More than 1k people at Twitter had ability to aid hack of accounts

https://www.reuters.com/article/us-twitter-cyber-access-exclusive/exclusive-more-than-1000-people-at-twitter-had-ability-to-aid-hack-of-accounts-idUSKCN24O34E

by 0xedb • 6 years ago

382 221 6 years ago

reuters.com

pmiller2• 6 years ago

This is why internal tools that can modify account settings and such need to have audit trails.

raz32dust• 6 years ago

I would be really surprised if they did not have audit trails. What gives you the impression they did not? The suspicion is that the credentials were stolen via social engineering. I wonder if employees needed 2FA to log in to these tools.

hombre_fatal2• 6 years ago

The attackers successfully manipulated a small number of employees and used their credentials to access Twitter’s internal systems, including getting through our two-factor protections.

https://blog.twitter.com/en_us/topics/company/2020/an-update...

ceejayoz3• 6 years ago

It probably does, and it probably wouldn't have stopped this.

akersten4• 6 years ago

Kind of sensationalist. There's thousands of people that have the ability to drain your bank account right now. Your average call center employee wields immense power. The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools.

hombre_fatal2• 6 years ago

Education programs only move the needle, not something you do instead of minimizing the number of attack vectors.

For example, education programs do squat against me attacking the employees directly (targeted malware, getting on their computer somehow, offering each of the thousands of employees $10,000 for temp access to their account). And each additional employee only strengthens my attack.

dguido• 6 years ago

It's not sensationalist when you realize it directly contradicts Twitter's prior statements from just last year about it:

Twitter, in a statement, said it is aware that "bad actors" will try to undermine its service and that the company "limits access to sensitive account information to a limited group of trained and vetted employees."

https://www.npr.org/2019/11/06/777098293/2-former-twitter-em...

1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." It's news because they misled people about their security, again.

ceejayoz3• 6 years ago

1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees."

That's not necessarily true. 20% of the company could fairly reasonably be deemed "limited", and there being a thousand of them doesn't mean they're not trained on their tasks.

akersten4• 6 years ago

I don't think that's a contradiction, I think you and Twitter have different understandings of what the size of a "limited group of employees" is. The usual advice of dismissing nebulous corporate statements like that applies.

Anyway, even if they had provided a figure, I think you're taking it out of context - the quote says access to "sensitive account information" is limited, not access to account recovery options. So it's potentially someone outside of that limited group whose credentials were compromised.

vangelis3• 6 years ago

I'm sure they took a web training before being handed the keys to the kingdom.

verroq• 6 years ago

It can be every employee except one and still be called "limited group of trained and vetted employees". It's written that way so that they covered their ass, it's not a statement of security.

nl• 6 years ago

1,000 people, including contractors outside the company, is not a "limited group of trained and vetted employees." It's news because they misled people about their security, again.

I don't think this is misleading at all. Your bank probably has thousands of people who can get equivalent access to your account, and they serve a lot less people than Twitter, and mostly during business hours, in one language, in one country.

1000 people in total when they have to have some available 24/7 isn't many.

Say 200 of them are individual technical staff with access for specific debugging purposes. Then it's only 200 people per 8 hour shift.

There's probably requirements for specific language support too, which increases the head count. There was a period of time some years ago when Twitter's peak usage was from Japan, in Japanese hours, in Japanese language.

MattGaiser• 6 years ago

Banks make the same promise that it is a "limited group of trained and vetted employees."

In an organization as large as Twitter or a bank, that still means thousands of people. You are seeing 1000 as large because you are forgetting the scale on which they operate.

freeone30002• 6 years ago

1000 people absolutely is limited - it's not everyone at the company! I'm sure they did their annual security training, like everyone here, and they might have even passed an additional screening and another training session for account access.

You have unreasonable expectations for what "limited group of trained and vetted employees" means in a CSR environment for millions of customers.

gcc_programmer2• 6 years ago

It's funny how most people think that 1000 out of 4600 employees having admin access is "not misleading" and counts as a "limited" group. It shows how in the public mind, technology groups should not be held accountable for their actions.

tjdetwiler• 6 years ago

CS tools should require some 2FA based on personal information. CS agents should not be able to access arbitrary data.

manigandham3• 6 years ago

Do they? There are usually levels of access and the bigger the change the more approval you need. Some things can only be done by an entirely separate team with manager sign off and other oversight.

It seems like Twitter has none of this, and while you can argue it's not the same a banking, there are still sensitive communications and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals.

akersten4• 6 years ago

and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals.

Unless new information has emerged recently, this wasn't the attack vector. The attack was resetting account emails/passwords and turning off 2FA.

I agree that there should have been more protections around this, but it's hardly newsworthy that Twitter employs a large support team to support their large userbase - my main gripe is with how the headline is framed.

mandatory• 6 years ago

The real story here is Twitter's lack of spear-phishing training for their support staff, not support employees have access to support tools.

Spear-phishing by its very definition is a highly targeted attack. I wouldn't count on any level of training to prevent someone from getting phished. Given some of the spear phishing campaigns I've seen, I wouldn't trust even myself not to fall for them.

It's a problem that needs to be solved with technical solutions like hardware U2F, locked-down customer support devices (e.g. Chrome enterprise policy managed ChromeOS devices), and special account VIP/anomaly locking and auto-escalation.

_jal• 6 years ago

FWIW, this is actually quantifiable. We contract with a firm that tests employees' response to spear phishing about once a quarter with varying degrees of "difficulty". Part of an overall scheme that also identifies people who blindly click on things for, uh, further email education.

p1esk• 6 years ago

It’s only going to get worse. Imagine your boss calling you and telling you to provide him some info: https://www.wsj.com/articles/fraudsters-use-ai-to-mimic-ceos...

miles• 6 years ago

It's very easy to avoid being spear phished: do not trust any unsolicited message over any medium. Email/text/phone message/popup window purporting to be from your registrar with an urgent call to action? Ignore said call and contact them directly via known good number, email address, URL, etc.

EDIT: Voice mimicry scam? Verify via known channel before taking action.

lucio• 6 years ago

"There's thousands of people that have the ability to drain your bank account right now"

Do you have some data to back that up?

Sounds implausible

akersten4• 6 years ago

Certainly it will depend on who you bank with, but JPMorganChase has 250,000 employees[1]. If even 1% of them are customer service representatives, bank tellers, or in other positions with direct access to your account (which I hope we can agree is an underestimate), that's 2,500 people right there.

[1] https://www.google.com/search?q=chase+employees

lopmotr2• 6 years ago

Does it matter? There are also millions of people who could murder you or burn down your house or kidnap you and force you to withdraw your money from the bank. But just like a bank worker stealing money, these are all serious crimes and easy to get caught so we're pretty safe.

TwoBit• 6 years ago

There's a difference though. The money you lost can be returned in the case of theft, which happens a lot. But Twitter cannot undo what happened here.

Also I don't think thousands of call center people typically have sole ability to directly overwrite bank and brokerage key data fields.

zkms• 6 years ago

i dont think spear-phishing training is the solution here; especially given the possibility of collaborating insiders. Short social media usernames are bizarrely coveted and so there's an entire cottage industry based on illicitly commandeering accounts and these operations have used insiders working for cellular telephone companies who are paid to grease along processes like unauthorized SIM-swaps/porting.

For operations on accounts where illicit access can cause massive irreversible damage -- either by exfiltrating private information (emails, DMs/PMs, posts on locked accounts, etc) or by making a post that appears authorized (the more notable the victim the worse it gets) -- there has got to be some sort of two-man rule (https://en.wikipedia.org/wiki/Two-man_rule) integrated into the system that can't be bypassed by the people with authority to make changes to accounts. Otherwise any insider / careless spear-phishing victim will make the changes they want, and theres no reason the adversary will limit themselves to posting shoddily-executed (they used the same address instead of generating one per victim!) bitcoin scams.

Furthermore, i'd really like there a way for any user (not just bluechecks) to opt-in to some sort of feature where Twitter enforces more stringent requirements/documentation/delays for the email/phone-change / password-reset processes -- at the cost of accepting higher delays or maybe even monetary payment.

There's no reason i need such critical account procedures to happen on twitter (or my email accounts, for that matter) to happen in real-time, and i would happily give that up in order to require that such a procedure only happen after, like, a week of enforced, non-bypassable delay where they contact me with details of the change on all my phone-numbers and emails every day.

irjustin• 6 years ago

Yes but it's missing the fact that you can't actually drain an account even with access. The overall network is designed for rollbacks, but more importantly, they're internally insured. My money will be put back if someone inside steals it (outside is completely different).

With twitter, the damage is not practically reversible since it was a bitcoin scam.

The analogy/comparison works to a degree, but misses some key differences as to why this is actually worse with twitter than a bank.

amf123• 6 years ago

There's thousands of people that have the ability to drain your bank account right now.

That's false equivalence. If a bank employee drains my account without authorization, it won't be difficult to prove and get back. But once your data leaks, it's out there.

bryan_w• 6 years ago

But a bank employee can leak data as well. Some would say more important data than some tweets

dwild• 6 years ago

There's thousands of people that have the ability to drain your bank account right now.

Let them do it... the bank will always be responsible and it will always be solved without much issue.

Twitter accounts though... good luck taking back theses bitcoins from all the one that got scammed. Good luck even getting back your account if you aren't named Bill Gates.

slaymaker1907• 6 years ago

I worked at a bank as an engineer and while some people did have _read_ access on certain databases, anything PII or otherwise highly sensitive would require special approvals and such approval would only be granted in 1 hour intervals. Write access generally required submitting the specific update query for approvals and was highly discouraged.

jbob20002• 6 years ago

I now understand why the bank I work for creates the separation of duties; the person who builds the system has no access to it, and the person with access has no idea how it works.

As a developer, it frustrates the shit of out me because I can’t deploy fixes quickly or easily diagnose issues.

But yep, there are 3 people that have access to the production databases that hold account info and they aren’t developers, just managers with no clue what to do once they log in.

I also worked for a company that sold software to lawyers. We had a feature that would alert the client any time a member of our company accessed their data. I think we called the feature something like “fire call”, because if you tripped it without informing the client, you’d get a call informing you that you’d been fired.

lowdose• 6 years ago

there are 3 people that have access to the production databases that hold account info and they aren’t developers, just managers with no clue what to do once they log in.

Just for my curiosity is this your observation or is this a company assumption?

jbob20002• 6 years ago

Hmm I think it’s just our group, we have a Production support team that holds the keys, and there’s only 3 of them that can access my app.

For example, if I want to change an environment variable, I can’t just log into the cloud console or run a cli command. God no. That would be too easy. I have to write a script for this team to run. This script is entered into an authorization app where a few parties “sign off”, at which point the prod support team can log in to the authorization app and click Deploy. This app then runs my deployment script against our app container to update the env variable.

Accessing and doing DB work follows a similar process.

peterwwillis• 6 years ago

It's actually fine to have multiple people get access to production databases, if you have an automated change management system.

Change Management authorize sactions which could be problematic by vetting them through a process. The end result of the process is more confidence in the change: we know who's making it, when, where, why, what the impact will be, what we'll do if it goes wrong, etc. If the change looks stupid, dangerous, or uncertain, it gets rejected. If it looks good, it gets approved. The appropriate access is doled out temporarily to make the change. In this way, Larry the Janitor can deploy changes to your prod db, and you can be just as certain (maybe more so?) about the outcome than if your 10x developer were doing it.

Just one example of this is Terraform applies. By loading your changes into a .plan file and requiring approval of the .plan, you know for certain what actions are going to be taken and approve only those. (That doesn't stop Terraform from totally hosing your system due to all the ways it can't predict the outcome of its actions, but at least you know what the intention was)

dzonga• 6 years ago

twitter, seems to have a cowboy engineering culture. that's why one of their exec's blamed rails for their failure to combat harassment[0]. n I bet now, if they still ran rails, it would've been blamed lol.

[0] https://char.gd/recharged/daily/twitter-blames-ruby-on-rails...

DetroitThrow• 6 years ago

"...a rudimentary web-application framework that made it nearly impossible to find a technical solution to the harassment problem"

To me, this is analogous to the perhaps undeserved "the internet is a series of tubes" lampooning, but I'm still chuckling how they managed to word that so poorly.

spoopyskelly• 6 years ago

It sounds like a perfect answer to those claiming "harassement" is a technology problem.

suizi8• 6 years ago

Emails are overrated as an anti-troll measure. Anyone can make a trash mail in seconds.

laughinghan8• 6 years ago

accounts with more than 10,000 followers should at least need two people to change key settings

For accounts that could start a war this might be necessary, but for celebrities with >10K followers this sounds expensive and unnecessary to me.

To me, it seems like you could instead ensure the admin view of every account has a timestamped log of recent settings changes, including changes done by admins, with a link to the profile of the admin responsible, and a button to suspend that admin account with one click.

This way, the security team could've seen that Elon Musk's account had just been reset by J. Random Employee minutes before tweeting the suspicious bitcoin tweet, messaged J. on Slack to be like "hey did you do that?", and suspended the compromised admin account within minutes.

Sure, some accounts might be briefly compromised initially, but it would be resolved in minutes and not the hours that it took Twitter, right? That seems fine for what should be a relatively low-likelihood, high-expense attack like compromised admin account (of course, you have to ensure that is the case).

foota• 6 years ago

I think the long tail was in undoing the actions made by the attackers. Resetting passwords, emails, etc.,.

laughinghan8• 6 years ago

No, according to The Block, @elonmusk repeatedly tweeted the scam at 4:17pm, 5:19pm, and 5:32pm, a span of 90 minutes, and the final scam tweet was at 6:05pm from @KimKardashian.

An hour after @elonmusk's first scam tweet, 7 celebrity or corporate accounts had tweeted the scam, all with the same Bitcoin address. With the two-click system I described, how many compromised admin accounts would you expect the security team to have been able to suspend by then?

8 more celebrity accounts went on to tweet the scam, plus @elonmusk and @kanyewest repeating the scam tweets.

https://www.theblockcrypto.com/post/71906/twitter-account-ha...

ceejayoz3• 6 years ago

I once had to restore my Authy 2FAs from a backup, and didn't have access to the original device.

Restoring it took 24 hours, during which I got bombarded with text messages and emails warning me that someone was restoring my backup, and that if it wasn't me, I should immediately click or reply to prevent it from happening.

Seems like that might help - a 24 hour waiting period on any significant account changes for verified accounts.

laughinghan8• 6 years ago

I actually had a similar idea for fighting SIM swaps—we should be able to ask telecoms "hey, when's the last time this phone number was moved to another device/changed IMEI numbers?" and distrust the number if it's been changed less than 48 hours ago.

I've looked but as far as I can tell, such an API does not exist, alas.

w3ll_w3ll_w3ll• 6 years ago

This method is actually used by many countries, most of them in Africa, where thanks to MPESA and such the need of protection against SIM swapping is even higher, since your SIM is literally your bank account.

https://www.wired.com/story/sim-swap-fix-carriers-banks/

"The SIM Swap Fix That the US Isn't Using While foreign phone carriers are sharing data to stop SIM swap fraud, US carriers are dragging feet."

icelancer• 6 years ago

Also have a Slack channel for automated bot notes of high-value targets having their passwords reset, or something similar.

babesh• 6 years ago

That just won’t work. Just target the attack in the middle of the night or lunch hour.

Furthermore, the next attack will probably be automated and be against far, far more accounts.

laughinghan8• 6 years ago

Yeah, response time might be slower in the middle of the night, but a falsified tweet on a celebrity account in the middle of the night is also likely proportionally less damaging.

Response time during lunch hour might be slower initially, but after responding to the first compromised account I don't think they'd be any slower.

If an admin account is only supposed to be for use by a human employee, it should have a rate-limit tripwire that automatically suspends the account and alerts the security team.

exdsq• 6 years ago

Twitter is a big company - they’ll have someone available 24/7

donkeyd• 6 years ago

Just target the attack in the middle of the night

Define 'middle of the night'. Is that Eastern US, Western US, GMT, or CET?

If I assume it's 2 AM pacific (since Twitter HQ is in SF), that's 11 AM in most of Europe, which makes it middle of the day for about 700 million Europeans, many of whom speak English and are interested in US celebrities. And that's still ignoring the majority of the World.

Anything on the internet is 24/7. Musk regularly tweets in the 'middle of the night' and I see those tweets come in while drinking a cup of coffee.

Also, Twitter has offices around the world and people don't collectively log out for lunch at a specific time, so there should always be people available to handle this type of incident. Provided they get the training and tools to do so.

AmericanChopper4• 6 years ago

There are already organisations that have to control employee access to ‘customer’ data very tightly. Law enforcement. Law enforcement agencies have access to large databases full of people along with a huge amount of very sensitive data (both confidential personal data, and stuff like information about ongoing and typically covert investigations).

I’ve worked with several of these types of organisations and the ones that actually want to manage that access well, typically do a pretty good job (though some of them actually want to do it badly, or just don’t care).

Locking down access to sensitive admin consoles isn’t tremendously difficult, requiring additional approval workflows for highly sensitive operations isn’t particularly difficult, and in that context non-repudiation is rather simply to address.

jameshart9• 6 years ago

There are already organisations that have to control employee access to ‘customer’ data very tightly.

How about... anybody who has customers in the EU?

jliptzin• 6 years ago

How about we don’t start wars based off a twitter feed?

delecti• 6 years ago

In an ideal world, world leaders would all have restrained enough Twitter habits such that anything that inflammatory would be seen as an obvious signal that their account was compromised.

jameshart9• 6 years ago

‘Two people’ misses the entire problem here.

If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. That chain should be documented somewhere - there must be some record in the ‘verified account management’ system that says something to the effect of ‘after we gave this actual verified human this token, this email from this address arrived on this date containing that token, establishing that this person had control over that email address on that date’.

If random twitter admins can change the email address and disable 2fa on verified twitter accounts, and those accounts can still publish tweets without them going into a ‘held pending verification that the blue check mark still applies to the person now in control of that account’ queue, then twitter verification doesn’t mean much.

Which might be of interest to organizations like the SEC who hold that communications over a verified twitter account count as official corporate notices, and various public safety organizations that have let it be known that messages on their twitter can be relied on as a source of official information during natural disasters...

Twitter needs to get serious about blue checks.

Thorrez2• 6 years ago

held pending verification that the blue check mark still applies to the person now in control of that account

That sounds to me like it's simply having a 2nd person verify the email change is correct. So your suggestion and the article's suggestion ("should at least need two people to change key settings") seem to be very similar if not the same as each other.

kanox• 6 years ago

If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account.

Not really, a blue checkmark is just a status symbol.

ponker2• 6 years ago

Twitter's blue check is a growth hack, not a notary public.

throw737• 6 years ago

PGP solved this issue 30 years ago. I can not believe we have this discussion in 2020

C1sc0cat4• 6 years ago

As twitter only has about 5k Employees having more than 1k ie over 20% with access like this is shocking and the fact that "j random "contractor" has access even more so.

Twitter needs to get serious period and not just blue checks.

Also a lot of the other FANG type companies are effectively CNI - I think they need to start properly vetting people and I mean real security clearance possibly including TS

laughinghan8• 6 years ago

pending verification that the blue check mark still applies to the person now in control of that account

Why would you want to ever allow an admin to transfer control of a verified account to an unverified person?

If you're saying that the account recovery process needs to be at least as secure as the credential that was verified (e.g. email address), then I agree. But I don't think reversion to a "pending" state would ever be desirable, though.

Thorentis• 6 years ago

This is all very true, assuming that was the purpose of the blue check. But it isn't. It's a status symbol that people also see as adding legitimacy to the tweets of an account.

SifJar2• 6 years ago

this sounds expensive and unnecessary to me

Should we be OK with what has become a significant communication platform being run with sub-par security because it's "expensive" to do it properly?

bigiain10• 6 years ago

Personally I think we need to step back and work out why the fuck anyone is OK with Twitter "accounts that could start a war"? And yet here we are.

dudul• 6 years ago

How would a Twitter account start a war?

michaelt• 6 years ago

I don't know if it's possible.

But people who do think it's possible probably think it would happen something like this: https://twitter.com/realdonaldtrump/status/12139194805748121...

sloshnmosh• 6 years ago

Ha!

Did you see in that article that the head of cyber security for AT&T added his two cents in shaming Twitter?

AT&T was just in the news recently where employees were accepting bribes that allowed criminals to swap SIMs steal bitcoins from AT&T customers.

Unbelievable.

manquer2• 6 years ago

Not just bitcoins, SIM swapping is how @jack twitter account got comprised as well.

onetimemanytime2• 6 years ago

Thousands of employees, each with their own financial problems and dreams...you're bound to find a taker. Money moves mountains

hn_throwaway_99• 6 years ago

Which is why once your company is big enough, you should need 2 employees who are unfamiliar to each other to sign off on high value operations.

tialaramex3• 6 years ago

I have a lot of sympathy for the telcos on this.

They did not volunteer telephone numbers as universal proof of ID. So their threat model was proportional to their intended purpose of the identifier. If bad guys steal your phone number and run up $100 of calls, the phone company would eat the charges and get the number back. Of course nobody did that because it wasn't worth it.

Imagine you own a medium-sized residential building, maybe 20 households live there. You issue them all with front door keys. You use pretty good locks, from a no-duplicate series that isn't trivially picked by amateurs. You figure that picking the door or forging a key would be pretty hard so there's no way it's worth it when someone could just kick it down.

Then, to your astonishment, a local jewellery store announces that anyone who has one of your front door keys can now store up to $1M of valuables in safes they've made accessible from the street. "It's totally safe" they assure your residents, "because how could anybody else get one of these front door keys? That'd be impossible".

Um. What? Before you know what's happening, one of your residents is trying to sue you for a million dollars because they proudly used a safe to store their $1M of Bitcoins for some crazy reason and (duh) somebody just got a duplicate key easily enough for way less than $1M and stole them.

tillcarlos• 6 years ago

I cannot find fault in that analogy.

Maybe only add that the whole city starts to run on your keys and you have been seeing this for years already.

bigiain10• 6 years ago

They not only "did not volunteer" to be a secure identity provider via SMS, they've been actively warning against it for almost a decade:

https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...

Telcos declare SMS 'unsafe' for bank transactions

By Brett Winterford Nov 9 2012

Communications Alliance chief executive John Stanton, representing the interests of mobile providers Telstra, Optus and Vodafone, took the extraordinary step of of declaring the technology insecure in the wake of numerous reports of Australians being defrauded via a phone porting scam first uncovered in Secure Computing magazine.

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," Stanton told iTnews this week.

wiradikusuma• 6 years ago

Anyone watched Westworld? The whole enterprise is destroyed (almost) by 2 low level employees. It's either a complete blooper in the script or --after I read this article-- reflective of the real world that I don't know about. Your take?

throwaway2207202• 6 years ago

For comparison, at Google in 2011, I was one of ~10 or so engineers that had the ability to view private Gmail or Gplus data (access that was heavily documented and audited).

That being said, Google did have to go through it's own public humiliation [1] to put a system like that in place.

https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

necovek5• 6 years ago

Don't all engineers working on Gmail theoretically have the same access by conspiring with a code reviewer or two?

It ultimately comes down to the person involved and I do not believe anyone can control the human factor.

throwaway2207202• 6 years ago

They can easily build and view their own versions of the gmail stack, but they would not be able to generate auth tokens to decode the private data of accounts they did not have passwords for.

koheripbal• 6 years ago

I almost wonder if government officials should be outright banned from using any private messaging platform that isn't hosted by the government itself.

There is just too much power in information.

necovek5• 6 years ago

I believe to an extent they are: Hilary Clinton's hacked email was not the govt provided one, and most of the flack she received was for using personal email for gov stuff at all.

imvetri• 6 years ago

Title corrected : More than 1k people at Twitter had ability to aid hack and chose not to.

amf123• 6 years ago

Title corrected : More than 1k people at Twitter had ability to aid hack and chose not to.

This is a stupid way of looking at it. Similarly:

- X number of people owned guns but they chose not to go do a mass shooting.

- X number of cops could kill a black person, they chose not to.

While it's a good thing that majority of the people know right from wrong, morality, etc, we still need to ensure one person can't do significant damage.

The fact that there are 1000s of individuals that could have hacked is not a good thing.

KingOfCoders• 6 years ago

There is all this talk from those successful companies about security and what you should do with your keys and they open source hardware secret stores and brag about it and they fail at the most basic security operations.

sunilkumarc• 6 years ago

On a different note, online presence is becoming very important and with remote work culture gaining traction, having a good online presence has become a must have asset.

I bought a course on building Twitter audience and been able to improve my following significantly from past 2 months.

Twitter link: https://twitter.com/sunilc_

If you're looking to increase your social presence too, here's the course that I found very useful:

https://gumroad.com/a/238777459/PBkrO

accurateappL• 6 years ago

Spam motivational quotes and hope people retweet and like?

alpb2• 6 years ago

Worth mentioning only 5,000 people work at Twitter.

Jaruzel4• 6 years ago

There are ~330 million active twitter users, which means 330,000 users per employee with access to admin accounts.

That ratio is massively high compared to a large corporate (i.e, a global bank). In a typical global bank lets says there are 100,000 employees, with about 25-50 IT people with the rights to admin accounts (from first line support to third line engineers) that's only 2,000-4,000 users per IT admin person.

Based on that, I'm surprised that it's only 1,000 staff members in Twitter with admin access, and not the whole company.

amf123• 6 years ago

There are ~330 million active twitter users, which means 330,000 users per employee with access to admin accounts.

I think we should look at how many daily requests they get to reset account access settings (that cannot be done automatically - via some system rather than through these 1k users).

alpb2• 6 years ago

I am not sure why this bank example keeps coming up. Almost no twitter user tries to contact support like they contact their teller for their bank. It’s really bad that 20% of the company had access to user data. No wonder it was abused in the past. https://www.buzzfeednews.com/article/alexkantrowitz/how-saud...

thinkingemote• 6 years ago

Twitter is an advertisement company so most of the employees will be in sales and marketing. Those probably don't need admin access.

Laforet• 6 years ago

Right, thousands of people with admin access and nobody could help me reinstating my API access....

OffensiveTomato• 6 years ago

Apparently you gotta have that coveted Verified badge or be an influencer of some sort

austincheney• 6 years ago

This should be a wake up call. Thank god the malicious messaging was only limited to a tiny Bitcoin scam. Imagine if they had pulled this off on the accounts of national leaders to stir hostilities or violence.

What is the recourse for this kind of failure? I suspect there is none. Twitter is shielded from lawsuits for its content. If this is provably negligent behavior and resulted in actual physical harm it are we supposed to do nothing and simply hope it never happens again?

I cannot fathom what I would do if I were in the position of Timothy Klausutis: https://www.washingtonpost.com/politics/widower-of-late-joe-...

suizi8• 6 years ago

GDPR is "supposed" to hold companies responsible for breaches and bad access controls. This is a different beast than liability protection for content.

dreen2• 6 years ago

I remember during my time with a large mobile carrier in UK I was told of a person in the company who could in theory read any SMS on the network. Mind you this was literally one person for over 30 million customers. He had a high security clearance, extensive security training and the powers vested in him were used mainly to identify scammers and other criminals.

Pretty sure this was a requirement set by law - we need someone to be able to do this, but lets make sure they know what they're doing. It is very weird we dont place the same requirements on social networks.

ummwhat• 6 years ago

Social networks were never supposed to be important or serious in the same way as phone networks. I would argue they still aren't. At the bottom, they are just time waster websites. You wouldn't demand that level of security of a php forum would you?

deadalus• 6 years ago

Social networs including Twitter host tax-payer supported institutions such as USGS and NASA where they post updates.

dreen2• 6 years ago

At a certain threshold yes I would, if it served millions of people. A small ISP can get away with terrible security but once they start having millions of customers someone is going to sound an alarm. A forum, written in any language, should be no different. I realise there are challenges in making this happen but they are not unrealistic.

antihero2• 6 years ago

Except that huge public figures tweeting can actually affect real life a lot more than a bunch of SMS messages to yer nan....

sharken• 6 years ago

You’re right about the first part, but large global social networks are quite close to phone networks in importance now.

Though cases like the recent bipolar tweets from Kanye West on Twitter does seem to support your point.

You could have said Wordpress forums, why take it out on PHP, though I get the message ;)

goodluckchuck• 6 years ago

Social networks were never supposed to be important or serious in the same way as phone networks.

I would think Zuckerberg intended Facebook to be important and serious. You don’t make a billion dollars off of something that’s trivial and unimportant.... The users might view it that way, but that lack of appreciation is just what enables you to make billions off of them.

suizi8• 6 years ago

This level of access horrifies me and in more than one way.

We should be limiting what people can do, and not giving them the keys to the kingdom.

vlqubed• 6 years ago

I wonder if they automatically turned off log in with twitter to other websites. Seems like the bigger hole is that they can use these credentials for any people using twitter to log in using oauth.

atum47• 6 years ago

well, I worked on a software house that makes software for industry automation. each user of the software has all their actions logged and time-stamped. if you edit something, give a big discount, granted permission, deleted something... it all goes into a different DB filled with just the logs. why doesn't Twitter have something like this? am I missing something?

suizi8• 6 years ago

If you're banning thousands of people, deleting thousands of tweets and updating thousands of people as routine (customer support), it might take time for someone to review what you're doing.

nextlevelwizard2• 6 years ago

implication that a hostile government might be able to cause even greater havoc.

it is stuff like this that make me question the whole article. like yes, obviously this was no "hostile" government since they were just scamming for some pocket change. but also how exactly would this hostile government create havoc with twitter?

M2Ys4U• 6 years ago

There are so many government officials on Twitter, and causing any number of them to tweet something plausible but untrue could be a big deal - from moving markets to moving troops.

Just imagine if Donald Trump's account tweeted that Antifa should be shot on sight. I'm certain people would die because of that.

Or, perhaps slightly less plausibly, that Boris Johnson tweeted that he's had enough and is abandoning negotiations with the EU. That would cause a frantic reaction from the markets before any official statement could be put out.

nextlevelwizard2• 6 years ago

If people are taking Tweets as actual government announcements then they have too many screws loose. Dumb people do dumb shit, what else is new?

uallo3• 6 years ago

I created a Twitter account close to a month ago and it was immediately suspended because it "appears to have exhibited automated behavior that violates the Twitter Rules". Well it did not really do anything yet, even less so anything against their rules. The account is still suspended despite multiple appeals and messages.

At the same time, dozens (hundreds?) of verified accounts get taken over. I think their fraud detection systems are total crap.

madeofpalk2• 6 years ago

Was it actually suspended, or did they just need you to verify with phone number?

uallo3• 6 years ago

It says "Your account is suspended and is not permitted to send Tweets". Why would they need to verify a phone number? I did not give them one.

ecmascript• 6 years ago

They do this for all new accounts. It's a way to harvest phone numbers from unsuspecting victims of this surveillance.

It doesn't matter from what ip, machine or whatever you register. It will automatically get suspended because I think they've realized it's easier to force people to enter their phone numbers in "protection" after they just created an account rather than to just ask for it during signup.

Less questions are asked. I wrote a blog post on my now deleted blog, but discussions on HN was here: https://news.ycombinator.com/item?id=19487304

uallo3• 6 years ago

I was assuming something like that. Very shady.

suizi8• 6 years ago

https://www.theverge.com/2019/10/8/20905383/twitter-phone-nu... Twitter caught using phone numbers for marketing purposes.

anonunivgrad4• 6 years ago

Should there be citizenship requirements for access to customer data at that scale? Background checks? Security clearances?[1] When you have so much private data and the ability to put words into people’s mouths, aren’t you a national security asset at that point? Today it’s some bitcoin scammers, tomorrow it’s Russian or Chinese intelligence. If I was in charge of Russian or Chinese intelligence, I’d make sure that my citizens working inside these companies are using that data to my advantage, or are at least positioned to should an opportunity arise.

There is already tons of evidence of Chinese nationals coming to the US to work at these companies with the express purpose of stealing trade secrets and sending them back to China. Why would the Chinese government stop there? How about your personal emails, your Twitter DMs, etc.?

Citizenship is loyalty. That is what it means legally and what it has meant in practice. Especially if your family is still in your country of citizenship.

Yes, this would mean the international segmenting of the internet, at least in terms of which websites you plug your personal data into vs. “just browse”. This strikes us nerds as awful. But perhaps anything else was just a naive fantasy. The last decade should have shattered our innocence. What happens online matters for great power politics, and great power politics matters a lot for ordinary people.

[1] The current security clearance process is at least partly a jobs programs for people with boring, unadventurous youths. I’m not advocating for that, just the principle of a security clearance.

scohesc• 6 years ago

You know, I used to think that locking down certain websites to citizens of the country the website resides in was a bad thing.

Now with the advent of all these apparent "bots", "state actors", etc. etc. I'm starting to think it might not be a bad idea.

There's a bunch of "what-ifs" however like "what if the government starts removing content it doesn't like", "should you be able to be banned from the platform?", etc.

anonunivgrad4• 6 years ago

At least within the US, I think sufficiently large platforms should not be allowed to censor on the basis of viewpoint. But that is exactly the kind of political question that nation states, not international forces, should be answering.

wasmitnetzen2• 6 years ago

That's a very US-centric view. Twitter has a lot of non-US users as well. In fact, a Dutch right-wing politician was apparently targeted in this attack.[1] How would such a requirement help in this case?

[1] https://www.reuters.com/article/us-twitter-cyber-netherlands...

anonunivgrad4• 6 years ago

Maybe the Dutch should do the same thing. Or throw their lot in with a country or group of countries they trust (EU, EU+x, NATO, etc.). The geopolitics of this would be complicated. But that has been life for small polities for thousands of years.

suizi8• 6 years ago

What if you're an activist and your government _is_ the enemy?

OfficialMuffin• 6 years ago

Interesting

flingo• 6 years ago

"Only two people can launch a nuke, the president, and the engineer who installed the system."

More than 1k people at Twitter had ability to aid hack of accounts

Related Stories