News for hackers. Stuff that matters.

A comment on A Twitter app bug was used to match 17M phone numbers to user accounts. Parent comment

Re:A Twitter app bug was used to match 17M phone numbers to ... by BurningFrog on Tuesday December 24, 2019 @04:27PM (#21875022)
> they have an active infiltrator in Twitter

If I was China, I'd go for this. Twitter has thousands of employees, many of which can surely be turned with some pressure. Also many who has family in China that can be used for leverage.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by chatmasta on Tuesday December 24, 2019 @04:33PM (#21875050)
I’d have to imagine this is very common, and they’ve probably got one at all the big tech companies. It’s an underreported threat IMO. Who would say no to doubling their salary in exchange for running the occasional DB query for their home country?
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by BurningFrog on Tuesday December 24, 2019 @04:51PM (#21875141)
I expect a lot of people would say no to that and report the attempt to company security.

Of course, if I'm China, I can try it with enough people to get several assets.

Also, of the offer includes "we won't kill your grandma", uptake might be higher.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by everdev on Tuesday December 24, 2019 @05:09PM (#21875270)
> I expect a lot of people would say no to that and report the attempt to company security.

Turning someone is rarely an upfront request.

You make friends with them and make small talk about politics to see if there are any sympathies to your cause.

Ask for a small favor and see if they'll do it, then progress slowly. You only ask them to break the law once they're already on your side.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by thelittleone on Tuesday December 24, 2019 @09:18PM (#21876280)
And if a little persuasion was needed, the folder with evidence of assets secrets that would turn their life upside down if revealed. Ideally real secrets, but these days made up ones are probably as effective.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by catalogia on Wednesday December 25, 2019 @05:44AM (#21877985)
Motives for spying are varied: https://en.wikipedia.org/wiki/Motives_for_spying

> MICE: Money, Ideology, Compromise, and Ego or Extortion (depending on source)

> RASCLS: Reciprocation, Authority, Scarcity, Commitment and Consistency, Liking, and Social Proof.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by bjornjaja on Tuesday December 24, 2019 @05:17PM (#21875314)
Social engineering at its finest.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by huy-nguyen on Tuesday December 24, 2019 @07:36PM (#21875923)
Also common spy recruitment tactic.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by jdavis703 on Tuesday December 24, 2019 @05:26PM (#21875361)
Oh boy, I’d encourage you to work in government for a year or two. I did IT for a government department that eventually wound up being investigated for letting the Taliban use their equipment (all I did was help them troubleshoot run of the mill PC issues FWIW). I personally know someone who had root access to a government land auction DB. Someone asked them to run “off the book” queries in exchange for looking the other way if said DBA wanted to run their own unaudited queries.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by x0x0 on Tuesday December 24, 2019 @04:50PM (#21875135)
At competent companies -- I make no claim about Twitter here, but certainly at Google or at my employer -- it is extremely uncommon to have access to that database. All requests to access are logged and individually permissioned. Asking to access without a good reason, such as attachment to an active customer ticket, etc -- will get a hard no.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by londons_explore on Wednesday December 25, 2019 @02:49AM (#21877472)
But at the same time, there's usually a way round it. For example, break the account in some way so the user opens a ticket, then grab the ticket and dump the whole contents of the account to 'debug'.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by drevil-v2 on Wednesday December 25, 2019 @04:41AM (#21877792)
Who watches the watchers?
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by dekpmm on Tuesday December 24, 2019 @05:27PM (#21875365)
Doubling their salary? People have sold secret classified data for just thousands of dollars worth of gift cards.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by yzmtf2008 on Tuesday December 24, 2019 @06:35PM (#21875660)
At a public company like Twitter, for SOX compliance reasons, it will be very difficult to find someone that has such permissions, and running anything unusual can be easily found by auditing. I'd stop with the conspiracy theories.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by lwf on Tuesday December 24, 2019 @06:47PM (#21875705)
https://www.washingtonpost.com/national-security/former-twit...

In general, most companies want to scope SOX as narrowly as possible. So if you can, only things that your auditors think will affect revenue reporting.

Querying ads performance data? Sure, we'll SOXify it. Querying user accounts writ large? "Meh, our engineers need to be productive."

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by nl on Tuesday December 24, 2019 @07:25PM (#21875877)
SOX doesn't really stop this kind of prying, and it has happened in the past.

https://www.npr.org/2019/11/07/777352750/how-saudi-arabia-us...

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by RijilV on Tuesday December 24, 2019 @07:51PM (#21875981)
SOX is about financial compliance. It is not a computer security standard.

I’ve worked for lots of SOX companies as a third party and had root/sqlplus on most of them. There’s really to relationship between SOX and security.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by t34543 on Tuesday December 24, 2019 @06:53PM (#21875737)
There are always weaknesses and internal vulnerabilities in every system.

If it was from the inside more likely a privileged user was compromised. It could also explain why Twitter is being quiet, especially if the investigation is ongoing.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by elorant on Tuesday December 24, 2019 @08:13PM (#21876062)
Anyone who isn't stupid. Considering how may big corporations have ties with government agencies, if you try to pull something like that and you get caught you could easily be charged with espionage.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by catalogia on Wednesday December 25, 2019 @05:46AM (#21877990)
Even people with large IQs can be 'temporarily' stupid. Hence the term "lapse in judgement." Somebody who's intelligent but lets their ego run wild might believe they're too smart to get caught.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by throw653214 on Tuesday December 24, 2019 @08:18PM (#21876086)
Why go to all that trouble? Why not just send their version of a National Security Letter?
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by nl on Tuesday December 24, 2019 @07:24PM (#21875874)
That is how the Saudis did it.

https://www.npr.org/2019/11/07/777352750/how-saudi-arabia-us...

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by FDSGSG on Wednesday December 25, 2019 @11:06AM (#21879018)
Saudis and many OGUsers kids.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by angry_octet on Tuesday December 24, 2019 @08:39PM (#21876145)
Saudis are amateurs.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by angry_octet on Tuesday December 24, 2019 @08:38PM (#21876142)
It doesn't scale -- the more you do it, the more likely one of them is to squeal or be caught, then MSS would be leaking their priority target list straight to the the FBI. Instead they would carefully target people with access, but not necessarily force them to divulge information / tamper with systems except when they really need it.
[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by ljm on Tuesday December 24, 2019 @06:57PM (#21875758)
Occam's razor supports this one. Which would also bring liability to Twitter for not taking adequate steps to secure their servers.

It's not like they get l337 h4xx0rs to pwn their internal systems; they probably just have login credentials or permissions they shouldn't have, which aren't audited, and they can sneak things out in plain sight.

[ Parent | on HN ]
Re:A Twitter app bug was used to match 17M phone numbers to ... by frequentnapper on Tuesday December 24, 2019 @08:54PM (#21876204)
this begs the question: is it a security liability to hire anyone with any family in China?
[ Parent | on HN ]