Bryce
Going Hard
- Joined
- Dec 8, 2024
- Posts
- 27,171
- Reputation
- 63,181
Take Graham Ivan Clark for example. After getting into Twitters administrative database, he logged into Obamas account, Musk's account, Apples account, and more. This kid had the ability to incite a global conflict but instead ran a crypto scam and only made $100k which ended up getting seized. All he did was pose as an employee, tell another employee there was an issue with Twitters internal VPN, sent them a phishing link, and used their login info to find a manual about logging into accounts with the database alongside it.
What I find funny is that most people seem to believe hackers are these computer geniuses who know how to crack passwords on a whim and program malware capable of taking over the world, but in reality, 99% of these attacks are done via social engineering or simple identity fraud.
Take push-bombing for example. Back when MFA was less secure, a hacker could buy or find a comprised account at a business, spam an employee's phone with MFA messages, and hope they'd click one out of annoyance or confusion. Just by simply pissing someone off, they could gain access to the entire business depending on who they got. This happened to Uber in 2022. And what did the hacker do? He trolled and sent messages to employees on Slack.
Think of it, this guy could've viewed proprietary source code, discover vulnerabilities, copy intellectual property, leak millions of customers accounts, sell driver information, or even find a path from employee systems to production databases. Yet he decided to mess around and tell employees that he hacked Uber.
I think it proves the real vulnerability is not the tech, but the people in charge of the tech.
What I find funny is that most people seem to believe hackers are these computer geniuses who know how to crack passwords on a whim and program malware capable of taking over the world, but in reality, 99% of these attacks are done via social engineering or simple identity fraud.
Take push-bombing for example. Back when MFA was less secure, a hacker could buy or find a comprised account at a business, spam an employee's phone with MFA messages, and hope they'd click one out of annoyance or confusion. Just by simply pissing someone off, they could gain access to the entire business depending on who they got. This happened to Uber in 2022. And what did the hacker do? He trolled and sent messages to employees on Slack.
Think of it, this guy could've viewed proprietary source code, discover vulnerabilities, copy intellectual property, leak millions of customers accounts, sell driver information, or even find a path from employee systems to production databases. Yet he decided to mess around and tell employees that he hacked Uber.
I think it proves the real vulnerability is not the tech, but the people in charge of the tech.
