Privacy News Hackers exploit suspended & inactive Twitter accounts

[Logethica]

Hackers exploit suspended and inactive Twitter accounts:
SOURCE: ibtimes.com (ARTICLE DATE: 3 Sep 2016)

A hacker group has claimed to have discovered an exploit that allows them to seize and reactivate suspended and inactive accounts on Twitter. The group called "Spain Squad" was reportedly able to briefly reactivate accounts that were previously banned from the platform including @Hitler, @1337, @DarkNet, @LizardSquad and @Hell and take control of them with the hope of selling the infamous screennames to the highest bidder, Business Insider reports...

While handles such as @Hitler, @LizardSquad and @Hell were previously suspended by Twitter, other accounts like @AK47, @1337 and @megaupload have been inactive for a while. If an account is found violating Twitter's rules or terms of service by engaging in abusive activities such as spam, harassment, hateful conduct or promotion of violence, it may be "temporarily locked and/or subject to permanent suspension." Once suspended, there is usually no way of creating a new, separate account with the same screenname or reinstate it without the company's go-ahead.

If an account has been inactive for some time or abandoned by a user, the account isn't usually deleted by Twitter, basically rendering it unavailable for anyone else to claim.
"Suspended and deactivated usernames are not immediately available for use, so you'll need to select a different username," Twitter's support page on claiming certain usernames reads. "Unfortunately, these usernames cannot be released at this time."

Spain Squad, however, claimed that it could not only bring back suspended and inactive accounts, but change a user's Twitter handle, take control of another active account and even suspend it. The group even tweeted to notorious hacking collective PoodleCorpsaying "im going to change your @ to @skids okey?"

However, it has only reportedly demonstrated the exploit to reinstate officially suspended accounts.

"For sell @botnet @Hitler @darknet @LizardSquad @nazi @ak47 @bypass @Hell etc," the group tweeted on 2 September to try and sell the accounts on the platform, providing users with an email to contact them if interested..

[To read the full article please visit ibtimes.com]​

 

[SpartacusSystem]

There's nothing on my Twitter to be exploited! Unless you want a bunch of SoundCloud shares and articles.

 

[_CyberGhosT_]

I use mine every day, all of my Twitter content
is Security related, they can read that if they want

 

[Omnipotent]

I use mine every day, all of my Twitter content
is Security related, they can read that if they want

This got me thinking.. This might be a little off-topic but, wouldn't having your security configuration posted on MalwareTips leave you vulnerable if someone was attempting to DOX/Infect your PC with malware? They would only have to code malware to bypass your whole security configuration. Preferably they would create some zero-day exploit and use social engineering to infect you. Maybe it would be a good idea to limit guests from viewing peoples security configuration.

 

[DardiM]

No twitter account

 

[SHvFl]

They should take my account and read the spam i post. That will show them.

 

[SpartacusSystem]

This got me thinking.. This might be a little off-topic but, wouldn't having your security configuration posted on MalwareTips leave you vulnerable if someone was attempting to DOX/Infect your PC with malware? They would only have to code malware to bypass your whole security configuration. Preferably they would create some zero-day exploit and use social engineering to infect you. Maybe it would be a good idea to limit guests from viewing peoples security configuration.

I wouldn't mind someone having a go, let's see how top their skills are.

 

[Exterminator]

Twitter account is inactive for well over a couple years.Facebook account is inactive also.No social media for me as it poses too much risk in employment and to family.

This got me thinking.. This might be a little off-topic but, wouldn't having your security configuration posted on MalwareTips leave you vulnerable if someone was attempting to DOX/Infect your PC with malware? They would only have to code malware to bypass your whole security configuration. Preferably they would create some zero-day exploit and use social engineering to infect you. Maybe it would be a good idea to limit guests from viewing peoples security configuration.

I don't think a generic security configuration posted by a member with only a username would leave you vulnerable to a DOX infection.
It is distributed through infected websites,social networks,spam/infected emails or malicious websites.
Since this is not a malicious website with no ads and two-step verification I doubt you would be vulnerable here especially from a security configuration post.
As guests are unable to post replies or PM members they can only view a security configuration and although they can read a profile page and information about a member this information contains no personal information that could be used by a would be attacker.

 

[Omnipotent]

Twitter account is inactive for well over a couple years.Facebook account is inactive also.No social media for me as it poses to much risk in employment and to family.


I don't think a generic security configuration posted by a member with only a username would leave you vulnerable to a DOX infection.
It is distributed through infected websites,social networks,spam/infected emails or malicious websites.
Since this is not a malicious website with no ads and two-step verification I doubt you would be vulnerable here especially from a security configuration post.
As guests are unable to post replies or PM members they can only view a security configuration and although they can read a profile page and information about a member this information contains no personal information that could be used by a would be attacker.

Yes, MalwareTips is a safe website. But if you use the same username on every online account you have and someone is attempting to gather as much information about you, they stumble upon this website and see your whole security configuration. They would of already found your e-mail by then whilst doxing you, if the attacker has zero-day malware and your e-mail they could use social engineering and e-mail you something too good to be true, tricking you into clicking onto the website and getting infected by a drive by exploit that your anti-virus nor your anti-exploit program can detect. I know it sounds stupid, but some people that hate you can go that far. There are many undisclosed zero-day's sold on the black market. Over 50% fall victim to click-bait just like your news post.

 

[SpartacusSystem]

Yes, MalwareTips is a safe website. But if you use the same username on every online account you have and someone is attempting to gather as much information about you, they stumble upon this website and see your whole security configuration. They would of already found your e-mail by then whilst doxing you, if the attacker has zero-day malware and your e-mail they could use social engineering and e-mail you something too good to be true, tricking you into clicking onto the website and getting infected by a drive by exploit that your anti-virus nor your anti-exploit program can detect. I know it sounds stupid, but some people that hate you can go that far. There are many undisclosed zero-day's sold on the black market. Over 50% fall victim to click-bait just like your news post.

I do use the same username across many sites. I'm careful of what I post online also. They can gather all they want about the stuff I post! It's more or less, other people's content.

 

[DardiM]

Yes, MalwareTips is a safe website. But if you use the same username on every online account you have and someone is attempting to gather as much information about you, they stumble upon this website and see your whole security configuration. They would of already found your e-mail by then whilst doxing you, if the attacker has zero-day malware and your e-mail they could use social engineering and e-mail you something too good to be true, tricking you into clicking onto the website and getting infected by a drive by exploit that your anti-virus nor your anti-exploit program can detect. I know it sounds stupid, but some people that hate you can go that far. There are many undisclosed zero-day's sold on the black market. Over 50% fall victim to click-bait just like your news post.

You are talking about targeting. Most attacks are mass attacks (not Mars attacks ), with a list of e-mails.
I think they don't need to know the configuration of people that are in this "big" list.
They just go "fishing", and wait for persons to fall into the trap.

If they target a member that posted its configuration, it can even stop them, they are often looking for facility, not for spending a lot of time for only one member, or this member should be a well known and/or an important person to be targeted

Some examples of messages :

In less than 7 days (copy and paste from a post in analysis) :

Spoiler: Examples

- Attached is the list of old office facilities that need to be replaced. Please copy the list into the purchase order form.

- Here is the travel expense sheet for your upcoming company field trip. Please write down the approximate costs in the attachment.

- Attached is the bank transactions made from the company during last month.

- Please file these transactions into financial record.

- Please sign the attached purchase of the office equipment. We will send you back the receipt afterward.

- Hello, as you requested, attached is the paycheck for your next months salary in advance.
=> my favourite

An advice : We must always look at the e-mail of the sender

 

[safe1st]

I only use twitter for giveaways, check some news and all about whats trending right now
But VERY VERY rare to tweet something...
So i dont know which one I should vote

 

[Cohen]

I mainly just use my Twitter account for MalwareTips giveaways.

 

[jamescv7]

Barely using Twitter account, well the thing I don't like where it creates more spammer account compare to Facebook. The claimed users are not real identity but bots.

 

[hjlbx]

You want my Twitter account... you can have it.

 

[SpartacusSystem]

You want my Twitter account... you can have it.

Email and password whenever you're ready.