captn3m0 · 5 years ago

Some of these are really high profile hacks (Biden/Obama for eg). I'm wondering if its a silly twitter authentication bypass.

redisman · 5 years ago

That sounds like a... high variance idea.

ISL · 5 years ago

BillGates tweet is now down, within the last minute.

rvz · 5 years ago

They are reposting the same message on the hacked accounts again. This is a coordinated Twitter hack.

blablablub · 5 years ago

One thing we know now is that Twitter can take tweets down really quickly if they want.

zwily · 5 years ago

We don’t know how much of that is the attacker sending himself to make it look legit.

saagarjha · 5 years ago

Fools, or people doing it for the lols

treis · 5 years ago

To be fair this does seem like something Elon would do

NocturnalWaffle · 5 years ago

https://www.blockchain.com/btc/address/bc1qxy2kgdygjrsqtzq2n...

5.9BTC now

Joeboy · 5 years ago

Those are both tiny sums anyway.

jcfrei · 5 years ago

This one's a bit more up-to-date: https://blockchair.com/bitcoin/address/bc1qxy2kgdygjrsqtzq2n...

monokh · 5 years ago

That explorer probably does not count unconfirmed transactions.

monokh · 5 years ago

They do often supply some coins to themselves to create the illusion that there is activity.

bogdanu · 5 years ago

I few weeks ago I saw two with 50k each...

Google has to step up it's game because their platforms aren't safe anymore.

throw_m239339 · 5 years ago

> What is going on that Twitter didn't get them locked ASAP?

I don't think Twitter itself knows yet.

Tenoke · 5 years ago

Easier to trace, higher monetary investment etc. This they can likely get away with without risk of losing a big investment.

arthurcolle · 5 years ago

Oh god. Nightmare fuel

laluser · 5 years ago

That's way riskier though. There's a reason they are using BTC.

viraptor · 5 years ago

It would be also much easier to track. Significant gains this way would not go unnoticed.

kogir · 5 years ago

Do you know they haven’t shorted twitter? Lots of ways to play this game.

amrrs · 5 years ago

"Hacking Elon’s Twitter account and using it for a crypto scam rather than a stock-trading scam shows a complete lack of imagination" - Naval

https://twitter.com/naval/status/1283507218294292481?s=19

shpongled · 5 years ago

Or SPX puts, /ES futures, etc and a tweet from a certain political account...

richardknop · 5 years ago

The hacker could have puts on Twitter as well. The Bitcoin scam might be just a cover / distraction so it looks like an unsophisticated hacker while the real money might be made with options contracts.

d--b · 5 years ago

What makes you think they have not bet on stock as well?

jacquesm · 5 years ago

It isn't over yet.

danabrams · 5 years ago

Couldn't market-traded options be rolled back in the event of a hack, though?

scottmf · 5 years ago

My crazy theory: the real attack is on the Twitter stock price and the bitcoin is a distraction.

mrep · 5 years ago

They could have just bought puts on twitter as it is currently down 4% after hours.

fortran77 · 5 years ago

It's not 100% guaranteed though; Tesla stock is odd. And it might be possible to people short selling who timed it exactly right.

This "scam", while crude, will probably not result in any loss and it would be much harder to catch them

closeparen · 5 years ago

The attack didn't start until after the markets closed.

xwdv · 5 years ago

This is the route I would have taken, but not with OTM puts. It’s far easier to let the stock tank, then buy up calls knowing that the reason is bullshit, and wait for the price to recover and sell.

You will blend in perfectly because you have an alibi for why you are buying so many TSLA calls.

And when you buy an OTM put, it’s hard to predict what a good price would be exactly. How far do you think the stock would drop? With a call you could be fairly more confident it will return to a previous level.

That said, this kind of attack requires you to have a good amount of capital on hand, so you need to be a fairly independently wealthy hacker.

partiallypro · 5 years ago

The SEC would be able to trace the trades, and the person would be busted. Bitcoin allows them to remain anonymous.

swarnie_ · 5 years ago

Sounds like "committing suicide" in a US super max with extra steps.

Golden rule is you don't steal money from rich people, only poors.

dclowd9901 · 5 years ago

It would be ridiculously easy to track down those puts and narrow them to a possible hacker. Authorities would find them in hours.

RealityVoid · 5 years ago

Haha, I apologise in advance, but for some reason, the tone of your post just made me chuckle. It just had an amusing sort if naivite'. It was most likely the hacker's own BTC address.

cryptica · 5 years ago

This strategy would require having money to begin with. It's a pretty big assumption that hackers have any money. If they had money, they wouldn't have to be hackers.

andy_ppp · 5 years ago

I mean why can they not stop the api? Why not just switch it off for a few minutes and figure out what is happening?

Sebb767 · 5 years ago

It's a sidenote, but it's so strange that that would be pocket money for him; just like donating 10$ for us. Gives you a sense of scale.

jcims · 5 years ago

Just tweet it yourself. Who will know?

nathancahill · 5 years ago

I believe I read something (trying to find it) about Twitter internally having additional protections on Trump's account. Only a handful of people within Twitter can touch it.

marcinzm · 5 years ago

They're clearly trying to avoid the risk of being tracked. For example, they could have done stock manipulation and made more money. Trump is someone with the power and craziness to spend a hundred million tracking you down and literally dropping bombs on your head. So it'd be poor risk management to go after his account.

ceejayoz · 5 years ago

No. Clicking into a tweet shows you which app was used to post it. https://help.twitter.com/en/using-twitter/how-to-tweet#sourc...

These tweets are showing up as being posted from the Twitter web interface.

whoisjuan · 5 years ago

- Uber

- Apple

- Bill Gates

- Elon Musk

- Jeff Bezos

- Joe Biden

- Barack Obama

- Michael Bloomberg

- Kanye West

- Wiz Khalifa

- Bitcoin

- Ripple

- Coinbase

- BINANCE

- CZ_Binance

- Gemini

- Kucoin

- Gate .io

- Coindesk

- Tron

- Justin Sun

- Charlee Lee

That seems like someone got full access to the backend, not the accounts per se.

Also worth mentioning that the tweets get deleted but then they get added and pinned again.

marcinzm · 5 years ago

Based on this, a metric fuckton of small accounts are posting this as well right now. Unless you hacked the backend I don't see why you'd bother with 200 follower accounts.

https://twitter.com/search?q=bc1qxy2kgdygjrsqtzq2n0yrf2493p8...

SwiftyBug · 5 years ago

I believe OP meant that the attackers got access to the account by hacking SMS, thus getting the verification code and legitimately logging in the accounts.

danso · 5 years ago

I meant in the sense of SIM-swap hacks, though SMS-posting would also make sense as a vector (had Twitter not recently ended it)

https://info.phishlabs.com/blog/sim-swap-attacks-two-factor-...

mikewhy · 5 years ago

When I posted my comment the title simply read "twitter compromised". I'm not sure if the exact nature of the attack is known, but it definitely wasn't at the time.

saagarjha · 5 years ago

Surely a hack of this magnitude would be on the radar of many of those agencies already.

6nf · 5 years ago

Biden / Obama would fall in that too though?

justinmeiners · 5 years ago

> multi-factor authentication enabled

It sure seems like multi-factor auth isn't very helpful, when nearly all hacks have nothing to do with breaking credentials.

jrv · 5 years ago

Wouldn't Twitter have locked the affected accounts by now then?

nonbirithm · 5 years ago

Well then we're royally fucked if all it takes is a single rogue admin at this single, societally ubiquitous company to expose everything and let people fire off false declarations of war on each other or short TSLA and additionally make the entire concept of 2FA meaningless.

This was exactly what 2FA was supposed to prevent, and if this is to be believed then because of Twitter's implementation it was all worth peanuts in the end.

There are just too many eyes on Twitter for their administration to let this happen. Twitter has grown into too big and too valuable of a target at this point, and the moment this happens you can't prevent dumb people from falling for it thirty seconds after it gets posted and starts showing up in their feed.

Then why was it even possible to do this from the inside? What employee access controls did they have on administrative accounts?

I'm thinking they're going to need to dig an underground bunker and have everyone be in the presence of at least three other certified minders when a group of two dozen people at a tech startup are the last bastion of hope in preventing the disruption of global communications.

redisman · 5 years ago

How many people have admin access to production? That is like a "in case of emergency break glass"-role at best.

Latty · 5 years ago

The responses to that tweet say it is fake and the real number is only 6BTC (~$50k).

mendelmaleh · 5 years ago

https://www.blockchain.com/it/btc/address/bc1qxy2kgdygjrsqtz...

According to this, 6.1 BTC, which is around 56k USD

jacquesm · 5 years ago

Pretty safe to assume they are all compromised until there is proof to the contrary.

10xPerson · 5 years ago

I refuse to believe there are people who can be aware of BTC enough to go out of their way to even obtain some, and then fall for a scam like this...

SwiftyBug · 5 years ago

There are services that are able to obfuscate a transfer of BTC, which really only makes it very laborious to trace the money.

lawn · 5 years ago

There are many exchanges and services where you can sell BTC for XMR (Monero) without revealing your identity. And with Monero you cannot trace addresses or transactions.

akmarinov · 5 years ago

God, imagine them declaring war on China from Trump’s Twitter...

ceejayoz · 5 years ago

Playing in the market leaves substantially more of a trail to follow.

WatchDog · 5 years ago

For someone that doesn't understand twitter, what does that mean?

gundmc · 5 years ago

I thought that vulnerability was due to the now-deprecated Tweet by Phone integration and SIM swaps?

ceejayoz · 5 years ago

That's one of the few accounts that might get you drone striked for messing with. It may stay safe.

tomp · 5 years ago

Would be too obvious. Noone believes what that account tweets anyway.

VikingCoder · 5 years ago

Yeah, I bet they're too stupid to be able to do it.

(He said, taunting the hackers.)

CPLX · 5 years ago

One wonders if that specific account has some unique exemption in the Twitter code to specifically deal with it.

vangelis · 5 years ago

Risk/reward for the sitting POTUS just isn't there.

freejak · 5 years ago

Don't worry guys I just changed my password.

amrrs · 5 years ago

I wonder if Elon is a type of guy who uses apps like Buffer or Social media manager app. It looks more like some exploit within Twitter which they've leveraged and orchestrated a coordinated tweet attack

macNchz · 5 years ago

They seem to have more access than purely posting as the user, I'm seeing reports that the attacker has changed the email addresses associated with the accounts to protonmail addresses.

Scoundreller · 5 years ago

All the big names hit said "Twitter Web App" as the tweet source.

zmmmmm · 5 years ago

Surely any individual client would have had their api keys immediately blocked. It would have to be more like a compromise of, say, the API key back end that allows them to surveil logins over a period of time, and the accounts we are seeing hacked is what they scraped.

positr0n · 5 years ago

It's common to "seed the tip jar" by transferring some of your own BTC from another wallet to the public facing one. So that number should be treated like a ceiling.

delive · 5 years ago

It's probably because the subset of people who would fall for it likely don't have BTC.

Nextgrid · 5 years ago

Cryptocurrency scams with fake accounts impersonating verified ones have been around for years despite being detectable with a simple regex. There's no reason to believe this disgraceful company actually cares, although after this incident hopefully they will change their mind.

trollied · 5 years ago

I can't believe Twitter haven't managed to stop this yet!

1-6 · 5 years ago

How do we know that it's not the actual OP trying to pose like a big account target?

stefan_ · 5 years ago

Love how they don't just ban the bitcoin address. Firehose big data my ass. No one at home at Twitter.

sleepybrett · 5 years ago

That probably gets the secret service involved, no?

jansan · 5 years ago

Bezos is probably a great guy to hang out with, but do not expect him do boy you a beer :)

Barrin92 · 5 years ago

At this point I'd advocate for a huge red button or a gong that someone can smash and it just halts the platform

actuator · 5 years ago

The ones I saw from Musk, Buffett etc had the actual address.

Aperocky · 5 years ago

Um why not enough and not too much? This alone doesn't say anything in regard to twitter's user count.

This means twitter had omni backend tooling that have manual/programmatic admin level access to production database.

This is a very bad idea, access to production tables should be through a controlled medium and always challenged.

blisseyGo · 5 years ago

On a serious note, does that 4000+ employees include the content moderators? If yes, then I can see why. If not, then I am not sure what that many employees is for.

webXL · 5 years ago

Daaaaaaamn! I bet morale really has deteriorated since national politics leaked into business decisions and employees being cut off from their daily social interactions isn't helping.

misnome · 5 years ago

I don’t think I’ve ever looked forwards to a postmortem so much, so many possibilities.

tornato7 · 5 years ago

Twitter hasn't released postmortems for other incidents, so I wouldn't hold out hope

slezyr · 5 years ago

> All Bitcoin sent to my address below will be sent back doubled. If you send $1,000, I will send back $2,000!

> Only doing this for the next 30 minutes! Enjoy.

No, it's hacker's doing, they need to keep timestamps updated

Narretz · 5 years ago

30 minutes later and it still happens, just after "Elon" posted a normal message. Hopefully most users have caught on to the scam by now.

MattGaiser · 5 years ago

Do that many accounts use the same social media manager?

kristofferR · 5 years ago

No way, it's way too widepread and would be shut down by now.

Elon Musk, Barack Obama and Wiz Khalifa just tweeted the scam again this very minute, more than an hour since it started. This is backend access, Twitter can't figure out how to shut it down.

celticninja · 5 years ago

I can't see that bill gates, Elon musk and every cryptocurrency channel using the same manager. This looks like something closer to a Twitter hack than an intermediary, especially with the the reposting after deletion.

neurostimulant · 5 years ago

But when you post a tweet via api, the tweet will include the app's name at the bottom? The screenshot in the article has "Twitter Web App" at the bottom.

one2know · 5 years ago

Don't know, but current corporate dogma is to not host anything, including using third party auth provider which is like giving away their customer list.

Scoundreller · 5 years ago

Could be front end, since all of these cite "Twitter Web App" as the source. Never anything else (unless you're a low-follower troll).

CleanCoder · 5 years ago

Liable for the account being compromised? Twitter. Liable for people sending money? People sending money.

Geee · 5 years ago

Maybe a popular browser extension? Would explain why it seems to target tech people.

boarnoah · 5 years ago

Is there even a self hosted Github? AFAIK there is no public offering of the sort.

neurostimulant · 5 years ago

Hmm, how much money this scam would potentially generates? I think the salary of an engineer working on twitter would be higher given how fast this scam would be shut down. Would a twitter employee risk their career to this scam?

ChuckMcM · 5 years ago

And now this : A Twitter insider was responsible for a wave of high profile account takeovers on Wednesday, according to leaked screenshots obtained by Motherboard and two sources who took over accounts.

From - https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...

sleepybrett · 5 years ago

If they did, they would be running the self hosted option.

suzzer99 · 5 years ago

That twitter buildspec.yml must be HUGE!

Darkphibre · 5 years ago

I'd guess that Elon's first reaction would be to change the password. Since it's still happening, it's probably back-end.

jmkni · 5 years ago

Donald Trump was Tweeting in Farsi earlier, I was seriously on the fence about whether that was a genuine tweet.

benlumen · 5 years ago

You say they'd target POTUS but of the very high profile accounts it's so far billionaires, corporations and democrat politicians. Does make you wonder.

bollu · 5 years ago

Can you clarify your edit? All I see is this tweet (https://twitter.com/TwitterSupport/status/128351803844522393...) which reads

We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly.

Are you implying that this was tweeted by the attackers? or something else?

Pmop · 5 years ago

I think that they just like to be alive, so they avoided hacking POTUS or other countries Presidents/PMs.

tathougies · 5 years ago

If they target @POTUS, I believe they'd be guilty of impersonating an elected official, which would make this an even more serious crime? I dunno

Krasnol · 5 years ago

Maybe they're POTUS fans ;)

mlinsey · 5 years ago

I do think it's odd that so many prominent accounts were hit but not Trump's. I remember there was an incident a couple years ago that a trust and safety employee at Twitter suspended Trump's account on their last day. It's very likely that after that incident, special guards were set in place to prevent admin tools from messing with Trump's account. This would align with speculation that this hack targeted an internal employee admin tool.

VectorLock · 5 years ago

The Twitter backend is probably heavily sprinkled with statements like `account_handle match { case "therealdonaldtrump" => throw new TrumpNotAllowedException("can't do"); }`

Especially after the last insider account tampering event.

VectorLock · 5 years ago

Write through caches would need to send the tweets through the normal channels for them to 'fan out' instead of writing directly to MySQL. But essentially what you're saying about possible backend compromise.

ragerino · 5 years ago

Just saw this https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...

Means they had someone inside Twitter.

Nextgrid · 5 years ago

[citation needed]

Their reputation and the post-mortem/cleanup effort of this hack already wiped out a significant chunk of their advertising profit. Taking down the platform for one day would be a drop in the bucket in comparison.

They are causing extreme damage to lots of high-profile people's reputation every second the platform is kept active. I wouldn't be surprised if lawsuits appear as a result of this. Taking down the entire platform would be safer and would at least stop the damage.

_____-___ · 5 years ago

No. No it wouldn't. Trust is priceless and they're losing it by the minute.

benjohnson · 5 years ago

curiosity value > fractional bitcoin value

davidlee1435 · 5 years ago

Curiosity, mostly. This was very soon after the tweet was posted, and it was less than a dollar.

buzzerbetrayed · 5 years ago

This is exactly what I was thinking. This has made me lose a lot of faith in crypto, not that I had a ton of faith to begin with. But I keep hearing people talk about blacklisting addresses and blocking transactions. That's scary stuff. How can people ever feel comfortable storing large amounts of money in crypto if the big players can simply block their address and make it near impossible to liquidize their money? I feel like this incident is showing Bitcoin's (at least what Bitcoin has grown to become) true colors.

tossAfterUsing · 5 years ago

Coinbase is not decentralized.

WarOnPrivacy · 5 years ago

WINterference !

perryizgr8 · 5 years ago

I still haven't figured out the correct way to watch a video on twitter. I always have to mess around with the mute button, seek back to start of video, etc.

marcinzm · 5 years ago

Could have paid/convinced/threatened an intern/employee to scope it out and then deployed the hack externally to bypass safety measures. Complicated but doable.

ehsankia · 5 years ago

As long as the API isn't running on node, right? :)

VikingCoder · 5 years ago

I'd suspect the web interface has UI that's wrapped around the semi-public API. It's that web interface I'm worried about.

SahAssar · 5 years ago

But the twitter web interface has access to post (since you can post via it), so it would be possible.

vmception · 5 years ago

I’m currently leaning towards Twitter tried a bunch of things to stop this and hootsuite got caught in the fray

Or maybe it was a multipronged attack that included social media management software and OAuth

but the hilarious most visible solution is that Twitter now disabled all verified accounts

and they should keep it that way

Macha · 5 years ago

Not sure if the hackers are doing that or people are just trying to get attention from the search results

e.g. tweets like this look like people are consciously looking for attention: https://twitter.com/Statist_Sam/status/1283533522536411136

miguelmota · 5 years ago

At this point people are only doing it for trolling reasons

cryptoz · 5 years ago

Indeed, already billions in trust lost so far, guessing by the ~4+% after-hours TWTR drop.

eternalban · 5 years ago

This is possibly a blessing in disguise. Obama and Biden's accounts have been hacked as well so this basically just burned Twitter as an international political platform.

Following that thought, it is entirely possible the whole point of the hack is to discredit Twitter and the bitcoin bit is just smoke.

jcims · 5 years ago

They just disabled posts from verified users.

htrp · 5 years ago

When you say unannounced pentester, how the hell did that happen? Usually, isn't someone in the escalation chain aware of these types of things?

PatrolX · 5 years ago

Imagine what "could have been" done.

Simultaneous compromise leading to tens or hundreds of millions of people receiving the same / similar messages for over an hour from the people they trust the most.

Death and destruction waiting to happen.

jasoncartwright · 5 years ago

Is it? They don't appear to know what will be hit next or how to stop it.

kristofferR · 5 years ago

The hackers are changing the login information of the hacked accounts too, gonna require a massive amount of cleanup.

dvt · 5 years ago

It's not too hyperbolic to say that WW3 could be started on a platform like Twitter. Having a "shutdown" button doesn't seem that extreme when essentially the entire site seems to be compromised. I'd bet my bottom dollar that Congressional hearings are going to happen.

jf- · 5 years ago

I don’t, they can say anything posing as anyone and the general public will believe it, this is a genuine hazard. Seriously, if I were them I’d pull the plug until this is fixed.

s5300 · 5 years ago

Not really.

As far as we can tell right now, Obama and Biden could've posted about a complete coup to assassinate Trump and that every middle eastern country already has nukes on their way...

rsanheim · 5 years ago

Its not extreme at all.

cgk · 5 years ago

Given the nature of how twitter has influenced elections, why would this be extreme? So far the known targets all appear to be of a particular political persuasion, but I haven't seen a comprehensive list yet.

sdiouhs9 · 5 years ago

Imagine if the hacker was a bit more nefarious and hacked Trump's account to say he was launching a first strike attack against Iran or on Musk's account saying he was halting Model S production due to battery defect. The real world ramifications could be immense.

jonny_eh · 5 years ago

Ok, y'all have convinced me. Shut it down!

catalogia · 5 years ago

Not as extreme as demonstrating that they evidently lack the ability to stop it...

suzzer99 · 5 years ago

Twitter used to go down all the time. Just put up the fail whale for old time's sake.

perryizgr8 · 5 years ago

ATT and Verizon also don't block users for speaking something that goes against their CEO's politics.

choward · 5 years ago

Not really. That just prevents them from posting bitcoin addresses. They still have access to all the accounts and can post whatever they like. It's still dangerous. And what about all the real posts that contain long strings?

mod · 5 years ago

For the specific variation this hack is currently taking, sure. But the actual problem is that someone has access to these accounts and can post anything they want. That is not okay, and has nothing to do with bitcoin addresses.

Nextgrid · 5 years ago

Cryptocurrency scams have been going on for years despite the fix being an easy "if reply to a high-profile account and contains the words "bitcoin" or "giveaway" then ban".

If they couldn't (or didn't want to) do it then I very much doubt they can do it now.

bart_spoon · 5 years ago

A bitcoin scam, in the grand scheme of things, is on the more harmless end of the spectrum of what they could do with this. They absolutely should shut it down while they work this out.

ageitgey · 5 years ago

I've got a check and I can't tweet. It just says 'unable to send'. Twitter must have no idea where the source of the hack is.

adrr · 5 years ago

We had maintenance mode at MySpace. We could shutdown any part of the site with feature flags that can be turned on for ranges of users. Very useful for bringing back the site after an outage and allow the caches to fill without overloading the underlying dbs. I am sure twitter has the same, they had scalability issues at the beginning . I guarantee they have a mode to disable posts and mode to disable authentication so they can recover the underlying systems .

dvt · 5 years ago

Because if there ever was a moment to press that button, it would be now. Thousands of accounts are still tweeting that BTC address.

woeirua · 5 years ago

Bingo, they're probably walking away with all of Twitter's internal data as we speak...

beaner · 5 years ago

What's the logic? It makes the problem much more visible. Ostensibly the fix for fake tweets would also fix whatever they'd be trying to cover.

BiteCode_dev · 5 years ago

Without knowing what they have access to, it's hard to tell.

If it's a third party API key with special priviledged that they hacked, the potential harm is limited.

If they have access to the full system, they could be sending millions of ghost messages to some part of the population right now to get them to do something while we all watch the BTC show:

- scam them

- get them infected to gather a massive bot net

- make them very angry and start some kind of civil unrest in a specific part of the world

- cover a currently happening terrible event somewhere so that we don't learn about it too soon because twitter is the faster medium for that

At this point I realize how critical twitter has became to shape the way we view the world, and govs should worry a lot that this can be happening and act on it quickly.

Monroe13 · 5 years ago

I’m seeing a lot of discussion of the DMs being the real target, but executives and politicians usually have staff who monitor and post to their social media channels. Hard to imagine Barack Obama communicating anything of blackmail value over a channel that a mid-level social media manager has the password to.

s5300 · 5 years ago

Yeah, not possible with both the last US pres and vice pres being hit.

Literally, at least 3 of the top 10 richest people in the world got hit. All of whom probably really don't like each other to begin with...

codesternews · 5 years ago

They are not stupid if they could make such a big attack.

searchableguy · 5 years ago

I doubt that. For one, they wouldn't be reusing the crypto messages from the past which have been seen by everyone on twitter a thousand times. I ignore based on tweet rather than looking at who tweeted it most of the time. So they at least would write new messages if they were after money.

There are so many ways to make money that even a dumb person could find something better than posting crypto ads without compromising on opsec.

ilaksh · 5 years ago

I think they have proven that it works with thousands of YouTube videos with the same scam and basically the same operating mode (impersonating famous people). They have made quite a lot of money.

So they are probably on at least their second attack vector by now.

I mean, who knows, based on the massive number of imposter YouTube stream BTC giveaway scams, this might be a whole sub-industry in India by now. Similar to fake virus scams etc.

ehsankia · 5 years ago

mafia boy 2.0

Sebb767 · 5 years ago

But then why set up a rather simply scam instead of getting the bug bounty from twitter? That wallet is currently sitting at about 150k USD and these are rather hard to pay out. Why not just go for 100k USD bug bounty, completely legal and with fame?

mortenjorck · 5 years ago

While possible, this scenario requires such a massive disconnect between the attacker's skill, connections, and luck versus their understanding of economic and geopolitical context that I would consider it among the least likely.

Scoundreller · 5 years ago

Sounds like the 2005 hack of the Danger Sidekick (early smartphone device). I think the fellow went by the 'nym "ethics".

Dude couldn't exploit it for much, despite being able to takeover/access any account, and everything was in the cloud.

VectorLock · 5 years ago

Someone got mugged with their phone unlocked and the mugger had a friend who was into bitcoin.

ransom1538 · 5 years ago

Yeah, like altering a POST variable.

zelly · 5 years ago

What would a state actor do with this? Read celebrities' DMs?

mmazing · 5 years ago

Never attribute to malice what is easily explained by incompetence.

Hanlon's Razor BOIIII

bb2018 · 5 years ago

Occam's razor says this is almost certainly the case. It isn't like the hacker knew that it would generate such little bitcoin being sent their way until after it failed.

Especially if the hacker is not from the US it seems much easier to do the bitcoin hack than try to contact a company thousands of miles away that you know one at.

doomjunky · 5 years ago

I remember last year around christmas/new year 2018/2019 a similar hack/leak/doxxing took place, targeting 994 (!!) mostly german politicians, celebrities and influencers. Massive amounts of private information (names, addresses, phone numbers, e-mails, DMs, contacts, online profiles, chat logs, private documents and even intimate details) where leaked. The data was published on a wide spread of public pastebins and etherpads. It took ages to take them down. The attacker had set up a labyrinth of links, files and passwords and even structured the data by topics and political parties.

Attack vector: Sim-Swapping. It was too easy. As soon as he got into one account, he got access to it's contacts and more phone numbers.

The attacker (0rbit) was a 20 year old student living at his parents home. He bragged about his hack to a online friend. This friend knew that 0rbit had been raided by the police years earlier. He betrayed him to the investigators and with the exact date of the raid the they were able looked up the old case and reveal his identity.

Previously on HN: https://news.ycombinator.com/item?id=18823286

WhyNotHugo · 5 years ago

Quite true. Maybe some unscrupulous 19 year old with average understanding of tech, who happened to have access to the right tools at the right time.

s5300 · 5 years ago

They're not a scammer. They're a massive multimedia conglomerate hacker.

williamdclt · 5 years ago

The typical scammer doesn't hack twitter

dividedbyzero · 5 years ago

But wouldn't that be evident very, very quickly, from just looking at a relevant account's audit log, and shut down right away?

toby · 5 years ago

A senior engineer (juniors would not have this level of access) risking their job and facing prosecution for an amount that would certainly be far less than their salary? That doesn't seem likely.

OriginalPenguin · 5 years ago

Why? It's certainly imaginable Obama's cell phone was targeted.

dvt · 5 years ago

This hack is (quite literally) worth billions of dollars. From market manipulation to geopolitical implications. So yes, 113k is peanuts.

williamdclt · 5 years ago

For taking the risk of impersonating several of the richest and most powerful people of the planet? yeah, I'd say yeah. Of course it's not stopping at 113k, but even assuming it'll stop at 500k I wouldn't say it's worth it

break_the_bank · 5 years ago

Twitter would have probably paid out about $100k for this to be reported via a bug bounty program. $100k is nothing for the risk taken, they could have made a lot more.

paulpauper · 5 years ago

it if seems small it probably because twitter has been under constant attack by crypto giveaway scammers since early 2018. the pool of potential victims has shrunk

JshWright · 5 years ago

That's pennies compared to what a compromise like this would be worth...

break_the_bank · 5 years ago

They could have probably made a 100k by disclosing this to Twitter. The reward/risk graph seems concave down and not convex up.

e2021 · 5 years ago

They could have make >$10m With Elon’s account alone by manipulating the share price. A few 100k is nothing

ErikAugust · 5 years ago

Are you the AOL Pizza? (I’m guessing not but have to ask)

epanchin · 5 years ago

I read about this in the news before I saw it in my Twitter feed. My trust in Twitter has dropped severely.

Why weren’t these tweets deleted immediately and a note pinned to every users feed?

stjo · 5 years ago

Yeah, I'm not sure there is much to be gained from leaking internal data (are DMs that valuable?). The actual scam is executed so poorly that it can't be the main goal too. "Prooving" you have a good exploit by throwing it away is also not plausible.

wisemanwillhear · 5 years ago

Bad idea for the hacker. Stock ownership is public information.

drra · 5 years ago

There is a spike of the short volume on 8th - https://fintel.io/ss/us/twtr

manjalyc · 5 years ago

Doubt it, that would open up too many vectors on an otherwise easily anonymized operation.

jeffbee · 5 years ago

If there is such a level of privilege in Twitter's stack, that says a great deal about their technology. Insiders must not be able to act as users except in prescribed ways requiring two-person control, logged and 100% audited. Glass-breaking privilege escalation should set off every pager in the company.

VectorLock · 5 years ago

After one incident of insider account tampering their entire response was "we must protect Donald Trump's account."

slantaclaus · 5 years ago

Based off the NYT article on the stunt this morning, I believe you are correct. It was a social engineering hack. https://www.nytimes.com/2020/07/15/technology/twitter-hack-b...

londons_explore · 5 years ago

If I were a miner now, I would not reverse these transactions.

Setting the precident that transactions can be reversed will do more harm to the crypto ecosystem than than $100k being taken from gullible users.

hn_throwaway_99 · 5 years ago

Again, nothing. Given the accounts that were hacked, they could easily have moved markets and had pre-placed short bets that would have netted them potentially hundreds of millions.

shdc · 5 years ago

Hmm the thing is, associating it even more with "hack" and "scam" isn't really great marketing.

caetris1 · 5 years ago

I like your thinking. This is a novel idea.

mhh__ · 5 years ago

Walk into the [country] embassy, probably (or twitter these days...)

durpkingOP · 5 years ago

this is not a way for you to demonstrate what can be done to a big client. ignore OP.

kshacker · 5 years ago

I will bite. Without taking a political stance. Imagine you could show GRU that they can make Trump tweet "I just ordered a nuclear strike on..."

What value would you place on this?

The proof will go along with another method of hacking the account that is not disclosed.

cwkoss · 5 years ago

Yeah, the idea that this is an initial step in something bigger doesn't make sense.

If they wanted to exfiltrate data, they already did that previously.

They very loudly burned their access, this seems a lot more like someone trying to monetize their access quickly before their access token expires - squeezing out the last few drops before they can no longer get into the system.

longtom · 5 years ago

So we're likely talking some 50-100 million of dollars being stolen? Insane.

veridies · 5 years ago

Question (I'm not an expert): can unconfirmed transactions be withdrawn? If so, what's the timeline?

icedistilled · 5 years ago

I'm a little unclear, is the following correct?.

So basically rando's are sending famous people bitcoin because the famous people tweeted "send us $$ and we'll send you double back"?

And somehow the rando's haven't heard of the hack. Is this what's happening? Like are random people seriously sending them bitcoin? Or is it some weird form of money laundering?

Although since that's very weird behavior even if there was no hack, I suppose I'm not too surprised that those people sending the coin haven't heard of the hack.

reportgunner · 5 years ago

Zoom out and you see that this is normal every ~14 days.

Also number of transactions is in no way related to amount of money being transferred.

cj · 5 years ago

If DMs were the real loot, they wouldn’t have exposed the hack by tweeting on the account.

xvector · 5 years ago

These are publicly managed Twitter accounts, they probably don't have any DMs of substance.

axaxs · 5 years ago

Interesting theory, but this widespread hack pretty much gives most people plausible deniability in my opinion.

benlumen · 5 years ago

Data theft like that is normally silently dumped after the breach occurs and anyone knows what happened.

This looks more like data injection somewhere. Perhaps an old API exploit. You used to be able to send an SMS to tweet, for example.

reilly3000 · 5 years ago

I think that's the case. No prominent Republicans were targeted. See: Watergate, Wikileaks DNC emails. Same shit.

canjobear · 5 years ago

Blackmail targets could still deny them.

ben174 · 5 years ago

Interesting theory, but then why would they include Apple? Among others in the list, they’re almost guaranteed to be of no value and only increase the risk.

vlz · 5 years ago

What does "DM" mean in that context?

(Went to wikipedia, but their suggestions like Death Metal and Dance marathon are probably not it ;) https://en.wikipedia.org/wiki/DM )

panopticon · 5 years ago

Twitter acknowledged the incident over two hours ago: https://twitter.com/TwitterSupport/status/128351803844522393...

Answerawake · 5 years ago

Do they seem the type of people that would send anything sensitive over Twitter DMs? I'd imagine if anything at the very least they would use iMessage or some messaging app of that nature. Biden seems like the type of guy who relies on e-mail.

WrtCdEvrydy · 5 years ago

I thought it was just me, but yes... please send me your ISK and I will double it... here's a website with a wallet thing that shows we sent out money... everytime we received some.

nseggs · 5 years ago

Lol not even close

WillPostForFood · 5 years ago

Real estate developer by day, elite hacker at night?

jessriedel · 5 years ago

You could move many, many millions of dollars on the stock market with these accounts. Would require more care and/or tricks to avoid being apprehended than a simple anonymous bitcoin scheme, but the pay off could have been at least a couple of orders of magnitude higher.

samanator · 5 years ago

Wow that's brilliant. I didn't think of that. If someone had a non trivial amount in stock shorts, they could stand to make an exorbitant amount of money.

the_gipsy · 5 years ago

"destroyed", a bit exaggerated, mate.

vb6sp6 · 5 years ago

based on what?

nkozyra · 5 years ago

"few BTC" is relative to the value of what they had, not the average income of the average person.

If I sold a 7500 sqft home in San Fransisco for $200,000 you could say the same thing.

aqme28 · 5 years ago

Sounds like they need to adapt to market conditions.

totony · 5 years ago

Yeah, this could've been very bad. I don't buy that it's a test. Twitter is going to fix this. Probably it's a restriction of the exploit that you don't know the posting account or something.

DevX101 · 5 years ago

This hack could absolutely get people killed. There are several tweets I can think of from POTUS that would begin immediate military mobilization from an unfriendly country.

BiteCode_dev · 5 years ago

Or just post some white nationalist call for arm. The US is ripe for a blood bath right now.

hn3333 · 5 years ago

That's assuming Tweets actually serve an actual diplomatic function and are not merely marketing/propaganda for voters.

(Also POTUS is not authorized to declare any wars btw.)