Twitter internal panel linked to account hijackings

Re:Twitter internal panel linked to account hijackings by except on Wednesday July 15, 2020 @11:24PM (#23855403)

I find it hard to believe this was a Social Engineering based attack. Elon Musk’s account was accessed multiple times after their tweets being deleted and it seemed to last forever, account by account being taken over.

[ Parent | on HN ]

Re:Twitter internal panel linked to account hijackings by Element_ on Wednesday July 15, 2020 @11:37PM (#23855486)

They social engineered access to a Twitter employees internal account, not the individual end users affected.

[ Parent | on HN ]

Re:Twitter internal panel linked to account hijackings by except on Wednesday July 15, 2020 @11:43PM (#23855528)

I understand, but that sort of behaviour should have been thwarted quickly by their security team or policies setup against abuse.

[ Parent | on HN ]

Re:Twitter internal panel linked to account hijackings by Gigablah on Thursday July 16, 2020 @01:02AM (#23855930)

Yep, for one, you shouldn’t be able to just hand over your credentials to other people and they can immediately start doing stuff in your systems.

Also, the ability to impersonate people (not just celebrities) should require at least manual approvals. Not sure why this ability even exists.

The original speculation (that it was an API vulnerability) is actually easier to stomach.

[ Parent | on HN ]

Re:Twitter internal panel linked to account hijackings by agloeregrets on Thursday July 16, 2020 @06:34AM (#23857561)

The account was fully hijacked, email and password changed, 2FA was disabled. At that point the account basically belonged to someone else. I don’t think they realized the scope and angle of the attack.

[ Parent | on HN ]