We now know it wasn't a 0 day. It was socially engineered access to internal tools. That's still a tricky one to lockdown.

It's tricky to fully prevent (considering conspiracies of multiple people) but not that tricky to ensure the responsible internal parties will be identified and brought to justice.

Working from home of course always leaves open the question if a person was willingly participating in a crime or was forced at gunpoint.

However, in this case, looks like Twitter's internal tools simply give too much access to people to control access to Twitter accounts. Probably no gunpoint required, just a single compromised employee. It remains to be seen how willingly they have participated.

More info on this https://techcrunch.com/2020/07/15/twitter-hacker-admin-scam/

Interesting looks like a moderation tool form the screenshots. You can block a user from timelines and searches or a tweet.

So the infamous "shadow ban" actually does exist on Twitter, based on this screenshot. I remember them actively denying this two years ago when a wave of shadow ban incidents hit German news.

Where do you see a shadowban option on that screenshot?

"Search blacklist" is one of the things that indicates a shadow ban (per https://shadowban.eu/). Lower left corner in the screenshot.

Shadowbanning people is a form of psychological abuse. To be honest it should be banned by law.

I just vouched for yet another HN user who had been posting insightful but [dead] comments for at least a month, and I couldn't even find the bad comment that triggered this.

It just makes me sad that I see people spending their energy on good comments, unaware they're not being read by most people.

Reddit mods are truly overly censor-friendly and ban-happy - and a bit bemused with the power that being a mod gives them over others.

Might want to email the mods if you come across such stuff...

Isn't this literally what the "vouch" button is intended for, though?

Currently their earned BTC balance is $120k+ for comparison. That's a pretty successful scam and 5% of potential revenue will not make anyone go white hat.

Many previous ICO hacks (wait for initial coin offering -> change the bitcoin address to your own) have paid millions. Musk's or Buffet's tweets have moved markets multiple times. This sort of access could have been leveraged to gain at least x100 more than what they achieved.

Moving the market doesn't do anything if you don't have the stocks. This might have been a temporary hack where the hacker was not sure how much time he has. It could be simple as someone gaining access to an unlocked home PC of a remote Twitter employee.

Sorry, but $120k is ridiculously low for something like this.

They could have caused so much more havok...

They must have been having an extreme adrenaline rush during this which clouded them from having a more sinister plan.