Twitter hack: accounts of prominent figures, including Biden, Musk, Obama, Gates and Kanye compromised
Twitter suffered a major security breach on Wednesday that saw hackers take control of the accounts of major public figures and corporations, including Joe Biden, Barack Obama, Elon Musk, Bill Gates, Jeff Bezos and Apple.
The company confirmed the breach Wednesday evening, more than six hours after the hack began, and attributed it to a “coordinated social engineering attack” on its own employees that enabled the hackers to access “internal systems and tools”. Twitter said it was “looking into what other malicious activity they may have conducted or information they may have accessed” in addition to using the compromised accounts to send tweets.
The hack unfolded over the course of several hours, and in the course of halting it, Twitter stopped all verified accounts from tweeting at all – an unprecedented measure. The company had restored most accounts by Wednesday evening, but warned that it “may take further actions”. The company said that it had also locked the compromised accounts and “taken steps to limit access to internal systems and tools” while it continues its investigation.
The compromised accounts, which count tens of millions of followers, sent a series of tweets proposing a classic bitcoin scam: followers were told that if they transferred cryptocurrency to a specific bitcoin wallet, they would receive double the money in return.
Other compromised accounts include those of Kanye West, Michael Bloomberg, Uber, and a number of cryptocurrency exchanges or organizations.
The messages included the address of a bitcoin wallet whose balance grew rapidly to more than 11 BTC (more than $100,000) as the scam spread. Tweets with similar messages were repeatedly deleted and re-posted by some of the compromised accounts over the course of Wednesday afternoon.
While the motives and source of the attack are not yet known, the coordinated hijacking of the verified communications streams of world leaders, celebrities and major corporate accounts was a frightening prospect. Twitter has become a de facto wire service for the world and is used for official communications by governments during emergencies; a hack on the scale of Wednesday’s attack could have been more disruptive or even dangerous.
“The amount of damage this could cause is very high,” said Douglas Schmidt, a computer science professor at Vanderbilt University. “These people could hold information gleaned from the hack for ransom in the future.”
Twitter issued its first statement approximately 90 minutes after scam messages began being sent out by Musk’s and Gates’ accounts, as the attack was ongoing.
“We are aware of a security incident impacting accounts on Twitter,” the company said on Twitter. “We are investigating and taking steps to fix it. We will update everyone shortly.”
The company subsequently warned that some users would be unable to tweet or change their passwords as it worked to address the issue. Verified users, whose accounts feature a blue checkmark to denote that Twitter has confirmed their identities, were blocked from tweeting for about an hour.
Twitter’s stock price tumbled more than 3% in after hours trading.
“Tough day for us at Twitter,” chief executive Jack Dorsey tweeted on Wednesday evening. “We’re diagnosing and will share everything we can when we have a more complete understanding of exactly what happened.”
It is not entirely uncommon for high-profile figures to suffer Twitter hacks. Dorsey himself was the victim of a Sim swap attack in 2019.
But Twitter’s description of the attack suggests a much more serious breach of the company’s internal systems, carried out by tricking or otherwise persuading an employee to provide access. It is not the first time Twitter has faced an insider threat. In 2017, a customer support employee briefly deleted Donald Trump’s account. And in 2019, two former employees were charged with spying after they allegedly accessed thousands of users’ account information and provided it to the government of Saudi Arabia.
Schmidt said that the attacks could be related to the fact that Twitter, like much of the rest of the tech industry, has transitioned to remote work during the coronavirus pandemic.
“The likelihood of attacks like this increase when people are working remotely it is much easier for bad actors to impersonate someone through an email and gain access to their accounts,” said Schmidt. “Assuming this wasn’t someone inside Twitter trying to take revenge, it appears to be a spear phishing attack – someone who has access to admin privileges that can override twofactor authentication and strong passwords fell victim to a hack”.