What You Can Learn From The Twitter Hack

🚨 IMPORTANT:

Recently, Twitter was the victim of a $100,000+ hack that effected hundreds of users. While you may think this was the cause of some clever computer programmer hacking into Twitter's defenses, in actuality, this hack was caused by Twitter's own internal development tools. These tools were leaked via a social engineering hack which led to hundreds of huge accounts posting messages that scammed hundreds of innocent people out of their own money.

In this video I will be explaining exactly how this hack happened, how Twitter messed up, and what you can learn from Twitter's mistakes.

🧠 Concepts Covered:

- What social engineering is
- How to avoid social engineering
- What happened with the Twitter hack

🌎 Find Me Here:

#SocialEngineering #WDS #TwitterHack

[FalseDev]

Your channel is that one channel that I can trust with my eyes closed, LITERALLY.
The best programming channel ever

[tsg]

Just came here from the "How to make tabs with HTML/CSS" video and I have to say, I love this channel so much man!

[dkras]

They found the login in an internal Slack channel

[pandit-jee-bihar]

Was it technically even a hack ? Given that the credentials for an internal tool used by support team got leaked.

Picking a lock without key is different from getting hold of the key.

[adamaaronson]

Really nice breakdown, getting straight to the point!

[nsharma]

Though I'm nowhere near being part of a giant like Twitter, I must say I was hooked for 14 mins. Kyle, you have amazing narration skills too! A great, enlightening video as always. Thank you!
PS - I loved how non-judgy you were towards the victims of the hack too 😊

[martinlutherkingjr.]

We don’t know how much of that $100k is actually from victims, it could easily have just been the scammers sending their own Bitcoin to make it look like people were sending funds to the address.

[asagiai]

If I have an employee that just give or say something like "hey here's the development tools that can access anything you like or something"
Not only he/she gonna get fired. He or she may also be sued or something.

[mykalimba]

Admin CPs (control panels) are a necessity for a "live" product like Twitter. There's really no reason to completely neuter them in your production environment -- the problem should be addressed by maintaining limited access to the CP. You should have different tiers of admin rights, and accessing the CP should be extremely difficult, like every login requiring 2FA and maybe even that admins be on company VPN.

[DarylLegion]

UPDATE: 5:08 You were completely correct!. Twitter posted an update late Thursday on the situation

[mk]

Your channel is the best, 10/10 and will check out your contents regularly!

[kanz]

Thank you for highlighting this! Its a important learning for Web Developers!

[harry-cee]

I appreciate what you are saying. But, You are continually wrongly referring to it as a "Development tool". Rather it is a "Production Support tool" which is much needed for live/ real-time support assurance. I do agree on how Twitter and companies alike, need to review and revisit their resource access/ security policies and back up measures (like multi-level alerting/ approvals) etc.

[deniskomarov]

Interesting video! And the hackers companies hire are called White Hats, pentesters, or ethical hackers. They have a specified amount of time to find as many flaws as they can and generate a report based on their findings, for the company to review & mitigate security flaws.

[froozynoobfan]

that is why there are identity and access management & previleged access management tools

[grayhat_x]

Really glad that I found and subscribed to this channel.
Keep up the good work man!

[s.e.]

12:38 make me think of Mike Ehrmantraut, from breaking bad, when he was hired as a Security Consultant

[tacowilco]

Kyle, I think you are thinking too high of Twitter. I used to work with Facebook, Amazon and Apple engineers. Their development processes are chaotic and very disorganized (from team to team though). Especially in Facebook, where the company itself is "developer-driven" (i.e. no formal processes). I imagine that similar shit show happens in Twitter.

[yellemonster]

Can you recommend any resources or tutorials that show how to implement good/solid security protocols on a Node back-end and React front end?

[universenerdd]

companies who put backdoors into their products should see this coming, and a lot of people don't even realize they have a backdoor, i'm sure you don't know that they're is a backdoor in you're cpu