What's the source for this? I was wondering how they were able to tweet from people's accounts.
-
Ever wanted an RSS feed of all your favorite gaming news sites? Go check out our new Gaming Headlines feed! Read more about it here.
-
We have made minor adjustments to how the search bar works on ResetEra. You can read about the changes here.
Large Twitter accounts, including Elon Musk and Bill Gates, got hacked to promote a crypto scam
- Thread starter Deleted member 43084
- Start date
The other thing I saw pointed out is this could lend credibility to release of fake DMs.
I get it but, he is culturally perceived as liberal. This attack may well also be political.
I'm sure somenoe else has hacked everyones twitter account before and read the DMs and they just did not decide to blow up their spot by tweeting for money
no, this bitcoin scam thing has been around in some form for a while and i'd just constantly see trump supporters retweeting it from fake accounts in their responses. the tweets coming from real verified hacked accounts is new tho
"Just shut it down" for a service as massive and intricate as Twitter is not only a huge decision to make, it's probably also way more complicated than you think it is. I'm sure it is a fucking dumpster fire over there right now trying to get a handle on this. And if they are trying to find the source of the hack or gather more information, doing anything drastic could hurt their chances of being able to perform a proper forensic analysis.
read the text hidden in the "address"
"just kidding you cant hack god"
its a joke XD
Check any of the accounts by doing a password reset any that haven't been fixed still point to a domain which starts with p (protonmail), and it's the same for a lot of them.
Not to mention the twitter employee dashboard I posted recently.
Yes, because you get verified on ERA by working in the crypto industry :)
Another good point -- these types of tools are usually gated on access from within their corp net, so VPN access would most likely be required. What's astounding is how they are still going when this has been happening for going on an hour now..it should be relatively easy to shut this down.
What I mean is, a Twitter employee had their corporate Twitter SSO account compromised.
Once the "hacker" has access to the employee account via their compromised credentials and access to whatever MFA is required for Twitter employees, they now have the keys to the kingdom.
They can access the internal corporate network via Twitter's VPN, and access any internal/support/eng privileged tools that user has access to. These tools often times give you essentially "superuser" access to anyone's account, with the ability to "impersonate" that user, i.e. it will create a logged in session for you with that user's account in production Twitter without the need to actually go through the login flow that particular user has setup. This is usually helpful for debugging account-specific issues you can't troubleshoot otherwise.
All a guess. What is really weird is that, there must be extensive logging for this kind of stuff, so you'd think in this amount of time Twitter would have already figured out which account was doing this and revoked all its access..unless there is really something else.
It'd be even more intriguing if they used an employee tool to just arbitrarily change emails and send password resets. Yikes.
A lot of people are just doing a joke now lol (read the Hard Drive mag wallet address)
Damn. I'm really interested on how it's being done. What kind of exploit they took advantage of or something else.
How much would a bug bounty of this kind be worth to Twitter if that's how they did this? Has to be worth more than what they have actually scammed.
I doubt this is a bug but rather a employee that goes phished
Most likely compromised an employee panel for the site and was able to reset the accounts of hundreds/thousands of blue checks. They've probably been in there a while too.
thats the interesting part! Bug bounties should be far, far higher for stuff like this. like SO much higher
So while we're on the subject, if I activate 2FA via an authentication app, should I keep the SMS 2FA active as well or disable that?
Edit: Authentication App 2FA seems to be busted at the moment anyway; tried on multiple browsers. I'll give it a few days and try again, keeping SMS active for now.
Edit: Authentication App 2FA seems to be busted at the moment anyway; tried on multiple browsers. I'll give it a few days and try again, keeping SMS active for now.
Yup, I ve seen plenty of tweets from acounts like "El0nmusk" or EIonmusk" (capital i instead of L) about bitcoin giveaways followed by lots of bots thanking for the donation before. This is a known scam that goes on Twitter, but using real verified accounts is crazy.