Twitter Hack Reminds Us That David Can Still Fell Goliath

twitter_hack_david

The twitter hack began as a quiet scheme to steal and sell unusual user names, which carry high currency in gamer and hacker circles.

But as the day wore on, the attack took over dozens of accounts belonging to corporations like Apple and celebrities like Joe Biden, Barack Obama, Bill Gates, Elon Musk and Kanye West. The hackers used the celebrity access to appeal to their followers for funds:

twitter hack of Joe Biden's accountAt least $180,000 worth of Bitcoin flowed into the hackers’ accounts.

By the time the hackers were done, they had broken into 130 accounts and dramatically exposed gaping holes in Twitter’s security.

What organized Goliath cybercrime ring was responsible?

Seventeen-year-old Florida resident, Graham Ivan Clark (David, for the purpose of this metaphor).

From the affidavit:

Graham Ivan Clark, 17  without authorization gain [sic] access to Twitter Inc.’s Customer Service Portal. Clark used social engineering to convince a Twitter employee that he was a co-worker in the IT department and had the employee provide credentials to access the customer service portal.

Clark then accessed the Twitter accounts of prominent individuals, including VP Joe Biden, former President Barack Obama and business [sic] such as Apple and Coinbase. Clark then posted on their Twitter accounts a communication that if Bitcoins are sent to accounts they will be doubled and returned to the victim. 

Despite the hackers’ cleverness, their plan quickly fell apart, according to court documents. They left hints about their real identities and scrambled to hide the money they’d made once the hack became public. Their mistakes allowed law enforcement to quickly track them down.

If Twitter, a company that spends millions on security ever year, can be hacked by a 17-year-old, so can your organization. But it wasn’t the technology that was hacked, it was the people. 

It is no surprise that the twitter hackers used the same tool that leads to a majority of damaging corporate breaches: social engineering. Twitter says that a few employees were targeted in a phone spear phishing attack, which suggests that hackers called Twitter employees while posing as members of the Twitter’s security team, and got them to reveal the credentials they use to access internal systems.

Once inside the system, they had free rein to do anything they wanted with any Twitter account. The next time this breach happens, the criminals will be more organized, and will use their access to launch a much more devious, lucrative scheme.

I hope Twitter invests as readily in their security awareness training and social engineering defenses as they do on their technology. And I hope you do as well, as it’s no fun to be beaten by David.


John Sileo is a cybersecurity expert, award-winning author and media personality as seen on 60 Minutes, Anderson Cooper and Fox & Friends. He keynotes conferences virtually and around the world and is the CEO of The Sileo Group, a technology think tank based in Colorado

12 Days to a Safe Christmas: Day 8 – What to Give the Person Who has Everything (and Wants to Keep it!)

Holiday Security Tips: On the eighth day of Christmas, the experts gave to me, 8 scam detectors

Most of us are too busy to monitor every form of identity that is at risk. Unfortunately, victims usually get hit when they take their eye off the ball.

 Solution: Purchase a comprehensive identity monitoring service

While a partridge in a pear tree may have been appreciated in 18th century England, it’s not a very coveted item these days!  Instead, help out the ones you love (and yourself!) by giving the gift of identity theft monitoring.

Traditional credit monitoring (which you can do for free at AnnualCreditReport.com) only detects a portion of identity theft. The remaining theft occurs as a by-product of non-credit loan activities (pay-day loans, etc), shared public records (court cases, real estate transactions, government filings, etc.), Internet trading sites (bought and sold on rogue websites), or in relation to medical or criminal records. It is important to monitor these forms of potential identity theft as well as your credit file. The key here is convenience; if you don’t have to do much to monitor a large portion of your identity, the work goes down while peace of mind increases. Make sure that your monitoring service has at least the following features:

  • 3-in-1 Credit Monitoring from each of the bureaus (Experian, Equifax, TransUnion)
  • Court & Public Record Monitoring
  • Non-credit loan monitoring like pay-day loans
  • Internet Surveillance for the buying and selling of your data
  • Sex Offender Reports to make sure crimes aren’t being committed in your name
  • Identity theft insurance to cover costs if you are affected
  • Identity theft restoration services to save you time

Forget the fruitcake; buy them something they’ll truly appreciate and remember long after the holidays! On the ninth day of Christmas…

To review our tips from previous days, click here.

 


About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker and expert on technology, cybersecurity, and tech/life balance. He energizes conferences, corporate trainings and main-stage events by making security fun and engaging. His clients include the Pentagon, Schwab, and organizations of all sizes. John got started in cybersecurity when he lost everything, including his $2 million business, to cybercrime. Since then, he has shared his experiences on 60 Minutes, Anderson Cooper, and even while cooking meatballs with Rachel Ray. Contact John directly to see how he can customize his presentations to your audience.

Stop Credit Card Thieves in the Act

Setting Up Account Alerts Can Help Protect You From Fraud.

Did you realize that you can have your credit card company and bank notify you anytime there is activity on your account? This tool makes it very easy to catch fraud before it stings your wallet.

John Sileo is an an award-winning author and keynote speaker on identity theft, internet privacy, fraud training & technology defense. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Cyber Security Expert Sileo on Check Fraud Scams

A new check fraud scam has reached the Front Range.

It involves a sizable check that arrives in the mail that, once cashed, can make you an accomplice in a money laundering scheme.

I recently appeared on 9 News to address the concern of a suspicious viewer, Martha, who had received such a check in the mail for $2,240.00. It was drawn on the Brown-Forman Employees Credit Union of Louisville, Ky.

The check came with a set of instructions:

No. 1: Have the check cashed at your bank.

No. 2: Pay yourself $300 after cashing the check.

No. 3: Take the rest of the funds to the nearest Western Union and transfer that balance to an address in San Diego.

Incredibly, the check is not a fake.  These are actually real checks, with real money attached to them, and you do get money in payment at the end. But you do have to do a little work for the cash. Martha was told that while making the transfer at Western Union, she was to observe how long it took to get service and if the customer service was professional. This is a ploy to make her believe she was actually doing some sort of job. In fact, had Martha followed through, she would have been committing a crime.

What they are doing is laundering illegal stolen money. They’ve gotten it through another breach like the Home Depot breach or the Target breach. They’ve gained all of this money, but they don’t want it to be tracked. So they send you a legitimate check, and they have you cash it because they don’t want to be traced to that money.  You then get to keep a part of the proceeds, say $300 of the $2,500, and you send off the remainder to them. They now have laundered money in a legitimate check that you have given them.  But you would be the one that’s held for the crime.  

Keep your “Hogwash” radar on high alert if someone wants to give you money out of the blue.  As always, if it seems to good to be true, it probably is!

John Sileo is an an award-winning author and keynote speaker on identity theft, internet privacy, fraud training & technology defense. John specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Mark K 9 News