News: 1594879751

I can't believe I'm the first person to comment on this topic.

I can't believe you came out of hiding after best part of a year – having posted only two things in the last nearly four years – just to post that. I guess maybe you're usually AC. Also, you weren't the first. Just that someone else got cold feet and deleted it. But maybe that was you too. In summary: what?

I was thrown off Twitter because I refused to give them my mobile number.

Sod 'em.

I just gave them a number of an old telemetry SIM I had access to. Other than the initial verification code they don’t seem to use it. If they did, they’d be getting no answer from a data station in the middle of Ireland.

... and nothing of any value was lost.

... and nothing of any value was lost.

Unless you were one of the simps transferring your $1000 BTC hoping a Billionaire will double it for you for shits n giggles.

I suppose in theory the BTC isn't actually lost, to quote Gekko "Money itself isn't lost or made, it's simply transferred from one perception to another". That's $100,000 in BTC definitely transferred in someones perception.

That's $100,000 in BTC definitely transferred in someones perception

Given that they were gullible enough to fall for this scam they were only ever going to be a temporary custodian of those BTC

Both Xi Jinping and Trump's twitter accounts being hacked and being used to start a war.

On second thought, Trump doesn't need to have his account hacked to do that.

How many wars has Trump started during his time in office? How does that compare to every other President in the last.. 200 years?

Hey, he isn't gone yet. Give the man a chance!

I don't think he has the attention span to start one. Even if he did start one, when it starts going wrong, he'll deny it ever happened and it was someone else's fault, even though it was just him joking.

I wonder if hackers too the time to harvest the compromised accounts DMs... interesting times ahead.

Assume most Twitter Admins working from home, so remote access a given. Plus probably running some BOYD build on an average joe wifi-router + ISP build which would be an easier target? Can't see Twitter being the sort of company that goes in for locked down corporate builds for it's employees?

Surely they'd have a VPN with 2FA before letting anybody near a vital internal system?

Agreed, but a) VPN's have holes (several high profile solutions have had exploits exposed recently). and b) if you hack the machine that has the VPN connection... Especially if that VPN is split tunneled...

The ideal of course is two workstations - one locked down tight for Admin tasks - but you send the people home, do you send them home with two laptops, again one locked down in such as way as it can only remote to the Admin box in the office? But then that's on the same wifi as your family kit, sky+, Alexa, ... So that should be on another network (4G maybe)... All nice, but this was short notice, so what setup did they have...

Also, it looks like they had access to a user admin panel (but perhaps not much else) so would all these security layers be in place, for a user support body...

I see, there was "a coordinated social engineering attack", or in layman's terms: "some of our staff fell for phishing"

or should that be "some of our soon to be ex-staff fell for phishing"

It does make you wonder how sophisticated it was, how they are going to prevent this in the future, and of course how many heads will roll.

Someone recently asked me whether I was on Twitter. The answer was "no", and that doesn't look like it is going to change any time soon, not just because of privacy concerns, but I also have the El Reg Commentard section to vent my more unhinged opinions

I did try Twitter once for six hours before deleting the account (only you can't really delete it, just as well it was in the name of a medieval theologian.)

Believe me, by Twitter standards I don't think you could even achieve an unhinged opinion.

I can't imagine any tweet they could have put from the POTUS's account that is any more unbelievable than the ones he normally puts out...…..

The red panic flag would possibly only be raised if the tweet was intelligent, correctly phrased and cogent.

So once again greed triumphs over common sense. I these people who paid Bitcoins if they went on the sucker list before they will be now. In recent news most of these celebrates (also known as rich people) have expressed interest in giving back something which makes this more plausible which goes back to greed.

I sympathies those of you who are having problems with twitter. In many ways they seem to have done it to them self's despite leaving the reservations (Facebook/Google) but they are a cooperate organization their to make money.

JimPoak, is English not your first language are or you just enjoying a pint of whisky?

Agree with your point regarding the comparison with other social media companies - they are all there to make money and not necessarily there to make the world a better place.

I do hope you're not a highly-paid IT pro...otherwise we're all fsck'd

He's a Twitter admin.

You could tell Trump's account had been hacked when it started making sense.

I notice Trump's name or indeed any allies of Trump are conspicuous by their absence.

"I notice Trump's name or indeed any allies of Trump are conspicuous by their absence."

It were Trumpy wot done it!

I don't think anyone would trust our Con-Man in Chief to double their donation. A general stereotype of Republicans/Conservatives is that they do not like handouts. That's could be why they were not targeted.

They do love handouts as long as they're trousering them

I've read elsewhere that Trump's account may be more protected, because if it got hijacked, it could have grave consequences…

Sounds like a well executed plan, and scary if the numbers are accurate as to how many people fell for it.

What got me is the request is so obviously a scam "send me money and I'll send you twice back", most people should have thought that was too good to be true. I would have thought they would have had a better conversion rate if they had said "Donate 1 bitcoin to this address and I'll match your donation to help COVID", that I think would have got past more peoples mental barriers.

So Twitter have been subject to a deeply embarrassing attack which will do long-term damage to their business. The same Twitter recently censored tweets from their most high-profile user, claiming that they contained provable falsehoods. Said high-profile user, in his day job as President of the United States, authorized a certain intelligence agency to carry out cyber attacks with little oversight (see story on this very site) some time ago.

I shall have to add some more tinfoil to my hat...

Oh I don't know in today's world......

It's ' all the not so famous user accounts that would be more interesting with an election coming up...

I have a bigger hat

So, here I have a wonnerful offer for all you ElReg listeners.

Send me yr money and Ill dooble it. YES! TRUE!!

Send mnoey to my untrasable offshore accountg and Ill send yoo back dooble.

Dont daly. This gullibility won't last 4ever.*

*Unfortunately this bit is not true.

No probs here is all me savins

£0.00

Can u duble it for me?

No probs here is all me savins £0.00 Can u duble it for me?

Ignore their scam, my scam can increase your savings 100-fold!

There will be a small administration fee payable up front, which will be returned with your increased savings.

.... there's nothing the company can do to mitigate an attack until its happened. Hopefully they'll find this person and throw the book at them. While it might seem amusing to do it from various CEO accounts imagine if it had been from a hospital/government/police/large media provider account saying there'd been a new mass pandemic outbreak/terrorist attack etc.

Something ain't right here. This lame bitcoin scam stinks of a diversion.

Yep, agreed. Sending out a Bitcoin scam request via a few rich peoples accounts sure seems to have grabbed the attention of everyone but what else might also have happened at the same time. I guess you only have a limited time before these sort of account takeovers get discovered so sending out these lame tweets from celebs accounts does seem like a diversion. I guess we'll never know.

if some unknown "miscreants" have been able to do it, why not any other, with - perhaps - similar or better skills and tools and with entirely different motives. Given how politicians have employed twitter to police the world, I can see a Mr President announcing, out of the blue, that yes, we are launching an all out nuke war against China (or not). I just hope that the Russians in charge of such accounts are not too drunk to do it as a prank.

This would be an amusing way to tell the West that 'we can access your systems no matter whose hardware they're running on'.

Maybe, or it could be exactly as the crooks said and they had paid one.

A few grand is tempting for a low paid offshorer.

...would have Elon Musk account posting about Tesla plans, and betting on the stock market reaction. Billions to be made not a few grand.

Such a stock market move would stick out like a sore thumb.

It’s a pity I don’t teach infosec classes any more, this would make a perfect example to show the senior techies how a breach happens.

However from Twitters response I suspect someone found a weakness in their password reset system and they are putting up a smokescreen whilst they fix it. Either that or their separation of duties system is horrendous.

English is my first language but my sentence structure is odd when I remove the swearing.