Posts

Twitter Hack Reminds Us That David Can Still Fell Goliath

twitter_hack_david

The twitter hack began as a quiet scheme to steal and sell unusual user names, which carry high currency in gamer and hacker circles.

But as the day wore on, the attack took over dozens of accounts belonging to corporations like Apple and celebrities like Joe Biden, Barack Obama, Bill Gates, Elon Musk and Kanye West. The hackers used the celebrity access to appeal to their followers for funds:

twitter hack of Joe Biden's accountAt least $180,000 worth of Bitcoin flowed into the hackers’ accounts.

By the time the hackers were done, they had broken into 130 accounts and dramatically exposed gaping holes in Twitter’s security.

What organized Goliath cybercrime ring was responsible?

Seventeen-year-old Florida resident, Graham Ivan Clark (David, for the purpose of this metaphor).

From the affidavit:

Graham Ivan Clark, 17  without authorization gain [sic] access to Twitter Inc.’s Customer Service Portal. Clark used social engineering to convince a Twitter employee that he was a co-worker in the IT department and had the employee provide credentials to access the customer service portal.

Clark then accessed the Twitter accounts of prominent individuals, including VP Joe Biden, former President Barack Obama and business [sic] such as Apple and Coinbase. Clark then posted on their Twitter accounts a communication that if Bitcoins are sent to accounts they will be doubled and returned to the victim. 

Despite the hackers’ cleverness, their plan quickly fell apart, according to court documents. They left hints about their real identities and scrambled to hide the money they’d made once the hack became public. Their mistakes allowed law enforcement to quickly track them down.

If Twitter, a company that spends millions on security ever year, can be hacked by a 17-year-old, so can your organization. But it wasn’t the technology that was hacked, it was the people. 

It is no surprise that the twitter hackers used the same tool that leads to a majority of damaging corporate breaches: social engineering. Twitter says that a few employees were targeted in a phone spear phishing attack, which suggests that hackers called Twitter employees while posing as members of the Twitter’s security team, and got them to reveal the credentials they use to access internal systems.

Once inside the system, they had free rein to do anything they wanted with any Twitter account. The next time this breach happens, the criminals will be more organized, and will use their access to launch a much more devious, lucrative scheme.

I hope Twitter invests as readily in their security awareness training and social engineering defenses as they do on their technology. And I hope you do as well, as it’s no fun to be beaten by David.


John Sileo is a cybersecurity expert, award-winning author and media personality as seen on 60 Minutes, Anderson Cooper and Fox & Friends. He keynotes conferences virtually and around the world and is the CEO of The Sileo Group, a technology think tank based in Colorado

Don’t Be Naive: Obama/Biden “Twitter Hack” Not What It Seemed

Photo Courtesy of the BBC.

twitter hack

I’m betting that the recent Twitter hack of prominent political and celebrity Twitter accounts was politically motivated and nation-state operated. But that’s not what “the investigators” say. And that false narrative could have massive implications for your privacy. Here’s the background in a nutshell:

Approximately 130 high-profile Twitter accounts were hacked on July 15 in what the company is calling a “coordinated social engineering attack”.  Victims included politicians like Barack Obama and Joe Biden, heads of mega companies like Tesla CEO Elon Musk, Amazon CEO Jeff Bezos and Microsoft CEO Bill Gates, and company accounts like Apple and Uber. Ironically, Donald Trump’s account has “extra security” protecting it from access, which begs the question, why don’t we all get added security if it’s possible?

Using various angles (“feeling grateful”, “giving back to my fans”…), hackers posted tweets on the compromised accounts saying that if followers sent Bitcoin to a wallet address then they would receive double the amount in return. No one falls for those scams anymore, right? At least 363 transactions occurred and the account received more than $118,000 in just a few hours. 

Investigators believe the people behind the twitter hack appear to have come from the “OG” community, a group interested in original, short Twitter handles such as @a, @b or @c, for instance. It is thought that they worked with at least one Twitter employee to gain access to an internal tool that allows staff to change email addresses associated with accounts; the hackers were able to reset the passwords of 45 of the accounts. The OG Community is not known to be tied to any nation state and their motivation is supposedly a mix of financial gain, hacker bragging rights, and disruption. So let me get this straight:

Experts are saying that cybercriminals got their hands on the Twitter accounts of 45 of the most powerful people on the planet and the best they could come up with was a tired Bitcoin scheme that made them $118,000? That’s pocket change to cybercriminals, and might be the lamest attribution for a hack I’ve ever heard. 

The key words above are “The OG Community is not known to be tied to any nation state” which is exactly why a nation-state like Russia would use technological tools like TOR’s Onion Router and trumped up OG user accounts to hide behind a plausible, alternative hacking group that would take the attention off of the real motivation. I can’t tell you how many historical cyberattacks I have seen that have been digitally disguised behind a highly-attractive alternative reality. 

Here is a fundamental law of cyberattacks: Hacker attribution (who actually performed the hack) and hacker motivation (why the hack was performed), is an exceptionally difficult puzzle to solve, and often manipulates outsiders in exactly the opposite direction. 

Twitter says no passwords were stolen, but they have not yet been able to confirm whether direct messages were compromised. I’m guessing that it will come out down the road that both passwords and direct messages were compromised. That’s how the corporate publicity machine works: the first message claims little damage and the truth comes out subsequently when we have all stopped paying attention (e.g., Target, Equifax, Marriott…).

So What Was the Point of the Twitter Hack – $118,000? NOT!

Clearly, nation-states don’t need $118,000 in Bitcoin, right? The twitter hack was simply a dry run for political disinformation attacks, cyber blackmail and campaign IP eavesdropping that will manifest closer to our presidential election. Nation-states that have a horse in the U.S. presidential race were testing the waters and covering their tracks by pointing to a plausible alternative explanation.

Yes, this hack raises questions about Twitter’s ability to secure its service against election interference and misinformation ahead of the U.S. presidential election, but those questions have existed for at least four years now. It also threatens the confidentiality and privacy of direct messages sent through Twitter; incredibly powerful information in the race for power. Politicians, business leaders and individuals alike should migrate their private messages to apps like Signal or even the less secure but better than Twitter option of Apple Messages. 


John Sileo is a cybersecurity expert, award-winning author and media personality as seen on 60 Minutes, Anderson Cooper and Fox & Friends. He keynotes conferences virtually and around the world and is the CEO of The Sileo Group, a technology think tank based in Colorado

Twitter privacy expert John Sileo talking with 9News on the AP hack

This Tweet disrupted the stock market as well as gold and oil prices: “Two explosions in the White House and Barack Obama is injured”.