics were the same as the screenshot in this article linked downthread: https://cointelegraph.com/news/fake-spacex-youtube-channels-...
Archive of the Sony scam site: https://web.archive.org/web/20200612034440/http://ps-btc.inf...
Compare that to the one linked by the compromised Twitter accounts: https://web.archive.org/web/20200715192340/http://cryptoforh...
[0] https://decrypt.co/32102/scam-sony-playstation-5-reveal-even...
Alphabet Inc should be held liable.
I thought it was very well-known that Lucky225 made that story up as a cover to hide the fact that he gained control of Adrian Lamo’s @6 Twitter via a SIM swap hack himself, and also took control of Lamo’s Facebook in order to hijack ownership of the 2600 Magazine group on Facebook.
It's a very awkward thread where Lucky225 accidentally demonstrates that he has indeed taken over Adrian Lamo's email account. Note this doesn't say anything about whether they were or weren't friends. They definitely had overlapping interests.
Lucky would criticize Adrian behind his back all the time, and Adrian knew about it. They were rivals at best, and frenemies who barely tolerated each other in public at worst. Lucky’s the kind of guy who’ll toss someone right under the bus as soon as they’re no longer useful to him, but feign friendship until then.
Imagine a celebrity saying some 'not so politically correct' things to a friend in private 8 years ago, and now imagine this becoming public while the Twitter cancel culture is in full force. There's a lot of money and power in having that information.
I don't want to argue about what's wrong or not, I just want to point out what I find really concerning about the hack.
I think some people are possibly just sending the scammers some money for the banter? A sign of respect for the hack.
There's an argument to be made that the only reason Bitcoin became popular the last few years is because of the amount of non-techies who have been falling for all the same, tired "join my ICO and get rich!" scams.
My friends in social media positions heard about the twitter hack from me, not the other way around. Given how this info disseminated, combined with the breaking of twitters fundamental feature, i'm surprised more people didn't fall for the scam. A commenter yesterday claimed Coinbase had blacklisted the wallet very early on. I assume Gemini and Binance had similar reactions. Without this swift action, i'd wager the actual haul could have been many times the ~13 BTC they ended up with.
//That scam still works today, never underestimate the gullibility of people.
‘Mom can I please buy $50 worth of bitcoin, pretty please?’
Another idea is, hijack customer service request DM's from crypto exchanges, and lead customer to phishing login page. Perhaps could athorize API access to the account, and then change email back to original, without the owner realizing account breach.
You could probably make the whole site fairly convincing with just static files & some js which would be super easy to scale up with just a free cloudflare account or something along those lines
1) Accessible via corporate VPN only (requiring 2fa)
2) Admin panel protected by 2fa plus necessary authentication+authorization controls
3) Audit trails
Short of cooperative access (device handover), I could only see an outsider gaining access to the system due to poor security practices or a remote access trojan getting installed. Though more likely, Twitter lacked these basic controls.
Verified accounts could probably be subject to 2nd person controls so IF someone were to modify an account via admin panel, then a 2nd support person (preferably in a different location), would have to vet the change.
And the best part, support personnel often doesnt have MFA, because its outsourced to countries where smart phones with Authenticator apps are not as common to own for the regular person. I'm not joking.
That said, tokens are probably simpler than zero trust network setup. Even if you had a zero trust network, you'd still want tokens in case an employee machine is compromised.
Who rotates them when someone who had access to one leaves the org? :)
But now these tools are accessible from the homes of twitter admins. How many of them are running behind compromised home routers, etc? Everyone in the house has access - spouses, partners, teens, visitors.
I bet twitter doesn't have a lot of extra security on their admin tools. They probably write straight to the production database. Those safeguards would really slow down day to day support and be expensive to build, and they probably assumed the physical security of the office building was good enough.
I think the most like cause was a disgruntled employee working from home plus a little bribery.
Putting VPN and MFA on shouldn't slow down people much. They'd just have to spend a bit more time logging in each day. Annoying? Yes, but that's better than a breach.
If you're facing a government though, you do need to be wary of physical attacks.
The most important aspect to the American people is that the largest real estate holder in San Francisco and employs roughly 5,000 employees can’t figure out how to secure their platform. Which means they are a joke of company.
Similar to Google who can’t figure out how to provide customer service when they employ roughly 119,000 employees. Yes, that’s hundreds of thousands of employees and they haven’t figured out how to provide support when their “bots”, which is really their outsourced India techs that cancel their corporate customer accounts on a whim.
Again, this is Google, that distributes malware on their Google Store for months and years at at a time.
Seriously, the ridiculous interview bullshit we’ve all heard about regarding Google and not one smart person ever recommended taking some of Google’s billions and offering customer service or figuring out how not to distribute malware through their official store.
We shouldn’t forget that Google engineers that have access to everyone’s email have also been caught and it’s only a matter of time before Google gets hacked in the same ways Twitter has.
Anyways, Twitter is a cesspool.
Google is also a cesspool that can’t even get search right these days.
It’s a shame that America has these joke of companies on its soil.
There is a healthy contingency of Google and Twitter employees on HN, so I expect the down votes. However, I know there are a ton of people out there that share my message.
How is this acceptable? That's practically (thus effectively) identity theft.
I personally saw one of the official @elonmusk scam tweets earlier this week.
It doesn't help that Twitter's own CEO legitimises and normalises "twitter giveaway bonanza" tweets with his own Square Cash giveaways.
If access were being sold via message board, I wonder if the thread contains stipulations on which accounts are off-limits for being hacked. My theory to why we didn't see any active government officials accounts get pranked is because the hackers, no matter how confident they were about covering their tracks, still might have worried that such a breach would almost guarantee FBI/NSA-level involvement.
"U.S. FBI is leading an inquiry into the Twitter hack, sources say"
https://www.reuters.com/article/us-twitter-cyber-fbi-exclusi...
I'd bet a lot of money the inclusion of people like Obama and Biden all but guaranteed the FBI/NSA get involved now, or at the very least the Secret Service.
That might be a fairy tale some black hats tell themselves, but it seems clear to me that compromising a former president's accounts has serious security implications for the US govt. Obama's access to information (both past and present) is such an overriding concern that his level of perceived power is basically an after-thought.
The FBI often helps out with major breaches of all varieties, let alone ones that involve former heads of state. It's extremely unlikely they're not already involved in this one.
This could be mostly the attackers’ own money. It’s impossible to tell, but I haven’t seen anyone explicitly mention this.
On the other hand, they can’t really do that. At that point the attackers would be able to poison any wallet just by sending a small amount of BTC to it. Therefore it seems like the only penalty is that they’d have to re-wash their coins.
I'd be surprised if there was any followup blocking on this wallet. It might just be set as super high-taint wallet.
But I don't know nearly enough crypto to even guess at whether or not this is a really stupid idea. Don't torch me for being foolish.
And attackers like the one in the twitter attack would just choose to use cryptocurrencies where this isn't possible.
Bold move to trust the "twitter stream" in the middle of an impersonation hack.
But a lot of those transactions will be from people who enjoyed the hack and want to reward the hacker for their work.
https://news.ycombinator.com/item?id=23860584
"No, you couldn't have made more money than the Twitter hacker" https://fortenf.org/e/security/2020/07/15/twitter-hack.html
But really, my point is that pulling off a sophisticated exploit involving major celebrities, politicians and CEOs, social engineering/bribery, internal access at a top company etc. doesn't really seem worth the risk if at the end it nets you $100K.
Yes, but you'd need to open one worth $1m to make $100k on a 10% move. $1m is still not "much" in the grand scheme of things, but it's still significant.
If you have a million to play with you could probably get something on the order of 10-20million or a lot more I guess depending on time you have to prepare
Not on it's own, and not if you're starting the investigation with a large pool of trade data
But if you have 5, 10 or even 100 suspects from various forums and then join in any trading data along with a time window of opening/closing trades you very quickly end up with a suspect, a search warrant, an indictment, etc.
Post deep fake from Gates account saying that he did create coronavirus and he’s going to release the antidote. No masks needed. Open the country up.
The chaos and distrust alone would be worth more than 100k.
"You can update the email address of any Twitter user, [...] without sending any kind of notification to the user" sounds like a bug, but if your repro starts with "get access to the internal dashboard" it'll get rejected out of hand.
No 2FA, just pure and simple hardware token that's chap and easily accessible.
Discord wants my phone number for forums about sexual topics that could get me killed if I was in certain countries. Obviously I don't want to give them something which actually identifies me.
function adminPanelShow()
{
if ( !isInOurVPN() )
throw logSecurityBreach();
if ( !isLoggedIn() )
throw logSecurityBreach();
slackSecurityChannel("AdminPanel Access: " + userName);
...
}Nobody mentioned indieweb.org/POSSE yet as a way to mitigate such?
Likewise, it's not a bitcoin scam when bitcoin is the method of transfer, just like it's not a US-dollar scam every other time dollars are used in theft.
Social engineering is when your target is unaware that what he does is wrong or will do damage.
You mean electronic us dollars? I doubt you'd be able to recover physical us dollars if they were scammed.
Opening a CMD and executing an "echo YOU HAVE VIRUSES", or repeatedly executing TREE command, are used in practice to bait people into paying for "malware removal" and "anti-hacker protection".
I think simple account takeovers started being called "hacks" jokingly on Facebook, when a friend would find your phone or computer unlocked and logged in.