Comment by paulpauper | Hacker News Reader

Comment by paulpauper | Hacker News Reader

Parent Full thread

>> Also, it seems clear that this Twitter hack could have let the attackers view the direct messages of anyone on Twitter, information that is difficult to put a price on but which nevertheless would be of great interest to a variety of parties, from nation states to corporate spies and blackmailers.

It is not as much money as pundits probably think it is worth. And also, trying to negotiate a blackmail is time consuming and opens the risk of being caught especially if it a high profile target, with no guarantee of being paid. Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating? Paying off a blackmailer is an admission of guilt and does no good if the info is released anyway.

It also depends on how sophisticated the thief was. Did he have everything automated to dump anything everything from the inboxes while automating the posting of the spam tweets, or was he frantically doing all his postings by hand before twitter could shut it down. If the thief is not sophisticated his main priority would probably be making as much money as possible with the posts and ignore the private messages

> Do you really think someone like elon musk will pay a bitcoin ransom

A somewhat odd blog post by Jeff Bezos about blackmail from last year is quite interesting in this context. [1]

[1] https://medium.com/@jeffreypbezos/no-thank-you-mr-pecker-146...

They grossly overestimated their leverage in that story though.

Anything illegal might've been actually good for black mail purposes, but dick pics? As if someone would actually look for that or even take a business decision based on that.

Dick pics are what lead a candidate for Paris Mayor election to resign this year. It is a powerful item against some people.

Indeed, it's a powerful weapon against anyone who depends on general public popularity for their power (for example many/most elected officials). This is in fact one of the things that is highly investigated for getting TS/SCI US government clearance. They don't want to employ anyone who possibly has dirt against them in the open.

For a public official I can see why it would give them some leverage, but Jeff Bezos/Elon Musk/any rich dude doesn't really have to care. Did the "fappening" damage anyone's career?

> Do you really think someone like elon musk will pay a bitcoin ransom assuming there is anything incriminating?

Maybe? I mean I certainly don't dismiss the idea out of hand. The one strong counter-argument I can think of is that very few things would actually embarrass Musk at this point.

Yeah, Musk specifically doesn't feel likely to care, perhaps if we assume someone else, who is less, shall we say, favorable to controversy?

Dude seems to devoted to his workaholic persona to leave much time for dick pics.

The thief did not appear to be too sophisticated. Obviously sophisticated enough to pull off the twitter hack, but we don't really know how much sophistication that required just yet (the exploit may have been trivial). But, they didn't disseminate this message anywhere other than twitter? That seems very shortsighted.

They used different approaches on different twitter accounts, some suggested a coin return, others suggested a charitable donation match, etc. But, they all used the same bitcoin address. If they were sophisticated, they would have used a different bitcoin address for each to evaluate the more profitable messages for a future scam.

My guess was frantic copy pasta. Since the reset password emails went to both him and the OG twitter user. Plus wouldn’t you need an API key per user and set that all up? I think that takes more time than spamming a tweet.

You don't need API's if you just use the web interface. Headless chrome would be a seriously easy way to automate this without having to mess with API keys.

True. Considering the level of access the hackers have gained, a case can be made that the attackers themselves fabricated the content in these user accounts.

Reply on news.ycombinator.com