Twitter GodMode – an internal tool that hackers used to tweet from high-profile accounts, including Apple, back in 2020 – remains available to all of the company’s engineers, according to a new report today.
Twitter had previously said that the security hole had been fixed, but a whistleblower said that aside from changing the name of the tool from GodMode to PrivilegedMode, the company had made only one change – and that still allowed any Twitter engineer to trivially gain uncontrolled access to it …
Apple’s official Twitter account @Apple was one of a number of high-profile accounts compromised back in 2020. Other accounts affected were:
Oh, and one more: Elon Musk.
The hack was all the more notable because it was possible despite the fact that many of the accounts used two-factor authentication, meaning that access should have been impossible even with the account password.
As it happened, the hackers simply posted a Bitcoin scam, but the ability to tweet absolutely anything from such high-profile and trusted accounts could have led to far more serious consequences.
It later came to light that the hack was made with an internal tool, then known as GodMode. Those with access to GodMode could post tweets from literally any account, without the need for account-specific authentication. GodMode also allowed existing tweets to be deleted....
What happened? The owner of this website (www.khmertimeskh.com) has banned your IP address (64.62.158.116). Please see https://developers.cloudflare.com/support/troubleshooting/http-status-codes/...