undefined | Better HN

0 pointsblisseyGo5y ago0 comments

Tweet from TwitterDev team yesterday:

https://twitter.com/TwitterDev/status/1283068902331817990

> 2 days to go… #TwitterAPI

https://twitter.com/TwitterDev/status/1283433096780677122

> Thank you to all of you who have engaged with us and shared your feedback. Your input has been vital, and we’re committed to continuing these conversations with you. There’s so much more we’re doing to build a better #TwitterAPI… and Early Access is coming tomorrow!

Were they supposed to launch some new API tomorrow which got hacked?

0 comments

zelly5y ago

It looks like someone found a 0-day in the new API and wanted to use it before others did. Probably didn't help that the bug bounty for this would have been only 7k. How much does the Twitter employee who implemented this bug get paid?

https://twitter.com/LiveOverflow/status/1283511782380908545

anonu5y ago

We now know it wasn't a 0 day. It was socially engineered access to internal tools. That's still a tricky one to lockdown.

2 more replies

kabacha5y ago

Currently their earned BTC balance is $120k+ for comparison. That's a pretty successful scam and 5% of potential revenue will not make anyone go white hat.

2 more replies

css5y ago

Or someone making one last use of an exploit on the old API, since ostensibly there is a day to go before the new API is released on the public net.

Sebb7675y ago

This might actually explain the simple scam nature. Setting up more complex monetisation, i.e. by shorting a company, takes quite a while, especially if you don't want to be tracked. A bitcoin scam is quick and simple to do. And it's not _too_ illegal (compared to, for example, stock manipulation), so the attacker will probably catch less heat.

3 more replies

blisseyGoOP5y ago

https://developer.twitter.com/en/docs/labs/overview/whats-ne...

I don't see any depreciations happening which could result in today's hack. Though I could be wrong.

mdoms5y ago

I don't think they were planning to immediately deprecate and remove the old API. Is there any reason to believe this is the case?

1 more reply

zmmmmm5y ago

That actually makes the most sense to me. Even makes me wonder about whether it could be an insider leak - someone who knows of an unadvertised exploit that has been patched internally and sold it at the last minute or something.

Nightshaxx5y ago

This makes way more sense than any of the other suggestions in HN.

DMs are almost worthless; who uses DMs for anything important? It's for contacting people you kinda know but not really. State secrets aren't transitted over DM, but not because people wouldn't be stupid enough to do it. the people holding them are much older than the demographic that uses Twitter DMs. Worst case with DMs is some new YouTuber drama would be exposed.

3 more replies

dmix5y ago

Nice catch, this may be what it was.

Edit: looks like an admin panel was the culprit https://news.ycombinator.com/item?id=23853786

Solvitieg5y ago

I don't understand this angle because typically admin panels only let you manage the account; deactivate, manage email address, etc. As shown in the screenshots.

Tweeting on behalf of another user seems like an unnecessary feature to give admins.

2 more replies

ryanisnan5y ago

Early access wasn't supposed to be enabled until tomorrow. I wouldn't speculate until they give a post-mortem.

1 more reply

wybiral5y ago

It seems weird to me that Twitter would have disabled tweets from verified accounts instead of disabling tweets from the API though.

shmoogy5y ago

That's really suspicious timing - probably was an exploit against the new api.

jonahbenton5y ago

Finally, a reasonable explanation.

j / k navigate · click thread line to collapse

0 comments

zelly5y ago

https://twitter.com/LiveOverflow/status/1283511782380908545

anonu5y ago

We now know it wasn't a 0 day. It was socially engineered access to internal tools. That's still a tricky one to lockdown.

2 more replies

kabacha5y ago

Currently their earned BTC balance is $120k+ for comparison. That's a pretty successful scam and 5% of potential revenue will not make anyone go white hat.

2 more replies

css5y ago

Or someone making one last use of an exploit on the old API, since ostensibly there is a day to go before the new API is released on the public net.

Sebb7675y ago

3 more replies

blisseyGoOP5y ago

https://developer.twitter.com/en/docs/labs/overview/whats-ne...

I don't see any depreciations happening which could result in today's hack. Though I could be wrong.

mdoms5y ago

I don't think they were planning to immediately deprecate and remove the old API. Is there any reason to believe this is the case?

1 more reply

zmmmmm5y ago

Nightshaxx5y ago

This makes way more sense than any of the other suggestions in HN.

3 more replies

dmix5y ago

Nice catch, this may be what it was.

Edit: looks like an admin panel was the culprit https://news.ycombinator.com/item?id=23853786

Solvitieg5y ago

I don't understand this angle because typically admin panels only let you manage the account; deactivate, manage email address, etc. As shown in the screenshots.

Tweeting on behalf of another user seems like an unnecessary feature to give admins.

2 more replies

ryanisnan5y ago

Early access wasn't supposed to be enabled until tomorrow. I wouldn't speculate until they give a post-mortem.

1 more reply

wybiral5y ago

It seems weird to me that Twitter would have disabled tweets from verified accounts instead of disabling tweets from the API though.

shmoogy5y ago

That's really suspicious timing - probably was an exploit against the new api.

jonahbenton5y ago

Finally, a reasonable explanation.

j / k navigate · click thread line to collapse