Hector Martin

Watching the slow motion Twitter trainwreck is just amazing. I hope we get an amazing postmortem out of this, but chances are their security team is just incompetent/understaffed and this just boils down to someone's credentials being stolen and them failing at containment.

Short of a nation state level attack, there's no reason this should've taken more than 5 minutes to contain, TBQH.

Word is this was a compromised user admin panel (screenshots are floating around). If so, it should've taken 40 seconds to disable that thing entirely, then 15 minutes to dig through the audit logs (they have audit logs, right????) and undo the damage.

40s? I wouldn’t estimate anyone the ability to deploy that quickly, let alone do root cause analysis to figure out what the leak actually is in that span of time.

I would expect them to have a killswitch for internal admin tools in case of abuse.

I’m still surprised. It takes time to detect these things & conjure meetings to decide proper course of action. Consider how such a killswitch could be abuse, and then consider what process would be put in place to mitigate such abuse... and only then weigh it against this.