News for hackers. Stuff that matters.

A comment on Twitter Hacked – 250,000 User Accounts Potentially Compromised. Parent comment

Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by taligent on Friday February 01, 2013 @08:18PM (#5154660)
Issue is that you don't know which of the tens of thousands of internal IP addresses would correspond to the one or two sysadmins who would have production access.

Which means either the production servers were hacked or there was a widespread compromise of their internal network and systems e.g. email, IM.

[ Parent | on HN ]
Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by 0x0 on Friday February 01, 2013 @08:28PM (#5154691)
I'm sure more than 2 people at twitter have production access.

And identifying the senior staff isn't probably that hard, they probably have quite visible twitter accounts.

As someone mentioned in a completely different thread, it'd be enough to have a vulnerable rails running on localhost:3000 on your laptop and "accidentally" being hit with a CSRF, for example.

Get a shell on some staffers laptop and stay dormant, I'm sure you'll catch a live ssh session soon enough [with access to that ssh client's process memory] (in fact you'd get quite far just with a copy of the id_rsa + known_hosts files)

[ Parent | on HN ]
Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by mikegioia on Friday February 01, 2013 @11:12PM (#5155125)
Yea you really only need the contents of ~/.ssh and you could access every server the laptop could.

Even if they didn't have production access, a lot of times servers are configured to easily hop from one to another. They could have connected to a development server and then just hopped to the DB server with the accounts it seems they were looking for.

[ Parent | on HN ]
Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by knweiss on Saturday February 02, 2013 @05:05PM (#5157555)
That's why you should use ssh-agent and protect your private key with a passphrase.
[ Parent | on HN ]
Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by 0x0 on Saturday February 02, 2013 @05:43PM (#5157692)
It's useful, but if an attacker got a shell on the dev laptop, I assume he could just coredump the ssh-agent process and steal the unlocked key from there.
[ Parent | on HN ]