News for hackers. Stuff that matters.

A comment on An incident impacting 5M accounts and private information on Twitter. Parent comment

Re:An incident impacting 5M accounts and private information... by drusepth on Tuesday August 09, 2022 @02:35PM (#32402008)
It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account.

Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total accounts (~290M). I don't know what the industry average is for linking phone numbers, but this seems like an exceptionally low ratio.

[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by munchler on Tuesday August 09, 2022 @03:48PM (#32403249)
5,000,000 seconds is about two months. The attackers simply might not have had enough time to check more numbers than that.

(Assumption: They were checking only one number per second, either to avoid detection or because they were rate-limited.)

[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by onionisafruit on Wednesday August 10, 2022 @12:31AM (#32407877)
What percent of mobile numbers do you think are associated with twitter accounts? I don’t know, but it wouldn’t surprise me to find out they had to try 500M or more numbers to find 5M accounts.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by herbst on Wednesday August 10, 2022 @03:59AM (#32409007)
We'd need to actually test it. But I believe the finding ratio would be even lower than 1 in 100.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by rolivercoffee on Thursday August 11, 2022 @07:53AM (#32424315)
As of Dec 2020 only 2.3% of active accounts had any form of 2FA enabled [1]

[1] https://www.bleepingcomputer.com/news/security/twitter-revea...

[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by junon on Tuesday August 09, 2022 @03:05PM (#32402477)
Phone numbers in the US. In other parts of the world, they're longer.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by fy20 on Tuesday August 09, 2022 @10:38PM (#32407317)
International phone numbers can be up to 15 digits, but in most places the rules narrow them down further.

For example in the UK the country code is 44, all mobile phone numbers start with 7, with 9 digits after that.

[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by knolan on Tuesday August 09, 2022 @05:17PM (#32404454)
And all US numbers begin with 555, or so I’m lead to believe.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by midoridensha on Wednesday August 10, 2022 @12:16AM (#32407802)
It's absolutely true. All US numbers are 555-xxxx. You can see this in any US movie or TV show, which we know to be very accurate.

Similarly, any time an American car has a fender-bender, or at least one of its wheels leaves the ground, it explodes in a massive fireball.

[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by martin_a on Wednesday August 10, 2022 @05:25AM (#32409522)
That's what's really holding me back from getting an American car. Just fearing that somebody might hit my car and then it's over.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by macksd on Wednesday August 10, 2022 @10:27AM (#32412562)
Independent of Hollywood, some American cars just might do that. Maybe not in such an impressive manner, but I've been through so many Dodge transmissions and Ford's reputation here is even worse.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by 867-5309 on Wednesday August 10, 2022 @03:48AM (#32408923)
joking aside, the 5M figure probably came from targeting like this, such as choosing a few area codes with high tech populations and testing the ~10M phone numbers for each area
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by newsclues on Tuesday August 09, 2022 @04:13PM (#32403608)
Us and Canada, remember we (Canada)helped invent the phone systems
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by junon on Wednesday August 10, 2022 @09:20AM (#32411440)
So?
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by cdash on Tuesday August 09, 2022 @02:45PM (#32402154)
Maybe Musk is right, they are all bots.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by suction on Tuesday August 09, 2022 @03:15PM (#32402665)
Maybe Musk is behind this to weasel out of the contract?
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by FBISurveillance on Wednesday August 10, 2022 @01:13AM (#32408037)
Yes he certainly is; he also reported it afterwards via HackerOne to get that $5k bounty. Two birds one stone.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by ReadTheLicense on Thursday August 11, 2022 @09:32AM (#32425294)
If Musk is right, it's not weaseling out of contract.
[ Parent | on HN ]