News for hackers. Stuff that matters.

A comment on More than 1k people at Twitter had ability to aid hack of accounts. Parent comment

Re:More than 1k people at Twitter had ability to aid hack of... by manigandham on Thursday July 23, 2020 @09:41PM (#23934799)
There's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then they already have everything.

The reset via admin tools must have bypassed the normal email workflow.

[ Parent | on HN ]
Re:More than 1k people at Twitter had ability to aid hack of... by SifJar on Friday July 24, 2020 @02:24AM (#23936402)
Admin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
[ Parent | on HN ]
Re:More than 1k people at Twitter had ability to aid hack of... by manigandham on Friday July 24, 2020 @11:11AM (#23940413)
Then that's the vulnerable bypass.

Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.

[ Parent | on HN ]