Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

With so many accounts compromised, the hackers might actually have full access to Twitter's backend. The postmortem would be very interesting. I'll be looking forward to it.

Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!



If they had full access to Twitter’s backend, they probably would be tweeting from accounts like @POTUS or @jack. But this seems like they have access to limited accounts. Most likely gained access to a third party service that allows you to manage your tweets?

Edit: they tweeted from the twitter support account. Just wow. They might have actually gotten into Twitter’s systems.

Edit 2: To expand on my edit above, I saw multiple tweets from other accounts that showed a screenshot of the scam tweet originating from the twitter support account. I’m not sure if it’s real or not, since they keep deleting the tweets. If it is real that would definitely open doors to more theories.

Edit 3: Seems like the twitter support account was a joke. Impossible to tell with everything going on!


You say they'd target POTUS but of the very high profile accounts it's so far billionaires, corporations and democrat politicians. Does make you wonder.


The POTUS account likely has more additional security than normal accounts.


Not sure why you are being downvoted given that this is probably correct? Sounds like the attack was through an admin portal. Given that Trump was one of the few high profile accounts not targeted, it seems like the attackers were not able to access his account through that portal. And his Twitter has been attacked by employees before so Twitter probably locked it down so employees can't modify it.


Or whoever did this didn’t want to draw a terrorism charge if they got caught and just wanted to keep it limited to wire fraud.


Could you elaborate on twitter employees attacking his account? This is the first time I read about that.



Oh, I thought you meant defacing his account or something. It "just" being deleted didn't quite register as an attack for me.


Like what?


Maybe not everybody with internal tools can mess with it. Because somebody with internal tools already messed with it before and it didn't look very well for twitter. So if there's anybody with brains there they probably made some measures so it won't happen again.


The account was vandalized in the past by a rogue employee, they probably added more controls since then.


I'm constantly amazed that people who are critical of billionaires and corporations, never wonder why billionaires and corporations are usually democrat supporters.


> I'm constantly amazed that people who are critical of billionaires and corporations, never wonder why billionaires and corporations are usually democrat supporters.

Most billionaires and large corporations have connections in, and make donations to, both major parties. The people who are critical of billionaires and corporations tend to also be the people that point out that the dominant faction of the Democratic Party (less sophisticated members of the critical group will shorten this to just the Democratic Party, without making the factional distinction) has for decades been, in economic policy terms, a center-right pro-corporate neoliberal group, not a progressive one.


I'm pretty sure most billionaires support the GOP. I don't have a citation. But neither did you. Let's not turn HN into a hodgepodge of wild unbacked claims. That's what reddit is for.


1. Most want cheap foreign labour via H1b Visas which is currently more of a democrat thing (it's republican thing too but Trump is avoiding that right now). They claim they like diversity but it's actually just importing H1B visas who basically get exploited by the companies because if they don't over perform, then they don't get promoted and therefore get fired leading them to get deported back. This is also why these companies have the "get promoted every 1-2 years or you are fired".

2. Most don't publicly support GOP because they don't want to get cancelled.

PREFERENCE FALSIFICATION: Preference falsification is the act of misrepresenting one’s wants under perceived social pressures.


Gates, Bezos, Zucckerburg, etc. etc. I was talking mostly about tech billionaires, should've made that clearer.


Bezos is a conservative. Amazon as a company is also conservative-leaning. If you look at Amazon's PAC, most of their donations go to the GOP.


Well that's wrong too.

I'm not sure the FB counts as democratic. At best he's big shades of gray with contradicting indications.

Out of the top four richest tech billionaires, according to forbes, only one of them is not most likely conservative and that one tries to stay out of politics, i.e. bill gates.

The next two have clear conservative leanings or contradicting indications, i.e. Bezos and Zuck.

Number four is Larry Ellison, who recently hosted a trump fundraiser. Well here is what wikipedia has on him:

Politics

Ellison was critical of NSA whistle-blower Edward Snowden, saying that "Snowden had yet to identify a single person who had been 'wrongly injured' by the NSA's data collection".[85] He has donated to both Democratic and Republican politicians,[86] and in late 2014 hosted Republican Senator Rand Paul at a fundraiser at his home.[87][88]

Ellison was one of the top donors to Conservative Solutions PAC, a super PAC supporting Marco Rubio's 2016 presidential bid. As of February 2016, Ellison had given $4 million overall to the PAC.[89] In 2020, Ellison hosted a fundraiser for Donald Trump at his Rancho Mirage estate.[90][91]


That's an amazing stack of assertions you have there.


Full stack


Simple, billionaires are usually Democratic because they tend to come from liberal backgrounds in liberal areas: Zuckerberg, Gates, or anyone who's come up through universities recently is younger and thus more Democratic leaning. It's really a case of demographics.


I think that they just like to be alive, so they avoided hacking POTUS or other countries Presidents/PMs.


Can you clarify your edit? All I see is this tweet (https://twitter.com/TwitterSupport/status/128351803844522393...) which reads

We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly.

Are you implying that this was tweeted by the attackers? or something else?


I edited my comment, but basically I saw tweets that showed a screenshot of the scam tweet from the twitter support account. Not sure if it’s real since they delete the scam tweets.


That was a joke.


Ah alright, really impossible to tell with everything going on!


The Twitter backend is probably heavily sprinkled with statements like `account_handle match { case "therealdonaldtrump" => throw new TrumpNotAllowedException("can't do"); }`

Especially after the last insider account tampering event.


I do think it's odd that so many prominent accounts were hit but not Trump's. I remember there was an incident a couple years ago that a trust and safety employee at Twitter suspended Trump's account on their last day. It's very likely that after that incident, special guards were set in place to prevent admin tools from messing with Trump's account. This would align with speculation that this hack targeted an internal employee admin tool.


Maybe they're POTUS fans ;)


If they target @POTUS, I believe they'd be guilty of impersonating an elected official, which would make this an even more serious crime? I dunno


They hack thousands of accounts and make national news, I doubt they are that worried. They probably just don't have access or they would have.


Donald Trump was Tweeting in Farsi earlier, I was seriously on the fence about whether that was a genuine tweet.


"3 people have been sentenced to death for participating in demonstrations. They could be subject to execution at any moment. This sends a deplorable message to the world and should not occur. #dont_execute"

[edit: not sure why this is getting so much silent attention. It is a literal translation of the tweet referenced in OP.]


Totally agree, backend - Musk's tweets being deleted and popping up again before our eyes was a dead giveaway.

It could be SQL injection writing tweets directly to the database for all we know.

I agree with everyone else saying the site should be pulled. Incredibly sketchy.


Write through caches would need to send the tweets through the normal channels for them to 'fan out' instead of writing directly to MySQL. But essentially what you're saying about possible backend compromise.


It "feels" like an insider attack (simultaneous compromise of lots of high value accounts) but I agree, it will make for a fascinating post mortem if one is produced.


And now this : A Twitter insider was responsible for a wave of high profile account takeovers on Wednesday, according to leaked screenshots obtained by Motherboard and two sources who took over accounts.

From - https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...


Hmm, how much money this scam would potentially generates? I think the salary of an engineer working on twitter would be higher given how fast this scam would be shut down. Would a twitter employee risk their career to this scam?


If you can't get caught, it's just some free money... depends on moral compass...

Maybe we'll get a leetcode question out of it, how much should you risk your career for after taking a job at a FAANG?


More than 130k, that's for sure. It would have to be orders of magnitude larger.


That would be hilarious and full of irony.

Given that most FANGers are obsessed with cash, I'm pretty sure they'd say "yes" to risking their career for some sweet BTC.


I would be surprised if it were an engineer, but not everyone who is employed would be an engineer. When I was at Google two fairly high profile incidents were enacted by contractors (one in the IT "TechStop" group and one a data center tech)


It might as well be an employee whose devices were compromised.


There is no way Twitter depends on Github CI/CD to push updates. I refuse to believe this.


If they did, they would be running the self hosted option.


That twitter buildspec.yml must be HUGE!


And it seems that it's still compromised. Tweets get deleted and then they re-appear.


30 minutes later and it still happens, just after "Elon" posted a normal message. Hopefully most users have caught on to the scam by now.


Crazy twitter can’t pin a warning to everyone’s feed... or just kill the site.


they have killed tweeting from verified accounts and also blocking tweeting that BTC address to mitigate the damage.


> All Bitcoin sent to my address below will be sent back doubled. If you send $1,000, I will send back $2,000!

> Only doing this for the next 30 minutes! Enjoy.

No, it's hacker's doing, they need to keep timestamps updated


It may be that the github outage is related. Too many companies rely on 3rd party hosted services for their deployment workflow. Even ones you really would not expect.


> Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

Imagine that. At that point it would be more secure to self-host the code off of GitHub to push that critical fix Twitter sorely needs right now.

Its still on going as we type.


> ... and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

I sincerely doubt Twitter depends on github.com. Github's enterprise version runs on your own infra, self-managed, and if Twitter uses GH at all, that'd be the version they use.


boy I sure hope we get a juicy post mortem, this is quite a scam


I don’t think I’ve ever looked forwards to a postmortem so much, so many possibilities.


Twitter hasn't released postmortems for other incidents, so I wouldn't hold out hope


I'm just glad the fallout from this isn't nuclear, to be honest.


and yet lots of technical type Twitter personalities tweeting like each individual user got popped. "OMG THEY GOT MR BEAST!" No, they got twitter. I mean its possible, we do not know, but this "They GOT so and so" thing is annoying at this point.


Twitter almost certainly self-hosts GitHub, no?


Don't know, but current corporate dogma is to not host anything, including using third party auth provider which is like giving away their customer list.


Many larger corporations have strict rules on keeping things like their source code in-house, so that means no external services for code reviews or CI, etc.


> current corporate dogma is to not host anything

Do you mean that they prefer using managed services? Or do you mean that the services managed by their internal IT utlize AWS/etc for servers as opposed to on premises.


They prefer to use managed services through third parties. Even to their detriment as those third parties basically own their customer lists. If for instance the auth provider goes out of businesses the business would end. Same with code, most new companies are using something like gitlab or github. But it's not as dangerous as many people will have a copy of the source code cloned.


The former. It’s pretty insane.

Like you are able to launch Adobe Photoshop because Okta says so. :)


I wonder if this is hack in the sense that the account passwords were compromised or that the system itself was compromised in a way that would allow the attacker to tweet from any account.


I'd guess that Elon's first reaction would be to change the password. Since it's still happening, it's probably back-end.


Maybe a front end/OAuth issue - those are not uncommon either. Will be interesting to learn more.

Also begs the question, who is liable in such cases....


Could be front end, since all of these cite "Twitter Web App" as the source. Never anything else (unless you're a low-follower troll).


Maybe a popular browser extension? Would explain why it seems to target tech people.


Liable for the account being compromised? Twitter. Liable for people sending money? People sending money.


How much will Twitter pay me for it's liability of my hacked account?


The same amount you pay them.


It seems like the devs at Twitter are clueless, how this happened.

The hackers could be deep in Twitters systems, eventually even have even someone working at Twitter, or it's a result of a new yet unknown password list or phishing attempt.


Just saw this https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...

Means they had someone inside Twitter.


Why can twitter staff tweet under people's accounts? How does that make sense?


Selfhost. If you rely on Github for your service you are rightfully doomed.


Twitter depends on GitHub?


Is the root cause and attack vector known?


probably a social media manager api keys


I can't see that bill gates, Elon musk and every cryptocurrency channel using the same manager. This looks like something closer to a Twitter hack than an intermediary, especially with the the reposting after deletion.


No way, it's way too widepread and would be shut down by now.

Elon Musk, Barack Obama and Wiz Khalifa just tweeted the scam again this very minute, more than an hour since it started. This is backend access, Twitter can't figure out how to shut it down.


They could have shut these bitcoin giveaway scams down with a single regex a year ago when they first showed up. They let them go and this is the price they will pay. Let's see if someone is going to sue Twitter because 'verified' to be Bill Gates is meaningless now.


This is much, much worse than a typical Bitcoin scam.


It has the same textual footprint. These tweets should be quarantined automatically until expressly checked by a human being.


But when you post a tweet via api, the tweet will include the app's name at the bottom? The screenshot in the article has "Twitter Web App" at the bottom.


Its not hard to believe that a group with the ability to hijack the twitter accounts of some of the world's most influential people could also hijack the "posted by" metadata.


I guess the previous post was seen as a argument against compromised API keys.


right, it's not only compromised API keys, but it could be that with something else.


Do that many accounts use the same social media manager?


I think many people have try several of them before settling on one for their use case, and don't revoke the OAuth.


I know hootsuite is a very popular app for managing the social media accounts.


And their status page shows their integration with Twitter is having issues now https://web.archive.org/web/20200716000356/https://status.ho...


> Imagine if the hackers timed the intrusion during github outage, and twitter's employees can't deploy a fix for the exploit fast enough because github was down!

Is Twitter really using GitHub internally (even self-hosted)?


Is there even a self hosted Github? AFAIK there is no public offering of the sort.


Github has offered this for years: https://github.com/enterprise MIT used it for a long time.


There's (was?) an on-premises enterprise version.



github enterprise i believe can be onprem


Yes, it can.


They must do some crazy code obfuscation or security though, because the source hasn't leaked.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: