Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Mona Strelaeff, a Metchosin resident, is the first non-terminally ill person in Canada to be allowed to use psilocybin assisted therapy. (Provided by Spencer Hawkswell)
Metchosin woman’s trauma treatment could be trendsetting

Experts say this could signal the broadening of who can access psilocybin therapy

Sidney’s Haunted Bookshop is changing owners with longtime owner Odean Long transferring ownership Dec. 1 to William Matthews. (Wolf Depner/News Staff)
Longtime owner of Sidney’s Haunted Bookshop closes chapter with sale

Odean Long and her late husband moved the business to Sidney in 1996

Goldstream Food Bank volunteers at work. Light Up the City will be offering various options for the public to drop off non-perishable food items to support this food bank and others in Greater Victoria. (Black Press Media file photo)
Greater Victoria residents can show their charity through Light Up the City

Drive-thru food bank and toy donation dropoff sites open up this Saturday around region

Police will be out in force to target drunk drivers this weekend as part of ICBC’s annual CounterAttack campaign. (Contributed - ICBC)
Police launch Christmas CounterAttack this weekend

On average, 11 people are killed in crashes involving impaired driving on the Island every year

Victoria police arrested a man in a Yates Street grocery store Nov. 27 after he refused to wear a mask. (Black Press Media File photo)
Belligerent man arrested in Victoria grocery store after refusing to wear mask

Officers fined the man $230 under the COVID-19 Related Measures Act

Mary Cox and Jack Plant dance in their pyjamas and slippers at the morning pyjama dance during the Rhythm Reelers’ 25 Annual Rally in the Valley Square Dance Festival in Chilliwack on June 4, 2011. Sunday, Nov. 29, 2020 is Square Dancing Day. (Jenna Hauck/ Chilliwack Progress file)
Unofficial holidays: Here’s what people are celebrating for the week of Nov. 29 to Dec. 5

Square Dancing Day, Disability Day and International Ninja Day are all coming up this week

Black Press Media and BraveFace have come together to support children facing life-threatening conditions. Net proceeds from these washable, reusable, three-layer masks go to Make-A-Wish Foundation BC & Yukon.
Put on a BraveFace: Help make children’s wishes come true

Black Press Media, BraveFace host mask fundraiser for Make-A-Wish Foundation

A photo from 2017, of Nuchatlaht First Nation members outside court after filing a land title case in B.C. ( Submitted photo/Nuchatlaht First Nation).
Vancouver Island First Nation calls on B.C. to honour UNDRIP in historic title case

Nuchatlaht First Nation says Crown counsel continues to stall the case using the ‘distasteful’ argument that the Nation ‘abandoned’ their land

West Vancouver Island’s Ehattesaht First Nation continues lock down after 9 active cases were reported today after a visitor tested positive last week. (Ehattesaht First Nation/Facebook)
Ehattesaht First Nation’s COVID-19 nightmare: nine active cases, a storm and a power outage

The Vancouver Island First Nation in a lockdown since the first case was reported last week

The Ahousaht First Nation confirmed its first case of COVID-19 on Nov. 26, 2020. (Westerly file photo)
Ahousaht First Nation on lockdown over COVID-19

“Emotions are high. The anxiety is high. We want our community to pull through.”

Screenshot of Pastor James Butler giving a sermon at Free Grace Baptist Church in Chilliwack on Nov. 22, 2020. The church has decided to continue in-person services despite a public health order banning worship services that was issued on Nov. 19, 2020. (YouTube)
2 Lower Mainland churches continue in-person services despite public health orders

Pastors say faith groups are unfairly targeted and that charter rights protect their decisions

A big job: Former forests minister Doug Donaldson stands before a 500-year-old Douglas fir in Saanich to announce preservation of some of B.C.’s oldest trees, July 2019. (B.C. government)
B.C. returning to ‘stand-alone’ forests, rural development ministry

Horgan says Gordon Campbell’s super-ministry doesn’t work

Most Read