I remember last year around christmas/new year 2018/2019 a similar hack/leak/doxxing took place, targeting 994 (!!) mostly german politicians, celebrities and influencers. Massive amounts of private information (names, addresses, phone numbers, e-mails, DMs, contacts, online profiles, chat logs, private documents and even intimate details) where leaked. The data was published on a wide spread of public pastebins and etherpads. It took ages to take them down. The attacker had set up a labyrinth of links, files and passwords and even structured the data by topics and political parties.

Attack vector: Sim-Swapping. It was too easy. As soon as he got into one account, he got access to it's contacts and more phone numbers.

The attacker (0rbit) was a 20 year old student living at his parents home. He bragged about his hack to a online friend. This friend knew that 0rbit had been raided by the police years earlier. He betrayed him to the investigators and with the exact date of the raid the they were able looked up the old case and reveal his identity.

Previously on HN: https://news.ycombinator.com/item?id=18823286

But then why set up a rather simply scam instead of getting the bug bounty from twitter? That wallet is currently sitting at about 150k USD and these are rather hard to pay out. Why not just go for 100k USD bug bounty, completely legal and with fame?

Occam's razor says this is almost certainly the case. It isn't like the hacker knew that it would generate such little bitcoin being sent their way until after it failed.

Especially if the hacker is not from the US it seems much easier to do the bitcoin hack than try to contact a company thousands of miles away that you know one at.

While possible, this scenario requires such a massive disconnect between the attacker's skill, connections, and luck versus their understanding of economic and geopolitical context that I would consider it among the least likely.

Sounds like the 2005 hack of the Danger Sidekick (early smartphone device). I think the fellow went by the 'nym "ethics".

Dude couldn't exploit it for much, despite being able to takeover/access any account, and everything was in the cloud.

What would a state actor do with this? Read celebrities' DMs?

Quite true. Maybe some unscrupulous 19 year old with average understanding of tech, who happened to have access to the right tools at the right time.

Yeah, like altering a POST variable.

Never attribute to malice what is easily explained by incompetence.

Hanlon's Razor BOIIII

mafia boy 2.0

Someone got mugged with their phone unlocked and the mugger had a friend who was into bitcoin.

These are publicly managed Twitter accounts, they probably don't have any DMs of substance.

I think that's the case. No prominent Republicans were targeted. See: Watergate, Wikileaks DNC emails. Same shit.

If DMs were the real loot, they wouldn’t have exposed the hack by tweeting on the account.

Data theft like that is normally silently dumped after the breach occurs and anyone knows what happened.

This looks more like data injection somewhere. Perhaps an old API exploit. You used to be able to send an SMS to tweet, for example.

What does "DM" mean in that context?

(Went to wikipedia, but their suggestions like Death Metal and Dance marathon are probably not it ;) https://en.wikipedia.org/wiki/DM )

Interesting theory, but then why would they include Apple? Among others in the list, they’re almost guaranteed to be of no value and only increase the risk.

Interesting theory, but this widespread hack pretty much gives most people plausible deniability in my opinion.

Blackmail targets could still deny them.

I'm a little unclear, is the following correct?.

So basically rando's are sending famous people bitcoin because the famous people tweeted "send us $$ and we'll send you double back"?

And somehow the rando's haven't heard of the hack. Is this what's happening? Like are random people seriously sending them bitcoin? Or is it some weird form of money laundering?

Although since that's very weird behavior even if there was no hack, I suppose I'm not too surprised that those people sending the coin haven't heard of the hack.

Zoom out and you see that this is normal every ~14 days.

Also number of transactions is in no way related to amount of money being transferred.

Question (I'm not an expert): can unconfirmed transactions be withdrawn? If so, what's the timeline?

So we're likely talking some 50-100 million of dollars being stolen? Insane.

Yeah, I'm not sure there is much to be gained from leaking internal data (are DMs that valuable?). The actual scam is executed so poorly that it can't be the main goal too. "Prooving" you have a good exploit by throwing it away is also not plausible.

There is a spike of the short volume on 8th - https://fintel.io/ss/us/twtr

Bad idea for the hacker. Stock ownership is public information.

Doubt it, that would open up too many vectors on an otherwise easily anonymized operation.

This hack is (quite literally) worth billions of dollars. From market manipulation to geopolitical implications. So yes, 113k is peanuts.

Twitter would have probably paid out about $100k for this to be reported via a bug bounty program. $100k is nothing for the risk taken, they could have made a lot more.

For taking the risk of impersonating several of the richest and most powerful people of the planet? yeah, I'd say yeah. Of course it's not stopping at 113k, but even assuming it'll stop at 500k I wouldn't say it's worth it

it if seems small it probably because twitter has been under constant attack by crypto giveaway scammers since early 2018. the pool of potential victims has shrunk

If there is such a level of privilege in Twitter's stack, that says a great deal about their technology. Insiders must not be able to act as users except in prescribed ways requiring two-person control, logged and 100% audited. Glass-breaking privilege escalation should set off every pager in the company.

Based off the NYT article on the stunt this morning, I believe you are correct. It was a social engineering hack. https://www.nytimes.com/2020/07/15/technology/twitter-hack-b...

After one incident of insider account tampering their entire response was "we must protect Donald Trump's account."

Without knowing what they have access to, it's hard to tell.

If it's a third party API key with special priviledged that they hacked, the potential harm is limited.

If they have access to the full system, they could be sending millions of ghost messages to some part of the population right now to get them to do something while we all watch the BTC show:

- scam them

- get them infected to gather a massive bot net

- make them very angry and start some kind of civil unrest in a specific part of the world

- cover a currently happening terrible event somewhere so that we don't learn about it too soon because twitter is the faster medium for that

At this point I realize how critical twitter has became to shape the way we view the world, and govs should worry a lot that this can be happening and act on it quickly.

Bingo, they're probably walking away with all of Twitter's internal data as we speak...

What's the logic? It makes the problem much more visible. Ostensibly the fix for fake tweets would also fix whatever they'd be trying to cover.

They could have probably made a 100k by disclosing this to Twitter. The reward/risk graph seems concave down and not convex up.

They could have make >$10m With Elon’s account alone by manipulating the share price. A few 100k is nothing

That's pennies compared to what a compromise like this would be worth...

I doubt that. For one, they wouldn't be reusing the crypto messages from the past which have been seen by everyone on twitter a thousand times. I ignore based on tweet rather than looking at who tweeted it most of the time. So they at least would write new messages if they were after money.

There are so many ways to make money that even a dumb person could find something better than posting crypto ads without compromising on opsec.

I think they have proven that it works with thousands of YouTube videos with the same scam and basically the same operating mode (impersonating famous people). They have made quite a lot of money.

So they are probably on at least their second attack vector by now.

I mean, who knows, based on the massive number of imposter YouTube stream BTC giveaway scams, this might be a whole sub-industry in India by now. Similar to fake virus scams etc.

this is not a way for you to demonstrate what can be done to a big client. ignore OP.

I will bite. Without taking a political stance. Imagine you could show GRU that they can make Trump tweet "I just ordered a nuclear strike on..."

What value would you place on this?

The proof will go along with another method of hacking the account that is not disclosed.

The typical scammer doesn't hack twitter

They're not a scammer. They're a massive multimedia conglomerate hacker.

But wouldn't that be evident very, very quickly, from just looking at a relevant account's audit log, and shut down right away?

A senior engineer (juniors would not have this level of access) risking their job and facing prosecution for an amount that would certainly be far less than their salary? That doesn't seem likely.

Hmm the thing is, associating it even more with "hack" and "scam" isn't really great marketing.

I like your thinking. This is a novel idea.

Yeah, the idea that this is an initial step in something bigger doesn't make sense.

If they wanted to exfiltrate data, they already did that previously.

They very loudly burned their access, this seems a lot more like someone trying to monetize their access quickly before their access token expires - squeezing out the last few drops before they can no longer get into the system.

Wow that's brilliant. I didn't think of that. If someone had a non trivial amount in stock shorts, they could stand to make an exorbitant amount of money.

"destroyed", a bit exaggerated, mate.

I read about this in the news before I saw it in my Twitter feed. My trust in Twitter has dropped severely.

Why weren’t these tweets deleted immediately and a note pinned to every users feed?

Are you the AOL Pizza? (I’m guessing not but have to ask)

I’m seeing a lot of discussion of the DMs being the real target, but executives and politicians usually have staff who monitor and post to their social media channels. Hard to imagine Barack Obama communicating anything of blackmail value over a channel that a mid-level social media manager has the password to.

They are not stupid if they could make such a big attack.

You could move many, many millions of dollars on the stock market with these accounts. Would require more care and/or tricks to avoid being apprehended than a simple anonymous bitcoin scheme, but the pay off could have been at least a couple of orders of magnitude higher.

I thought it was just me, but yes... please send me your ISK and I will double it... here's a website with a wallet thing that shows we sent out money... everytime we received some.

Again, nothing. Given the accounts that were hacked, they could easily have moved markets and had pre-placed short bets that would have netted them potentially hundreds of millions.

Walk into the [country] embassy, probably (or twitter these days...)

Yeah, not possible with both the last US pres and vice pres being hit.

Literally, at least 3 of the top 10 richest people in the world got hit. All of whom probably really don't like each other to begin with...

Twitter acknowledged the incident over two hours ago: https://twitter.com/TwitterSupport/status/128351803844522393...

"few BTC" is relative to the value of what they had, not the average income of the average person.

If I sold a 7500 sqft home in San Fransisco for $200,000 you could say the same thing.

based on what?

Do they seem the type of people that would send anything sensitive over Twitter DMs? I'd imagine if anything at the very least they would use iMessage or some messaging app of that nature. Biden seems like the type of guy who relies on e-mail.

Why? It's certainly imaginable Obama's cell phone was targeted.

Real estate developer by day, elite hacker at night?

Lol not even close

If I were a miner now, I would not reverse these transactions.

Setting the precident that transactions can be reversed will do more harm to the crypto ecosystem than than $100k being taken from gullible users.