Re:July 15 Twitter Attacks
by motohagiography on Friday July 17, 2020 @01:08PM
(#23872805)
The attacks as described forfeited a giant amount of leverage. It was like breaching a bank vault and just stealing some rolls of coins. By doing something high profile, the attackers gave up any shot at persistence inside the infrastructure, and didn't even show any forethought on political options. It's like some employee's kid using their parents device got hacked by his schoolmates. However, we can probably surmise that if people this dumb are inside the platform, smarter attackers are in there too.
[ Parent
| on HN ]
Re:July 15 Twitter Attacks
by lliamander on Friday July 17, 2020 @01:19PM
(#23872952)
I think the real purpose had to do with capturing the DMs of high-profile people for blackmail or other nefarious purposes.
Do people actually use DMs on Twitter for anything?
I'm reasonably active on Twitter, but I'm not famous and don't have a ton of followers. Are DMs a common method of communication for high profile accounts?
I'd suspect not (since I'd think most high profile accounts have people that run them).
I'd guess the simple (dumb) explanation for this hack is probably the true one.
But if that was your goal, why wouldn't you just remain silent and allow your targets to continue to use the platform? Presumably a live data feed is strictly better than one than one that immediately dries up.
The attack requires changing the email and disabling mfa, the target and Twitter would know pretty quickly. You also have no way to prove to outside parties that you actually had control the account afterwards. This way there is trivial proof that you had control of the account by simply sending some btc from the address.
They got their access by changing email addresses and disabling 2FA. There was no way to remain undetected.
That makes more sense and this way they can prove at least prove they have the bitcoin private keys. Reduces some of the deniability that the DMs were faked.
Re:July 15 Twitter Attacks
by AnimalMuppet on Friday July 17, 2020 @01:31PM
(#23873113)
If I understand correctly, the real users were locked out. Doesn't that mean that they couldn't send DMs?
Now, sure, you could gain access earlier, capture DMs for a while, then lock out the real users, post the bitcoin scam messages, collect what you can in bitcoin, and still have the captured DMs as your real haul from the attack.
Re:July 15 Twitter Attacks
by EForEndeavour on Friday July 17, 2020 @01:38PM
(#23873201)
I'm assuming your second scenario is what went down: gain access to target accounts, export DMs, then execute the public bitcoin scam as proof of work.
Yeah, what ppl mean by collecting DMs is getting copies of years' worth of private conversations that the accounts likely engaged in over Twitter DMs (not so much about continued surveiling of new DMs)
You don't have to have the actual DMs. You can make shit up and claim the source is this attack.
Re:July 15 Twitter Attacks
by ASalazarMX on Friday July 17, 2020 @07:48PM
(#23877423)
Unless they can prove control of the bitcoin wallet used for the attack, or show a portion of the DMs, no one will take them seriously.
Re:July 15 Twitter Attacks
by raverbashing on Friday July 17, 2020 @01:31PM
(#23873127)
And then you're forfeiting access by "burning that bridge"?
I think they would just keep it for as long as they could. You set an app (a token) on the account and just ride with it
High chance it would be detected and blocked. The hack involved changing the email, disabling mfa and locking the user out. You can change the email back but their password and mfa would still be gone. They'd also get an email notifying them of the change. For professionally managed accounts that's going to be an instant red flag.
Then you have no proof you ever had access to the account.
I thought yesterday that perhaps the attackers were burning an exploit they had. This makes sense only if that exploit would have been going away with the introduction of the new Twitter API, or something. Obviously this is ruled out due to what we know now.