Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

A still from surveillance footage showing a confrontation in the entranceway at Dolly’s Gym on Nicol Street on Friday morning. (Image submitted)
Troublemaker causes pain and damage at downtown Nanaimo gym

VIDEO: Suspect breaks fire alarm, slams door on business owner’s foot after attempting to defraud her

Scott Saywell, Nanaimo Ladysmith Public Schools’ superintendent and CEO, has seen his contract renewed for four years, the district announced Wednesday. (SD68 YouTube screenshot)
Nanaimo school district renews superintendent’s contract for four years

‘Singing superintendent’ Scott Saywell under contract through 2024-25 school year

Cyclists pick up swag and cycling trail maps at city Bike to Work Week ‘celebration station’ a few years ago. (News Bulletin file photo)
City of Nanaimo’s active transportation plan will be about more than infrastructure

City working on goals to double walking trips and quintuple cycling and busing trips

Nanaimo RCMP seek public assistance after numerous tire slashings between Jan. 12-14. (News Bulletin file)
20 tires punctured in ‘slashing spree’ in Nanaimo

Nanaimo RCMP ask for any tips about Jan. 12-14 incidents in Country Club and Boxwood areas

Kinsmen Participark in Beban Park will be closed next week so city workers can remove dangerous trees and invasive plant species. The work is the start of an improvement project that includes replacing signs and fitness stations in the spring. (Chris Bush/News Bulletin)
Nanaimo fitness park to close for removal of hazard trees and invasive plants

Tree cutting to start in Beban Park’s Kinsmen Participark as part of improvement project

Health Minister Adrian Dix and provincial health officer Dr. Bonnie Henry head for the press theatre at the B.C. legislature for an update on COVID-19, Jan. 7, 2021. (B.C. government)
B.C.’s COVID-19 spread steady with 509 new cases Friday

Hospitalized and critical care cases decline, nine deaths

Seasonal influenza vaccine is administered starting each fall in B.C. and around the world. (Langley Advance Times)
After 30,000 tests, influenza virually nowhere to be found in B.C.

COVID-19 precautions have eliminated seasonal infection

Prime Minister Justin Trudeau listens to a question during a news conference outside Rideau cottage in Ottawa, Friday, January 8, 2021. THE CANADIAN PRESS/Adrian Wyld
Trudeau says Canada’s COVID vaccine plan on track despite Pfizer cutting back deliveries

Canadian officials say country will still likely receive four million doses by the end of March

Jobs Minister Ravi Kahlon shared a handwritten note his son received on Jan. 13, 2021. (Ravi Kahlon/Twitter)
Proud dad moment: B.C. minister’s son, 10, receives handwritten note for act of kindness

North Delta MLA took to Twitter to share a letter his son received from a new kid at school

Lilly and Poppy, two cats owned by Kalmar Cat Hotel ownder Donna Goodenough, both have cerebellAr hypoplasia, a genetic neurological condition that affects their ability to control their muscles and bones. Photo by Alistair Taylor – Campbell River Mirror
VIDEO: Wobbly Cats a riot of flailing legs and paws but bundles of love and joy to their owner

Woman urges others to not fear adopting cats with disabilities

Dr. Shannon Waters, the medical health officer for the Cowichan Valley Region, is reminding people to stay the course with COVID-19 measures. (File photo)
‘Stay the course’ with COVID measures, Island Health reminds

Limit social activity, wash hands, wear a mask, and isolate if you feel sick

Cowichan Tribes members line up at a drive-up clinic on Wednesday, Jan. 13 to receive the first doses of the COVID-19 vaccine in the region. (Kevin Rothbauer/Citizen)
BCAFN condems racism against Cowichan Tribes after COVID-19 outbreak

“Any one of us could do everything right and still catch the virus”: Regional Chief Terry Teegee.

Chief public health officer Dr. Theresa Tam provides an update on the COVID-19 pandemic in Ottawa on Friday, Jan. 8, 2021. THE CANADIAN PRESS/Sean Kilpatrick
Canada’s top doctor says to avoid non-essential travel as B.C. explores legal options

Premier John Horgan says he is seeking legal advice on whether it can limit interprovincial travel

Nursing staff at West Coast General Hospital celebrate the announcement of a $6.25-million expansion of the emergency department that will start in March 2021. (File photo)
B.C. health ministry commits $6.25M to hospital expansion in Port Alberni

Plans for larger emergency department have been on hold since 2015

Most Read