OAKLAND, Calif. (AP) — Hackers broke into the Twitter accounts of world leaders, celebrities and tech moguls on Wednesday in one of the most high-profile security breaches in recent years, highlighting a major flaw with the service millions of people have come to rely on as an essential communications tool.
The intent of the hack appeared to be to steal money from unsuspecting cryptocurrency enthusiasts — in particular, by using the compromised high-follower accounts to scam people out of Bitcoin. But it also raises questions about Twitter’s ability to secure its service against election interference and misinformation ahead of the U.S. presidential election.
Here are some questions and answers about the breach:
WHAT HAPPENED — AND HOW?
On Wednesday afternoon, the Twitter accounts of famous figures began tweeting similar messages saying they were “feeling generous” and would double any Bitcoin payments sent to an address in the tweet. Among the individual accounts affected were former President Barack Obama, Democratic presidential candidate Joe Biden, tech billionaires like Amazon CEO Jeff Bezos, Microsoft co-founder Bill Gates and Tesla CEO Elon Musk and celebrities such as Kanye West and his wife, Kim Kardashian West.
Companies like Apple and Uber, which respectively have 4.6 million and one million followers, were also affected.
Twitter soon locked down many accounts, including those of its “verified” users with blue check marks next to their names — a group that include many U.S. politicians as well as businesses, celebrities, journalists and news organizations. Twitter called the hack a “coordinated social engineering attack” by unknown people who “targeted” Twitter employees with access to the platform’s internal systems and tools.
The hackers, Twitter said, used this access to take control of many high-profile accounts and masquerade as their owners.
WHAT IS SOCIAL ENGINEERING?
Essentially, social engineering means taking advantage of human nature. Examples include phishing attacks and other ways people can be tricked into giving out compromising information, malware attacks that get people to download malicious software, and compromising people by offering something in return for information. Twitter did not say how its employees were compromised.
COULD THE ATTACK HAVE BEEN PREVENTED?
Twitter said late Wednesday it has taken “significant steps” to limit employees’ access to internal systems and tools while its investigation is ongoing. But this is not the first time Twitter employees have wrecked havoc.
In 2017, a disgruntled employee deactivated President Donald Trump’s account for a few minutes. Last year, U.S. prosecutors charged two former Twitter employees with spying on user data for the government of Saudi Arabia. The incidents raise questions about Twitter’s internal security systems, and whether the company can trust employees with access to sensitive information.
WHAT DOES THE HACK MEAN FOR THE 2020 ELECTION?
The hack might be a simple demonstration of Twitter’s weak security controls as the U.S. heads into the 2020 presidential election, a contest in which social media is already playing a hugely influential role.
Among the political figures targeted, the hack mostly appeared to target Democrats or other figures on the left, drawing comparisons to the 2016 campaign. The White House said that President Donald Trump’s account was secure and wasn’t jeopardized.
U.S. intelligence agencies have established that Russia engaged in coordinated attempts to interfere in the 2016 U.S. election through social media tampering and various hacks, including targeting the campaigns and major party organizations.
While Twitter, Facebook and other social media companies have since tightened their election security systems and policies, malicious actors trying to intervene have also improved their tactics. In other words, if a Bitcoin scam was so easy to pull off, what will prevent an attack on the U.S. election?
Experts say Twitter breach troubling, undermines trust
HONG KONG (AP) — A breach in Twitter’s security that allowed hackers to break into the accounts of leaders and technology moguls is one of the worst attacks in recent years and may shake trust in a platform politicians and CEOs use to communicate with the public, experts said Thursday.
The FBI said Thursday it is investigating the hacks, and said the high-profile accounts “appear to have been compromised in order to perpetuate cryptocurrency fraud.”
The ruse discovered Wednesday included bogus tweets from former President Barack Obama, Democratic presidential front-runner Joe Biden, Mike Bloomberg and a number of tech billionaires including Amazon CEO Jeff Bezos, Microsoft co-founder Bill Gates and Tesla CEO Elon Musk. Celebrities Kanye West and his wife, Kim Kardashian West, were also hacked.
Twitter said the hackers used “social engineering” to target some of the company’s employees and then gained access to the accounts. The term refers to taking advantage of human nature via phishing attacks, tricking people into downloading malicious software or compromising them by offering something in return for information. Twitter did not say how its employees were compromised.
The attackers sent out tweets from the accounts of the public figures, offering to send $2,000 for every $1,000 sent to an anonymous Bitcoin address.
Cybersecurity experts say such a breach could have dire consequences since the attackers were tweeting from verified, globally influential accounts with millions of followers.
“If you receive a tweet from a verified account, belonging to a well-known and therefore trusted person, you can no longer assume it’s really from them,” said Michael Gazeley, managing director of cybersecurity firm Network Box.
Reacting to the breach, Twitter swiftly deleted the tweets and locked down the accounts to investigate. In the process it prevented verified users from sending out tweets for several hours.
The company said Thursday it has taken “significant steps to limit access to internal systems and tools.” User passwords did not appear to have been compromised, Twitter said, so it’s not necessary for users to reset them.
Many celebrities, politicians and business leaders often use Twitter as a public platform to make statements. U.S. President Donald Trump, for example, regularly uses Twitter to post about national and geopolitical matters, and his account is closely followed by media, analysts and governments around the world. The White House said Thursday his account was secure and wasn’t jeopardized by the hacks.
Twitter faces an uphill battle in regaining people’s confidence, Gazeley said. For a start, it needs to figure out exactly which accounts were hacked and show the vulnerabilities have been fixed, he said.
“If key employees at Twitter were tricked, that’s actually a serious cybersecurity problem in itself,” he said. “How can one of the world’s most used social media platforms have such weak security, from a human perspective?”
Rachel Tobac, CEO of Socialproof Security, said that the breach appeared to be largely financially motivated. But such an attack could cause more serious consequences.
“Can you imagine if they had taken over a world leader’s account, and tweeted out a threat of violence to another country’s leader?” asked Tobac, a social engineering hacker who specializes in providing training for companies to protect themselves from such breaches.
Tobac said companies can guard themselves against such attacks by beefing up multi-factor authentication -– where users have to present multiple pieces of evidence as authentication before being allowed to log into a system.
Such a process could include having a physical token that an employee must have with them, on top of a password, before they can log into a corporate or other private system. Other methods include installing technical tools to monitor for suspicious insider activities and reducing the number of people who have access to sensitive data, Tobac said.
This week’s case follows last year’s federal investigation of two former Twitter employees charged with spying on users for the Saudi government.
Several U.S. lawmakers called on Twitter to cooperate with authorities including the Department of Justice and the FBI to secure the site after the latest breach.
“I am concerned that this event may represent not merely a coordinated set of separate hacking incidents but rather a successful attack on the security of Twitter itself,” said Sen. Josh Hawley, a Missouri Republican.
He added that millions of users relied on Twitter not just to send tweets but also communicate privately via direct messaging. Twitter hasn’t said if hackers were able to access the private messages of their high-profile targets.
Oregon Democratic Sen. Ron Wyden said Twitter CEO Jack Dorsey told him in a private conversation in 2018 that the company was working on protecting direct messages, known as DMs, with end-to-end encryption.
But that promise never materialized, Wyden said Thursday, leaving everyone’s private messages “vulnerable to employees who abuse their internal access to the company’s systems, and hackers who gain unauthorized access.”
“This is a vulnerability that has lasted for far too long, and one that is not present in other, competing platforms,” Wyden said in an emailed statement. “If hackers gained access to users’ DMs, this breach could have a breathtaking impact, for years to come.”
___
AP reporters Matt O’Brien in Providence, Rhode Island, Eric Tucker and Kevin Freking in Washington and Barbara Ortutay in Oakland, California contributed to this report.