If the hacker regularly does black hat stuff (and perhaps used black hat methods to obtain this access), they risk criminal prosecution by going through the official channel.

Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out. Not surprising to me that they'd cash out in this manner - especially if they got access via a token which expires: they wouldn't have much time to plot on how to monetize the access.

I suspect this was a small operation - a national intelligence organization could have caused orders of magnitude more havoc with this sort of access. Smaller groups don't have the infrastructure to capitalize on such chaos.

> Bug bounty programs typically have stringent rules, disqualify many valid reports, and take a long time to pay out.

When they pay out. Some will even fix the bug, and just tell you "thanks, but it wasn't a security bug"

Happened to me in a minor way with ASCII chat characters running down the search engine results page into other results.

I reported that you could use this to basically block out the serp and they said it wasn't a bug then fixed it.. I was hoping for a t shirt at least..

Now I wished I would've abused it and blogged about it for the resume.

I found a bug (not security bug) in an apparel companies website allowing unlimited reuse of their £10 of vouchers. I reported and got a free t-shirt :)

If you can exploit it to make economic damage, would that count as a security bug?

Taken to logical extreme, that would make any black PR or reputational attack a security vulnerability.

Infosec is certainly a hefty part of business continuity, but business continuity itself is a much wider topic.

I'd say it's a bug, but not a security bug.

Someone bragging about finding Zalgo in a SERP would not impress me when reading resumes.

You can still blog about it.

I agree with their assessment. No sensitive data's confidentiality or integrity was impacted, and no availability impact to users.

Their number one source of revenue (search engine results page) could be defaced.

Exactly, it's easier to sell your bug to 'mafia boy 2020' for crypto meme tokens on some shady fraduster network than it is to fit inside the scope of the bounty offer. "This exploit is out of bounds you receive nothing thanks for your time"

Or "This exploit is a duplicate report that we've known about for two years and still haven't gotten around to fixing."

No to mention in this case you’re likely giving up disclosure for under $10k before taxes

or just tell you "what bug? lol that never happened..."

Great way to alienate the hacking community. That would work only a small number of times before word spread not to bother even trying that company's disclosure program.

That's how we got here. This is the word

But is it a fact, or just rumor?

It is fairly well known that certain large companies are really stingy.

I'm not into this but once discovered a kind of security related bug (could reveal details about the composition of a password typed into a new Windows 8 password field, admittedly low value as you had to have the user type in the password and leave) and later found a more interesting issue in the way an official powershell module works with Azure Information Security that makes it possible to sneak a file through unencrypted.

On the first I got a nice thank you mail and on the last I struggled so hard to report it that I gave up.

Well, the question was why someone wouldn't use the company's disclosure program, so that's the point.

Have you ever tried to participate in a bug bounty program? I've tried a couple and the experience has been consistently disappointing, but maybe there are some better ones.

There is actually a post on Twitter from a bounty hunter who got awarded $7000 dollars or so from Twitter for ATO, and he puts that in relation now to what the adversaries are getting by exploiting things.

The point is that bounty value of critical ATO kind of vulnerabilities tend to be okay-ish, but relatively low compared to what black hats could get.

Personally, I think this was an opportunistic actor, not a persistent one with a strategic goal.

> a national intelligence organization could have caused orders of magnitude more havoc with this sort of access

It doesn't need much fantasy to cause more havoc. It was speculated in another thread, but maybe the hackers held back since the manhunt is going to be far less for a 'harmless' Bitcoin scam rather than i.e. crashing $TSLA or declaring a war.

Exactly, this was the bug bounty

100k USD? Twitter's payouts aren't that impressive, <10k for account takeovers: https://hackerone.com/twitter

The income tax on that bounty would halve its value compared to Bitcoin, if they have a way to cash out that isn’t reported.

Also for example, if they’re a US student, they could lose access to benefits and loans as a result of reporting the income.

They might have expected to get more than 150k USD from the scam.

Maybe if it was the first time the scam appeared, but this is old hat now. This was possibly thrown together quickly to make the most of an explot before the API changed. Prior to this there is no reason to assume they were not very careful with access and this was not the main money making part of the job.

they got btc, not usd.

Yea they got a lot of btc

> Why not just go for 100k USD bug bounty, completely legal and with fame?

Not everyone believes that the existence of Twitter, in its current state as an amplification medium for the ever increasing polarisation in this world, is actually a force of good.

Helping them out with a security report might be the last thing on their mind.

True, though I’d take amplified polarization any day over what Facebook and YouTube have done for years steering vulnerable people to conspiracy content.

We can argue about which is worse, but let's agree they're all bad :)

Reporting that social engineering would allow to take over the admin panel might not lead to any pay out at all.

Hackerone has non-technical people screening your exploits. They will often mark them as out of scope.

Companies will routinely downgrade the severity of your exploit so they can pay you less.

I've had enough repeated bad interactions through Hackerone that I will go full disclosure on any company that offers it as the only disclosure channel.

(If Hackerone wants to fix that: enable easy, on-platform disclosure unconditionally after 30 days. Right now, the platform is just used to pressure people into delaying disclosure or not disclosing at all.)

I would bet the attacker(s) is/are reading this thread, curious about this community's reaction on the attack and having a good laugh.

I would've guessed they would've raised more, maybe they thought so too.

How much do you think Trump's DMs are worth? Kanye's? Elon's?

Maybe Trump was protected, his tweets can certainly move markets. And while it's possible to track investments in smaller stocks, someone buying futures or ETFs on large indices to profit from that would likely be able to stay anonymous. There are way too many trades in S&P500 on a given day to find the one that sticks out.

Then that begs the following questions...

Are Twitter protecting "even higher" profile accounts? Why do they put more effort into protecting these "even higher" profile accounts? And how do they protect these accounts? And if that really is the case, and this product feature is outed during this election campaign year, then Twitter deserve a court summons.

I seriously doubt Trump's account would, or should have that much more protection than other high profile, verified accounts.

You're probably getting downvoted because of the tone you used, but I think there's a good point hidden underneath.

Trump's account is probably specially marked for two- or even three-person lock, to prevent "rogue account termination" as has already happened. So the questions quickly turn to odd angles: how many other high-profile, politically (and/or economically) influencal accounts are equally protected? What criteria are used to assign the account this level of protection? Should this kind of account lock mechanism be more widely available? If yes, to whom?

I personally suspect that Twitter will eventually have to follow Google's route for high-profile accounts and identity management in general.[0] If people are using Twitter as their personal press office, the company has no choice but to accommodate.

0: https://landing.google.com/advancedprotection/

That was the point really. Was trying to post objectively, tbh. Didn't realise it might be seen as snarky, or anything of the like. I really did wonder what it might mean, if Trump's Twitter account was subject to extra protection.

If that's proven to be the case, that in itself is quite a big issue. Biden, as a leading political rival absolutely should have a right to similar protections if they exist.

Indeed, as a democracy, anyone should have access to the same level of protection. Or at the very least, all verified accounts.

That page looks nothing like the kind of security measures you're talking about. It's for people who care about good opsec, who carry around hardware keys, and think 2FA isn't just a good idea, it's a necessity. But what you really need is someone to stop the takeover of high-profile accounts run by people who pick the worst possible passwords: https://www.theverge.com/tldr/2018/10/11/17964848/kanye-west...

Right, good point. I'm relying on my memory here, but when the advanced protection program was first launched, I recall that one of the benefits of it for journalists and high-risk individuals was that changing recovery options (email address, phone number) would have always required a manual review and a confirmation round by someone at Google.

I do think that Google should subject passwords for accounts in the program to HIBP checks. By this point every major browser provides at least some kind of password manager functionality. It'll probably never be the same quality as a stand-alone, fully focused password manager product, but it must be an improvement over forcing to memorise passwords.

Pros: no taxes

Cons: trying to deal with 103k in bitcoin

The market cap for Bitcoin is about $170 billion; 103k in Bitcoin would be a blip in the scheme of things.

Someone moved $1 billion nearly a year ago and I don’t believe we know who made it: https://arstechnica.com/tech-policy/2019/09/someone-moved-1-...

Finding a buyer is not the problem, the problem is the buyer finding you.

Sell $200 worth a pop on LocalBitcoin.

very time consuming and risky in its own (robbery, state eventually finding out one way or another etc)

Lots of little transactions, too. Easy to hide in the noise, at least at first, but when you start throwing out tons and tons of small transactions they can start with the pattern recognition.

Still easily traceable.

Some men aren’t looking for anything logical.