Hackers tell the story of the Twitter attack from the inside

Re:Hackers tell the story of the Twitter attack from the inside by rosywoozlechan on Friday July 17, 2020 @06:38PM (#23876806)

So a kid got access to the keys to the kingdom at Twitter by social engineering their way into Twitter's internal Slack. That sounds like crazy irresponsible use of sharing privileged access information in Twitter's internal processes. That could be career ending for someone. Just someone on Twitter's slack, lurking there, seeing passwords and services and being able to access them without an employee account or some kind of sane security process? Huh?

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by panarky on Friday July 17, 2020 @06:47PM (#23876897)

So Twitter's admin panel just takes a username and password, no 2FA, no device authentication??

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by GycDH6mb on Friday July 17, 2020 @08:18PM (#23877660)

Or even IP firewall? Hell, our admin panel can't be accessed outside of our physical office, save for VPN.

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by comex on Saturday July 18, 2020 @01:04AM (#23879110)

I’m pretty sure Twitter is still (mostly) working from home like all the other tech companies in the area, so a physical proximity requirement is out. A VPN requirement could work; in theory there’s no reason a VPN login is any more inherently secure than the login to whatever admin panel they’re using, but in practice VPNs can help centralize security policies across many applications. (I have no idea what Twitter’s systems look like, though.)

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by tjohns on Saturday July 18, 2020 @01:11AM (#23879144)

> there’s no reason a VPN login is any more inherently secure than the login to whatever admin panel they’re using

VPN credentials can also be tied to a device certificate, which can be securely stored in the machine’s TPM.

This prevents VPN login from anything except a company issued machine. You don’t get this with normal password auth.

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by _kbh_ on Saturday July 18, 2020 @04:25AM (#23879960)

People are generally far less likely to give out credentials to their VPN or personal accounts than they are to give out passwords to a random application. Additionally requiring a VPN increases the barrier to entry to accessing the application as you could have additional requirements to a VPN (such as a 2FA and device certificate).

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by jbob2000 on Friday July 17, 2020 @07:41PM (#23877358)

Management never wants to invest in the tooling

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by taytus on Friday July 17, 2020 @09:16PM (#23878045)

I get that. Everybody reading this gets that. The thing is thou, that this is not tooling. This is 101 of BASIC security practices.

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by toomuchtodo on Sunday July 19, 2020 @10:04PM (#23894060)

Most businesses survive opsec 101 failures with minimal cost. Equifax is still in business, for example.

Practitioners take issue with these gross failings, but the markets and regulators seem to not care in the slightest. Disheartening to say the least, yet the reality of the situation.

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by dkubb on Friday July 17, 2020 @08:07PM (#23877574)

This also means that if you want to break into twitter all you need to do is break into slack.

[ Parent | on HN ]

Re:Hackers tell the story of the Twitter attack from the inside by megablast on Friday July 17, 2020 @08:11PM (#23877602)

And 1000s of other companies.

[ Parent | on HN ]