Will #infosecTwitter survive Elon Musk?

Twitter is one of the key platforms for the information security community to share information. What happens if researchers flee?

A little after noon on Tuesday, Katelyn Bowden, an artist for hack.xxx and member of the hacker collective Cult of the Dead Cow, tweeted that there seemed to be a major internet outage afoot:

https://twitter.com/medus4_cdc/status/1592568950986276869

The tweet racked up 638 likes, more than 100 retweets and 18 quote tweets. The replies included jokes — “I’m sorry, I was just really desperate to get Taylor Swift tickets I’ll put the internet back now” — reply-guy mansplaining, and confirmations from multiple states. Before long, security researchers were trading information trying to figure out exactly what was happening.

It was the kind of information sharing that’s played out on Twitter for years that security companies and researchers sometimes rely on for their work and an example of what, for some, could be lost as the platform implodes under the rapid changes forced Elon Musk in the wake of his $44 billion takeover. Musk has reportedly fired half the company’s staff, botched product roll-outs, caused advertisers to hit pause, and pushed cuts to backend software that have caused significant problems, most notably with text-based multi-factor authentication.

The chaos has been good for short-term eyeballs, at least according to Musk, but has pushed a number high-profile security researchers to decamp or reduce their use of their Twitter accounts in ways they had before.

For years infosec Twitter has been a robust community, with all the ups and downs, quality and dreck, you’d find in any online space. Many have moved over to Mastadon, which offers a Twitter-like experience with notable differences by design.

“That’s where infosec is now,” Patrick Gray, the host of the Risky Business podcast, said on his show Wednesday. “It’s absolutely insane how quickly it happened.”

But some worry that the fracturing of infosec Twitter could have profound impacts on not only the community, but the vital exchange about the latest vulnerabilities, researchers’ techniques and tactics and the newest hacks that have collectively helped make the internet more secure — and the people on the frontlines of cybersecurity more informed.

The platform became a replacement for the often private and exclusive channels that security researchers previously relied on share information. Before Twitter, hackers formed communities via internet relay chats, mailing lists and messages boards. Twitter provided a public space where even anonymous researchers could inform other hackers and the public at large about new threats. But if there’s a significant exodus, that global megaphone for security researchers could soon vanish.

Sherrod DeGrippo, vice president of threat research and detection at Proofpoint, told CyberScoop that during last week’s Cyberwarcon conference, which brings threat researchers, government officials and others together to share the latest on high-end cyberespionage and threats, a presenter crystallized the problem.

“At the end of one presentation, the presenter shared a slide of 15 works cited as well as references,” DeGrippo said in an email. “She said, ‘I’ll share this list on Twitter later.’ The audience laughed uncomfortably, acknowledging that Twitter was the default sharing vehicle for high value intelligence and information security data — and was likely no longer reliable.”

Information security professionals, DeGrippo said, are constantly sharing information on Twitter. “It is the most used, visible, timely place to exchange and find information. Many threat actors directly drop vulnerabilities and data breach alerts on twitter or others drop it for them.” Additionally, “multiple tools in infosec engineering teams are set up to comb Twitter for IOCs and new vulnerability data so it can be actioned immediately. There are many organizations with automated workflows based on Twitter intel alerting.”

DeGrippo initially shared her concerns in a Nov. 11 tweet:

Mark my words: the InfoSec community being fractured by the implosion of twitter will absolutely make the global internet less safe.

— Sherrod DeGrippo 🦓 (@sherrod_im) November 11, 2022

Replies poured in. While some were skeptical — “We’re all here in this industry because we’re great at finding information” one user said — many felt the same way DeGrippo did.

Very much so. I found out about a company breach from a journalist on here. (small company). Wannacry happened in real time on here. Log4j I was able to stay ahead of things by days because of this.

— Accidental AppSec (@Jedediah6) November 11, 2022

One of the best sources of threat intelligence and shit posting there is.

— Ken Westin (@kwestin) November 11, 2022

Infosec seems to have descended on Mastodon and it’s really pretty great, even considering our propensity for drama. What I’m really concerned about losing acces to: journalists, historians, doctors, and all the other collectively intelligence that Twitter brought.

— @[email protected] 🐡 (@SethHanford) November 12, 2022

It’s not just longtime Twitter users’ nostalgia and overwrought angst, as some have claimed. The platform’s real-time information security utility was reflected in the July 11, 2022, Cyber Safety Review Board report on the Log4j open-source vulnerability, first exposed in December 2021.

“Many interviewed stakeholders indicated one of their earliest, if not their first, notifications of the vulnerability came from social media platforms, especially Twitter, where the broader security community shared vulnerability information and emerging indicators of compromise (IOC),” the report said. “Individual accounts also shared exploitation variants, obfuscation and defense evasion techniques, and other trends to enable responders to adjust defensive measures and deter potential attacks. Multiple interviewees told the Board that Twitter was a valuable resource for global events of this type.”

The NSA and the FBI tweeted about Log4j vulnerabilities, and so did Rob Joyce, head of the NSA’s Cybersecurity Directorate.

Major incidents will still get around as quickly as they need to, Amitai Ben Shushan Ehrlich, a threat researcher with SentinelLabs told CyberScoop.

“I still think when something big happens all the big sec companies hurry to push a blog around it, so it will still be available for those who are into it,” he said. “I think the small things will be the ones affected the most, like those tiny incidents or cool research that gets some attention only because it’s passed between researchers on Twitter. The big things not so much.”

Time will tell the full scope the impact “Twitter 2.0” will have on the infosec community. But some may choose to go down with the proverbial ship.

https://twitter.com/s_sabots/status/1592978281636429824?s=20&t=4TfRtUJ158_hhTSdapnwgw

Tonya Riley contributed reporting for this article.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure