7 ms·

Quite possibly this isn't a hack and someone got a Twitter admin's account, then got access to the admin panel and "all" accounts without having to hack much of

Quite possibly this isn't a hack and someone got a Twitter admin's account, then got access to the admin panel and "all" accounts without having to hack much of anything.

jeffbee 6y ago
If there is such a level of privilege in Twitter's stack, that says a great deal about their technology. Insiders must not be able to act as users except in prescribed ways requiring two-person control, logged and 100% audited. Glass-breaking privilege escalation should set off every pager in the company.
- shakezula 6y ago
  this assumes two things: that there is a security model that would prevent this attack that they should have implemented, and that alarms _weren't_ set off. Both of those are weak assumptions.
  - GVIrish 6y ago
    I don't think parent was assuming those measures are implemented. They were saying that they should be implemented and if they are not, it betrays seriously poor security posture at Twitter.
- somehnguy 6y ago
  Sorry, but would you mind expanding slightly on how you would implement such a system? In my understanding once you remove all the layers of abstraction as some point it's a bunch of databases and data stores. Someone has to manage them. Why wouldn't a breach of those users be able to do whatever they want? And a higher level, someone is writing the code to implement such a stringent access system. Why wouldn't a breach of those users (or a rogue employee) be able to accomplish bad things?
  - jeffbee 6y ago
    Glad you asked. "There is a database and some guy is the DBA" is a very outdated architecture that can get you passing grades as an undergraduate and that's about all its good for. You should not take as a given that the right to modify datastores falls ultimately upon some individual. It is possible to permanently discard this ability, and organizations should strive for that.
    - somehnguy 6y ago
      Thats not what I meant, sorry. How do you implement such a system? So theres a team to manage the datastores, but that changes nothing that on some level someone somewhere has root passwords and/or filesystem access and/or ability to modify the fleet. We all know access controls and multiple operators are good, yeah. But at the heart of it is still a bunch of linux machines that have to be managed and deployed to. Which as far as I know has no mechanism for check with operator x before running command from operator 0.
      - adamantoise 6y ago
        AWS KMS has a great whitepaper explaining how they do it here: https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Detai... The tl;dr is that they use hardware security modules (HSMs) with quorum-based access controls. Any administrative actions such as deploying software or changing the list of authorized operators requires a quorum of operators to sign a command for that action using their respective private keys. While this system was designed specifically around protecting customers' private keys, you could imagine a similar system around large databases.
      - cardamomo 6y ago
        Your comment got me thinking: what does Twitter's infrastructure look like. This is from 2017, so I'm sure it's changed since then, but I found it interesting: https://blog.twitter.com/engineering/en_us/topics/infrastructure/2017/the-infrastructure-behind-twitter-scale.html https://blog.twitter.com/engineering/en_us/topics/infrastruc...
- belorn 6y ago
  > requiring two-person control, logged and 100% audited That would be good from a security perspective, but it would cost additional training, require more support staff, increase response time between request and resolve, make the system more complex and possible fragile, and take development resources away from profit centers. Most companies has likely, at best, the same security at their internal support center as their accounting department, and given how common CEO fraud is, it mean social engineering will likely continue to be a major attack vector for a long time.
VectorLock 6y ago
After one incident of insider account tampering their entire response was "we must protect Donald Trump's account."
- C1sc0cat 6y ago
  If you do that to a head of state its very visible and leads to major changes. Same as when a journalist in the UK got a temp job in BT's office in Edinburgh and looked up the queens unlisted phone numbers at Balmoral - lead to a major security incident and massive changes.
  - VectorLock 6y ago
    I bet you in this case not a lot changed. As you can see tons of accounts weren't "protected."
    - C1sc0cat 6y ago
      In BT it was 3 months later and the only way I could get in that building was if I was personally vouched for by some one the security guards knew. This was a v high profile project we had two board members as sponsors. Later on I knew that some team leaders had to be Vetted and this is Developed Vetting - this is the same as TS clearance I could see this happening in FANG companies to
slantaclaus 6y ago
Based off the NYT article on the stunt this morning, I believe you are correct. It was a social engineering hack. https://www.nytimes.com/2020/07/15/technology/twitter-hack-bill-gates-elon-musk.html?referringSource=articleShare https://www.nytimes.com/2020/07/15/technology/twitter-hack-b...

Quite possibly this isn't a hack and someone got a Twitter admin's account, then got access to the admin panel and "all" accounts without having to hack much of anything.

jeffbee 6y ago

If there is such a level of privilege in Twitter's stack, that says a great deal about their technology. Insiders must not be able to act as users except in prescribed ways requiring two-person control, logged and 100% audited. Glass-breaking privilege escalation should set off every pager in the company.

shakezula 6y ago
this assumes two things: that there is a security model that would prevent this attack that they should have implemented, and that alarms _weren't_ set off. Both of those are weak assumptions.
- GVIrish 6y ago
  I don't think parent was assuming those measures are implemented. They were saying that they should be implemented and if they are not, it betrays seriously poor security posture at Twitter.
somehnguy 6y ago
Sorry, but would you mind expanding slightly on how you would implement such a system? In my understanding once you remove all the layers of abstraction as some point it's a bunch of databases and data stores. Someone has to manage them. Why wouldn't a breach of those users be able to do whatever they want? And a higher level, someone is writing the code to implement such a stringent access system. Why wouldn't a breach of those users (or a rogue employee) be able to accomplish bad things?
- jeffbee 6y ago
  Glad you asked. "There is a database and some guy is the DBA" is a very outdated architecture that can get you passing grades as an undergraduate and that's about all its good for. You should not take as a given that the right to modify datastores falls ultimately upon some individual. It is possible to permanently discard this ability, and organizations should strive for that.
  - somehnguy 6y ago
    Thats not what I meant, sorry. How do you implement such a system? So theres a team to manage the datastores, but that changes nothing that on some level someone somewhere has root passwords and/or filesystem access and/or ability to modify the fleet. We all know access controls and multiple operators are good, yeah. But at the heart of it is still a bunch of linux machines that have to be managed and deployed to. Which as far as I know has no mechanism for check with operator x before running command from operator 0.
    - adamantoise 6y ago
      AWS KMS has a great whitepaper explaining how they do it here: https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Detai... The tl;dr is that they use hardware security modules (HSMs) with quorum-based access controls. Any administrative actions such as deploying software or changing the list of authorized operators requires a quorum of operators to sign a command for that action using their respective private keys. While this system was designed specifically around protecting customers' private keys, you could imagine a similar system around large databases.
    - cardamomo 6y ago
      Your comment got me thinking: what does Twitter's infrastructure look like. This is from 2017, so I'm sure it's changed since then, but I found it interesting: https://blog.twitter.com/engineering/en_us/topics/infrastructure/2017/the-infrastructure-behind-twitter-scale.html https://blog.twitter.com/engineering/en_us/topics/infrastruc...
belorn 6y ago
> requiring two-person control, logged and 100% audited That would be good from a security perspective, but it would cost additional training, require more support staff, increase response time between request and resolve, make the system more complex and possible fragile, and take development resources away from profit centers. Most companies has likely, at best, the same security at their internal support center as their accounting department, and given how common CEO fraud is, it mean social engineering will likely continue to be a major attack vector for a long time.

VectorLock 6y ago

After one incident of insider account tampering their entire response was "we must protect Donald Trump's account."

C1sc0cat 6y ago
If you do that to a head of state its very visible and leads to major changes. Same as when a journalist in the UK got a temp job in BT's office in Edinburgh and looked up the queens unlisted phone numbers at Balmoral - lead to a major security incident and massive changes.
- VectorLock 6y ago
  I bet you in this case not a lot changed. As you can see tons of accounts weren't "protected."
  - C1sc0cat 6y ago
    In BT it was 3 months later and the only way I could get in that building was if I was personally vouched for by some one the security guards knew. This was a v high profile project we had two board members as sponsors. Later on I knew that some team leaders had to be Vetted and this is Developed Vetting - this is the same as TS clearance I could see this happening in FANG companies to

slantaclaus 6y ago

Based off the NYT article on the stunt this morning, I believe you are correct. It was a social engineering hack. https://www.nytimes.com/2020/07/15/technology/twitter-hack-bill-gates-elon-musk.html?referringSource=articleShare https://www.nytimes.com/2020/07/15/technology/twitter-hack-b...