Twitter reveals what it knows so far about massive hack

[Nevilledog]

https://www.digitaltrends.com/news/twitter-reveals-what-it-knows-so-far-about-massive-hack/

Twitter has revealed what it knows so far about the massive hack involving a bitcoin scam that targeted dozens of high-profile accounts on its service on Wednesday, July 15.

In a series of tweets posted on its Support account, the company said it believed the hack had been made possible by tricking one or more of its employees who had access to Twitter’s internal systems and tools.

“We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools,” the company said. Such an attack involves the perpetrator duping the target — in this case one or more individuals at Twitter — into making security-related errors or divulging sensitive information that enables the hacker to gain access to a company’s internal systems. There are a number of ways in which this can be done, including through malicious emails that impersonate a trusted person.

“We know they used this access to take control of many highly-visible (including verified) accounts and tweet on their behalf. We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it.”

It said that once it learned of the incident, it immediately locked down the affected accounts and removed the scam tweets posted by the attackers.

*snip*

[captain queeg]

1. Best to just stay off social media.

[irisblue]

11. So how can you post on DU , if you stay off social media?

[Silent3]

15. You personally staying off social media doesn't fix a thing

This is not about whether or not you personally get fooled by any of this hacking. Social media is here to stay. You are NOT going to stop that by setting some brave example of resistance to social media (and besides, as someone else pointed out, DU counts as a form of social media too).

Your own personal distaste or skepticism about social media doesn't change a thing about dangerous problems of public trust and public deception caused by these kinds of security failures.

[lagomorph777]

18. Yes and Twit is every bit as bad as Falsebook.

Both are Putin's Platforms.

[HipChick]

2. Tricking an employee?

Nah..an internal job, or Twitter has some dumb ass employees..

[soothsayer]

6. Social engineering is a pretty good phishing ploy

They’re very clever out there.

[NutmegYankee]

7. Social engineering is a classic method of attack.

There are several methods, all well known in industry circles.
Think of emails that look like your bank with links to fill in data, classically known as a spear phishing attack.

[HipChick]

12. These are employees though..

Not ordinary Joe Public..
IT specialists at that...they have to take extra special training for these scenarios

[NutmegYankee]

16. You would be very disappointed in how many fall for these, even with training.

Especially if it is a Whaling Attack.

[whistler162]

22. Just took a online course

done by Google employees, Google IT Professional certification. One of the presenters told the story of testing Google employees with a globe that lit up when plugged into an USB port but also had some code embedded into it to test employees. Quite a few employees plugged it into their computer thinking how generous Google was.

[uponit7771]

10. They have to get in first

[Renew Deal]

3. Why do employees have access to post tweets?

Even Twitter administrators shouldn’t be able to do that.

[Bernardo de La Paz]

17. None have access. That wasn't how it was done. READ THE OP!

This is a very simple concept.

The hackers didn't post tweets through admin accounts.

They phished enough admin details to gain access to the system. One they do that, they can can change passwords and reset notification email addresses. All they need do is the latter. Once notification email is going to a mailbox they can read, then they login and fail the password and request a temporary password to be sent to that mailbox.

Then they use the changed password to access the account in the normal way and post the bogus tweets.

[whistler162]

4. Dang Commies and all this

Socialist engineering stuff!

Not to surprising social engineering was a factor.

[JesterCS]

5. Trump hired Russians maybe? Or NK to do this?

I'm only mostly joking....

[uponit7771]

13. +1

[lagomorph777]

21. Why would Putin and Trump hack their own platform?

[Dennis Donovan]

8. Full Twitter statement:

https://threadreaderapp.com/thread/1283518038445223936.html

We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly.

You may be unable to Tweet or reset your password while we review and address this incident.

We’re continuing to limit the ability to Tweet, reset your password, and some other account functionalities while we look into this. Thanks for your patience.

Most accounts should be able to Tweet again. As we continue working on a fix, this functionality may come and go. We're working to get things back to normal as quickly as possible.

Our investigation is still ongoing but here’s what we know so far:

We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf. We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it.

Once we became aware of the incident, we immediately locked down the affected accounts and removed Tweets posted by the attackers.

We also limited functionality for a much larger group of accounts, like all verified accounts (even those with no evidence of being compromised), while we continue to fully investigate this.

This was disruptive, but it was an important step to reduce risk. Most functionality has been restored but we may take further actions and will update you if we do.

We have locked accounts that were compromised and will restore access to the original account owner only when we are certain we can do so securely.

Internally, we’ve taken significant steps to limit access to internal systems and tools while our investigation is ongoing. More updates to come as our investigation continues.

</snip>

[uponit7771]

9. People, this is an op sec Earthquake ... This is bad

[lagomorph777]

19. Putin needs to tighten up security at Twit - somebody is eating his lunch there!

[Silent3]

14. Deleted --- oops!

Response attached to wrong message.

[NightWatcher]

20. And the Prez rules by decree on a hackable medium. Nothing bad could ever happen...

I hope I'm alive in January when we get to Build Back Better.