Hacker News new | past | comments | ask | show | jobs | submit login
Indian Prime Minister Narendra Modi’s Twitter Account Gets Hacked (bloombergquint.com)
102 points by superasn on Dec 12, 2021 | hide | past | favorite | 74 comments



I am pretty sure it was social engineering. One can't seriously think only Modi logs into his twitter. I mean look at his instagram page; the guy is self obsessed and has team of midwits working in his IT cell.


self obsession - Modi posted an obituary the other day with 4 pictures of himself attending the funeral.


> self obsessed

You mean like the rest of the people on Instagram?

Even if it's not Instagram, that is what most politicians do to stay in power (advertising things done by them and hiding the things detrimental to them)


Quite a bit more than that. He's got his photo on covid certificates, among others.


This feels vague and whataboutism-ish. He's known to be particularly that way inclined.


Can you explain what insta and twitter is for, if not self promotion?


I just wonder if the hacker tweeted "Effective immediately all 2000 rs notes are demonitized. Official announcement at 9pm."

Would have crashed the whole bloody stock market.


And this is what kind of indicates it was not state sponsored.

Won’t be really surprised if an IT Cell team lead unwittingly handed over control of the account to an enterprising cousin for a while :D


I can think of a few other things which would have a bigger impact.

"Suck it Pakistan, missiles launched"

"Britain did nothing wrong"

"After 3000 years of struggle we've finally invented the toilet"


Looks like the hacker was like a dog chasing cars. Didn't know what to do with the account once they hacked it.


Maybe they invested a lot of personal money in BTC, tweeted, and hoped for a large short-term gain from the increased value of BTC?


Then they would have just posted a credible sounding message instead of an obviously shady looking link.

Saying, “My advisory team studied safest crypto currencies. We are considering making Bitcoin as official digital currency of India”, would have worked better.

Or “From X:Ypm we are making Bitcoin India’s only and official currency”. Given his track record I might have beloved it.

I think it was what happened - chasing dog getting the car.


Don't expect the crypto fanatics of Twitter hacks to exercise discretion. Remember the 2020 doubling scam [1]? Hundreds of high profile accounts hijacked and the best they could do is the most ancient trick in the book.

I have to wonder what the combined effect of all these scams is on the BTC price. It can't be good for public opinion for Bitcoin to be "that thing that hackers and scam artists keep promoting on twitter".

1. https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking


Twitter should have 2FA enabled by default. Most national governments, agencies and leaders are on twitter. Passwords are inherently insecure and things can get ugly real fast.


Passwords (when you use a password manager) are as secure as your computer.

If your computer is compromised, you are out of luck anyhow. As the attacker then can just use your logged in browser or app to post whatever they like.


Passwords are at most as secure as your computer.

There are many ways to compromise passwords other than achieving access to the user's computer, such as phishing and password reuse. Use of a password manager mitigate these attacks a bit, but not completely.


So now instead of social engineering the government intern all they have to do is social engineer the phone company. It’s called sim swapping. 2FA is bullshit and doesn’t work in practice.


> 2FA is bullshit and doesn’t work in practice.

You made an argument against SMS/phone-based 2FA, but didn’t address any other 2FA method such as U2F. I don’t see how your claim follows.


I only say 2FA because every instance of being offered the choice to use 2FA in my experience was phone based. It’s by far the most common 2FA scheme — its very widely asserted that phone based 2FA is secure and it enrages me because it really isn’t.

But something like u2f as far as I can tell isn’t any better than memorizing a strong pass-phrase. It’s basically just moving the password manager to a computer that’s not connected to the internet. I guess it’s easier than memorizing.


It adds one more layer of security and makes stuff like this much more difficult. Now the attacker has to both, figure out his password and hack his phone. How is this bullshit?


Because the way it’s implemented in 99% of cases is password reset uses your phone for validation. But that’s not true 2FA.

It’s a widespread lack of courage which I think afflicts many areas of the western world right now. Instead of making things right, everyone just says well if you lose your password then it’s ok, just do x y and z and you can reset your password. Never mind the fact that this completely ruins the whole point of passwords and 2FA. People aren’t brave enough to just confront the plain fact that in order to have security, you have to let your customers deal with the bitter consequences of losing their passwords. Instead of rightly putting the burden of managing passwords on the consumer, we treat them like children at the expense of sanity and order.

Just strong passwords and backup passwords is way stronger than 2FA anyway


You are describing 1fa if SIM-swappinh is enough.


I’m sure a somewhat large team manages or has access to that account, and it’s possible that one of them fell for some social engineering attack. It’s still a bit shameful that country and state representatives cannot use better security practices, including two factor authentication.

BTW, the distribution of 500BTC to citizens could be a joke based on a past campaign statement by him that he would bring back all “black money” stashed abroad by Indian citizens and that would result in each Indian getting 15 Lakh rupees (1.5 million rupees) in their bank accounts. The actual wording of this promise was different, but it became a constant joke when he failed to get the claimed dirty money back. For comparison, the per capita income in India when that was announced was around 70,000 rupees.


A couple months ago, Twitter announced that all staff are required to use U2F for their accounts. Why not have this requirement for important accounts, as well?


Bet it's log4j.


Log4twitter


Is saying 7.3 crore rather than 73 million common Indian vocabulary? Is there an equivalent for a hundred million or ten billion?


Yes. 'Crore' and 'Lakh' are very common in the Indian Subcontinent and parts of Middle East.

https://en.wikipedia.org/wiki/Indian_numbering_system


Yes, lakh,crores are a common part of language. For a billion, I believe it is "arab" and for a hundred billion, it is "kharab".

1 crore = 10 million

100 crore = 1 billion = 1 arab

100 arab = 0.1 trilion == 1 kharab


Though beyond the crore, most people wouldn't know what you were talking about.


Ambani is oftened referred to as an arabpati (a billionaire) at least in Hindi language media.

Kharab is more obscure as until now I thought a kharab was one trillion.



How. I mean let's talk how.

I know twitter has security to disable password resets. Or, like there are extra precautions for important accounts and such. Read about that.

Short of someone copying the login from a browser, I don't see how this is possible. I would love to hear ideas

Edit: yeah, what about 2fa ?


His personal account is also professionally managed by a dedicated team. All you have to do is get access to one of this team's terminals.


Twitter log4j RCE!


All to promote bitcoin. Sounds about right


Spy pigeons.


Not the first time this has happened. Why isn’t there 2FA required for sign in?


When more than one person needs access, like say a social media team, then usually the 2FA has to be piped into some mechanism for the entire team to get it otherwise things get very frustrating very fast and then it gets turned off. So it’s entirely understandable that it’s either off or not as much of a preventative as you might think.


Twitter should implement a feature to allow different people to manage a shared account with a separately set up 2FA for each individual that needs access to the account. It would be entirely feasible to do so, and Twitter is a 36B USD company so they should be able to implement it.


This


Did somebody pegasus his password?


[flagged]


Why do you assume it's state sponsored?


Aren't hacker groups notorious for being state sponsored? https://en.wikipedia.org/wiki/Cyberwarfare_by_China

Also, relations with the Chinese government have reached an extremely low point under Xi.


That's like saying criminals are notorious for being under 6' tall. There exist state-sponsored hacking groups. There also exist plenty of not-state-sponsored hacking groups too.


That is stating the obvious. I also had clearly explained in the above comment that why I believed it was state sponsored.

>Also, relations with the Chinese government have reached an extremely low point under Xi.

I can't claim what I said was true about this being state sponsored. It is what is known as a gut feeling.

Personally I see a counter point to my own point as I don't see any reason that in the past few months, we would have done anything to get Chinese aggression.

I also am open to the idea it is some troll who wanted the money they invested in Bitcoin to get a temporary bump which would be worse for Twitter IMO if one person on their laptop can do this.


sounds like states should put their public sector on the fedi instead.


Yup. Why is taxpayer funded government organization using one particular social media site over others? Why are they not on Fediverse, Parler etc?


Parler has serious issues and the main problem is that it is dominated by white far right conservatives. Here's a subreddit that does a decent job of documenting every terrible thing posted on that site, including but not limited to anti-semitism ,islamophobia ,transphobia and other forms of racism etc. https://www.reddit.com/r/ParlerWatch/

By being on the site, someone is giving an endorsement to its users and indirectly to the riots that occurred on Jan 6 in the Capitol as well as the unfounded allegations of election fraud.

And from what I have read about Fediverse, it had amassed a million users, but for the investment it will require someone to post regularly there for relatively limited exposure, governments and companies may not find it to be worth it. It is (a sort) of a chicken and egg problem.


As much as I hate social media, and the fact that I am not a white man is why I will break your heart with this awful truth.

Alt-left is just as bad as alt-right, but I'd rather sit in a room with a racist and talk it out rather than a leftist. At least the racist will generally make sense and can be reasoned with even if you hate them with a passion.

My socialist neighbor wants to have come colored people as his pet project, but seems to be quite the racist when it comes to us doing better than him.

The capital riots were nothing more than some degenerates tricked into putting the final nail in the Trump admin.


>Alt-left is just as bad as alt-right,

Of course, I am full believer in the horse shoe theory.

>but I'd rather sit in a room with a racist and talk it out rather than a leftist. At least the racist will generally make sense and can be reasoned with even if you hate them with a passion.

If you genuinely believe all alt righters (ie those who believe in the supremacy of their race to others) can be convinced with some dialogue,the issue would have been solved long ago. It isn't that easy.

You are however, judging the left from the lenses of dumb college students who do dumb shit and anarchists who use protests to do evil things.


Like the people you list don't exist on twitter.


Sure, there are. But Twitter is actively trying to work against it, and so far, in my personal experience I have not seen Hitler apologists on the site.

Sure, there are full fledged genocide deniers ( I have personally read tweets on Holodomor and Srebrenica denials), plus supporters of fascist regimes like in DPRK and Syria. Then there is the stuff like the BJP IT Cell tweeting their absolute worst.


There are Hitler apologists on twitter too. Along with pedos and groomers, racists and misogynists, among others. No, twitter doesn't remove them all either.


I personally haven't seen these as I keep my feed limited to tech news and memes but what you can do is click on "report"* And Twitter may take action. I have had bad experience myself with the reporting mechanism as it does not take action always on reported tweets. That I blame on the Twitter execs who do not have moderators who are properly aware of the region of the world they have to moderate. But broken as it is, it still works.

Parler has a report button from what I have heard but it is only for show. And from the former CEO Matze's own words, they allow all constitutionally allowed speech which unfortunately opens the doors for actual Nazis to flood the site with their hatred.


I think you're living in a bit of a bubble here. Your 'evidence' is a bunch of cherry picking that's hosted on reddit, a left-wing website. You could easily make the same case for twitter, with the caveats that 1) reddit probably wouldn't let you do it 2) you'd dislike the people twitter targets so it'd be less morally objectionable.


You can find plenty of criticism of the the Twitter left. Hell they do it to themselves, especially with incessant purity tests. Jimmy Dore comes comes to mind as well as how he turned on Cenk Uygur and the whole so called "Force the Vote" Fiasco as well as the "Bloody Monday" conspiracy.

r/enough_sanders_spam documents some of their dumb takes but that sub devolves more into bashing anyone to the left of Joe Biden.

As for my personal views,they don't really matter but I try and find hypocrisy in the "eat the rich" crowd as well as the hard right wingers.

Also one other thing that matter is that what the public perceives Parler as. I believe it has been forever associated with the Jan 6 riots and voter fraud allegations, so whether it was instrumental to these things or not does not necessarily matter but the public's perception of them does.

Think Ronald Reagan for example, modern people have a lot of to object about his presidency and many did then as well, but he enjoyed strong approval ratings throughout his presidency. During his reelection campaign, he had many issues while speaking like stuttering etc. but during his second debate with Walter Mondale, he was able to dispel all fears about his age and capabilities almost instantaneously.

https://youtu.be/Wt0xCpduK-E https://www.youtube.com/watch?v=22Lr4fgSFAY&ab_channel=NBCNe...

So anyway the point was the perception of the truth matters sometimes more in our society.


ISI must be short on Bitcoin


[flagged]


I doubt Modi's a nobody. Prime Minister of the world's second largest population, fifth largest economy and largest democracy seems like more than a nobody.


Very possibly the worlds largest population, considering how unreliable some statistics are.


Meh, those are PR words. India’s democracy is a facade anyway. Might as well call China a democracy, both follow the same (Nazi) ideologies.


Whoa - nationalistic flamewar like this will get you banned on HN, regardless of how right you are or feel you are. If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

You posted other flamewar comments in this thread too. That's not ok. Please don't do it again.


As opposed to several years of literal dictatorship in Pakistan? Sure, Imran Khan has been legitimately elected but Pakistan has been far far worse at democracy than other South Asian countries.

https://freedomhouse.org/country/pakistan/freedom-world/2021

https://freedomhouse.org/country/india/freedom-world/2021


I mean, I didn’t claim it to be a (largest) democracy =D


Of course, it is by the metric of population, yes. By the metric of democratic freedoms, nope.


Well however liked or disliked India’s PM is - at home or outside, he is anything but a nobody. Especially to the western neighbours. So I hope, for your own intellect’s sake, you said that in zest :)


[flagged]


Conversation was about the incident being state sponsored. I didn’t know Pakistan’s intelligence and state apparatus function based on cricket season. But good to know.


Nice flamebaiting, keep it up and you'll soon be banned from HN which would be a net positive.


Please don't respond to flamebait by posting in the flamewar style yourself. That just makes things worse.

https://news.ycombinator.com/newsguidelines.html


Too bad there are tankies on this site as well.


Posting like this breaks the site guidelines. If you'd please review them and stick to the rules, we'd appreciate it.

https://news.ycombinator.com/newsguidelines.html


Fair enough.


Is Twitter written in Java?


Looking at the security of twitter account, it looks like an insider job at Twitter. Unimaginable without inside help.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: