Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Just Posted

The barred owl is the most likely to be spotted in the south Island. (Ann Nightingale photo)
Barred owls dominate Greater Victoria owl-scape

Western screech owl population decimated, partly due to barred owls

Between June 1 and 7, 168 net unconditional sales were made for properties in the VREB region. (Black Press Media file photo)
Victoria home sales slightly behind last June’s pace

Benchmark value of single-family home in Greater Victoria tops $1 million

VicPd are asking for the public’s help in finding Camper, a lost pit bull who ran away after their owner’s van was reportedly attacked by a man with a hammer on June 12. (Courtesy of VicPD)
Edmonton man reportedly smashes van’s windows with hammer while woman and her dog inside

VicPD are asking for help to find Camper, the woman’s dog who ran away during the Friday incident

Red arrow shows the existing warehouse that is home to a variety of specialized equipment used by the Capital Region Emergency Services Telecommunications (CREST). The service provider is looking for a new home that will protect the equipment in the event of an earthquake or other natural disaster. (Google Maps)
CREST telecoms look to find a post-seismic facility in Greater Victoria

The move will better protect equipment vital to its 50 emergency service clients across the CRD

(Black Press Media file photo)
FRESH AND LOCAL: Greater Victoria farm markets ready to greet shoppers

A list of markets on the go this spring and summer, right into fall

At an outdoor drive-in convocation ceremony, Mount Royal University bestows an honorary Doctor of Laws on Blackfoot Elder and residential school survivor Clarence Wolfleg in Calgary on Tuesday, June 8, 2021. THE CANADIAN PRESS/Jeff McIntosh
‘You didn’t get the best of me’: Residential school survivor gets honorary doctorate

Clarence Wolfleg receives honorary doctorate from Mount Royal University, the highest honour the school gives out

“They will never be forgotten, every child matters,” says Sioux Valley Chief Jennifer Bone in a video statement June 1. (Screen grab)
104 ‘potential graves’ detected at site of former residential school in Manitoba

Sioux Valley Dakota Nation working to identify, repatriate students buried near former Brandon residential school

The Queen Victoria statue at the B.C. legislature was splattered with what looks like red paint on Friday. (Nicole Crescenzi/News Staff)
Queen Victoria statue at B.C. legislature vandalized Friday

Statue splattered with red paint by old growth forest proponents

Police cars are seen parked outside Vancouver Police Department headquarters on Saturday, January 9, 2021. THE CANADIAN PRESS/Darryl Dyck
Vancouver police officer charged with assault during an arrest in 2019

The service has released no other details about the allegations

Denmark’s Christian Eriksen receives medical attention after collapsing during the Euro 2020 soccer championship group B match between Denmark and Finland at Parken stadium in Copenhagen, Saturday, June 12, 2021. (AP Photo/Martin Meissner, Pool)
Christian Eriksen in stable condition, Euro 2020 match resumes

Eriksen was given chest compressions after collapsing on the field during a European Championship

Members of the Department of Fisheries and Oceans’ Marine Mammal Response Program rescued an adult humpback what that was entangled in commercial fishing gear in the waters off of Entrance Island on Thursday, June 10. (Photo courtesy Marine Mammal Response Program)
Rescuers free humpback ‘anchored’ down by prawn traps off Vancouver Island

Department of Fisheries and Oceans responders spend hours untangling whale

As stories of the horrors of residential schools circulate after the Tk’emlups te Secwepemc First Nation announced it had located what are believed to be the remains of 215 children, Grand Chief Stewart Phillip of the Union of B.C. Indian Chiefs said he feels a connection with the former students. THE CANADIAN PRESS/Darryl Dyck
2 sides of the same coin: Ex-foster kids identify with residential school survivors

Grand Chief Stewart Phillip says the child welfare system takes Indigenous children from their families

Nathan Watts, a member of the Tseshaht First Nation near Port Alberni, shares his story of substance use, a perspective he said isn’t seen enough. (Photo courtesy of Nathan Watts)
Public shaming, hate perpetuates further substance use: UVic researcher

Longtime addict Nathan Watts offers a user’s perspective on substance use

Most Read