As account after verified account tweeted a false bitcoin philanthropy scam, Twitter temporarily deactivated the “blue checks” while it sought to revert Twitter back to its chaotic normal. Wednesday afternoon, an iteration of a message claiming to offer coronavirus relief appeared on a number of high-profile Twitter accounts:
Sheeeeeeesh pic.twitter.com/gMY1nXGmNU
— Ryan Mac ?? (@RMac18) July 15, 2020
Hackers promised to double the amount of money deposited in the hacker’s blockchain account. Before it shut down, the account accrued as much as 116,000 USD from victims.
The messages appeared on accounts of politicians, including Democratic presidential hopeful Joe Biden; tech CEOs, including Elon Musk, Jeff Bezos and Bill Gates; pop culture icons, including rapper Wix Khalifa and boxer Floyd Mayweather; and cryptocurrency dealers. President Trump's account is protected by a special lock-and-key, officials told the New York Times, so hackers could not access it.
“This appears to be part of a larger issue Twitter is facing,” a spokesperson for Gates told Recode.
Twitter has removed the counterfeit messages from affected accounts.
The hack appears to have originated in the Twitter control room itself rather than a process of acquiring credentials to different accounts. CoinDesk, another victim of the ploy, reports that it is one of several accounts utilizing two-factor authentication.
Tough day for us at Twitter. We all feel terrible this happened.
— jack (@jack) July 16, 2020
We’re diagnosing and will share everything we can when we have a more complete understanding of exactly what happened.
?? to our teammates working hard to make this right.
Recommended
While Twitter did not say whether company personnel were directly involved, it did acknowledge that hackers exploited the platform’s existing administrative infrastructure.
Twitter suffered a “coordinated social engineering attack who successfully targeted some of our employees with access to internal systems and tools,” Twitter Support announced in a statement last night after recovering from its own infiltration.
“Internally, we’ve taken significant steps to limit access to internal systems and tools while our investigation is ongoing. More updates to come as our investigation continues.”
TechCrunch claims that a person associated with the hacker, who goes by the pseudonym “Kirk,” began by purchasing the stolen usernames to “vanity” Twitter accounts and resetting the accompanying email addresses. Some Twitter users familiar with the main tool Kirk employed to control accounts began sharing screenshots, but Twitter has since removed the tweets and suspended users who posted them.
Another purported insider told Vice, “We used a rep that literally done all the work for us,” referencing an insider at Twitter.
Twitter temporarily disabled verified accounts before the hackers could infiltrate the platform further, spawning an almost revolutionary reaction from previous Twitter unknowns:
Blessed are the non-verified, for they shall inherit the discourse
— Alec Dent (@Alec_Dent) July 15, 2020
While some high-profile users joked about the incident, others consider it a serious threat to individual privacy and the integrity of the electoral system.
I don’t have any bitcoin to offer you but I do have grave concerns about what today’s hack of @Twitter means for the safety of our elections and other critical infrastructure from hostile actors. Now more than ever we have to strengthen our nation’s cyber security.
— John Garamendi (@RepGaramendi) July 15, 2020
Senator Josh Hawley (R-MO) drafted a letter to Twitter CEO Jack Dorsey, urging him to cooperate with the FBI and DOJ to investigate the source of the breach and develop systems to prevent any further problems.
“I am concerned that this event may represent not merely a coordinated set of separate hacking incidents but rather a successful attack on the security of Twitter itself. … A successful attack on your system’s servers represents a threat to all of your users’ privacy and data security,” he said.
The FBI’s San Francisco Bureau said it was “aware” of the incident and counseled users “not to fall victim to this scam by sending cryptocurrency or money in relation to this incident.”
Instances of individual accounts being hacked or moneymaking schemes perpetuated by accounts imitating high-profile individuals have happened before, but Twitter has never before experienced an incident at this scale.
Crypto scammers hack Elon Musk, Biden, Obama, and Kanye on Twitter@TwitterSupport says "We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it."https://t.co/fWBBPxzzST pic.twitter.com/WDYN4phBXW
— Engadget (@engadget) July 15, 2020
Join the conversation as a VIP Member