Twitter Hacked – 250,000 User Accounts Potentially Compromised

Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by 0x0 on Friday February 01, 2013 @08:28PM (#5154691)

I'm sure more than 2 people at twitter have production access.

And identifying the senior staff isn't probably that hard, they probably have quite visible twitter accounts.

As someone mentioned in a completely different thread, it'd be enough to have a vulnerable rails running on localhost:3000 on your laptop and "accidentally" being hit with a CSRF, for example.

Get a shell on some staffers laptop and stay dormant, I'm sure you'll catch a live ssh session soon enough [with access to that ssh client's process memory] (in fact you'd get quite far just with a copy of the id_rsa + known_hosts files)

[ Parent | on HN ]

Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by mikegioia on Friday February 01, 2013 @11:12PM (#5155125)

Yea you really only need the contents of ~/.ssh and you could access every server the laptop could.

Even if they didn't have production access, a lot of times servers are configured to easily hop from one to another. They could have connected to a development server and then just hopped to the DB server with the accounts it seems they were looking for.

[ Parent | on HN ]

Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by knweiss on Saturday February 02, 2013 @05:05PM (#5157555)

That's why you should use ssh-agent and protect your private key with a passphrase.

[ Parent | on HN ]

Re:Twitter Hacked – 250,000 User Accounts Potentially Compro... by 0x0 on Saturday February 02, 2013 @05:43PM (#5157692)

It's useful, but if an attacker got a shell on the dev laptop, I assume he could just coredump the ssh-agent process and steal the unlocked key from there.

[ Parent | on HN ]