Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Just Posted

Black Press file photo
RCMP seek suspect in Vancouver Island-wide crime spree

Crimes stretched from Deep Bay to Qualicum, Ladysmith, Chemainus and Youbou

North Cowichan’s committee of the whole have rejected staff’s recommendation to limit the use of fireworks to Halloween. (File photo)
North Cowichan rejects limiting fireworks to Halloween

Municipality decides staff recommendation would be unpopular

Things are looking up for Vancouver Island as zero COVID-19 cases have been reported for the first time since October. THE CANADIAN PRESS/Darryl Dyck
Island records zero new COVID-19 cases for the first time since October

For the first time since October, the province is reporting zero new… Continue reading

CVRD Area E director Alison Nicholson, right, hiked two hours to Waterfall Camp at the Fairy Creek watershed along with Comox town councillor Nicole Minion and Comox Valley Regional District director Daniel Arbour to meet with old-growth logging activists on Monday, June 7. (Submitted)
Cowichan Valley regional director visits Fairy Creek protest camps

‘They clearly communicated that they are committed to what they are doing’

A small pod of Pacific white-sided dolphins pass by close to shore in Campbell River June 16, 2021. Still capture from video courtesy of Kimberly Hart
VIDEO: Dolphin sunset captured from Vancouver Island shore

Spectacular setting for view of travelling pod of Pacific white-sided dolphins

Karl and Stephanie Ann Johanson were thrilled to spot a pair of Sandhill Cranes in the Panama Flats this month, an unusual appearance for such birds. (Photo by Stephanie Ann Johanson)
WATCH: Sandhill cranes an unusual, joyful sight in South Island parkland

These birds don’t often touch down on their way between northern B.C. and Mexico

Police are asking for public assistance in locating Anthony Graham who has been charged with the murders of Kamloops brothers Carlo and Erick Fryer. (RCMP photo)
2 charged, suspect at large in killings of B.C. brothers linked to gang activity: RCMP

Kamloops brothers Erick and Carlo Fryer were found deceased in May on a remote Okanagan road

(V.I. Trail/Google Maps)
Now 90% complete, Vancouver Island trail forges new funding parnership

Victoria Foundation takes on Vancouver Island Trail Association; fund valued at $40,000

Albert Health Minister Tyler Shandro and Alberta Premier Jason Kenney unveil an opening sign after speaking about the Open for Summer Plan and next steps in the COVID-19 vaccine rollout, in Edmonton, Friday, June 18, 2021. THE CANADIAN PRESS/Jason Franson
Alberta 1st province in Canada to lift all COVID-19 public health restrictions

70.2% of eligible citizens 12 and older in the province have received a dose of the vaccine

Fraser Health registered nurse Ramn Manan draws a dose of the Pfizer COVID-19 vaccine into a syringe at a walk-up vaccination clinic at Bear Creek Park, in Surrey, B.C., on Monday, May 17, 2021. THE CANADIAN PRESS/Darryl Dyck
‘Honour our fathers’ with COVID-19 vaccine protection, B.C. urges

109 new cases Friday, 75 per cent of 12 and up immunized

Freighters have becomd abundant in the Trincomali Channel on the east side of Thetis Island.
Nanaimo ponders taking on waste from nearby anchored freighters

Vancouver-based Tymac petitioning the Regional District of Nanaimo to accept waste at its landfill

(Paul Henderson/ Chilliwack Progress)
Trutch Avenue in Chilliwack to be renamed to remove racist taint

New name to have Indigenous significance as Chilliwack takes new step toward reconciliation

Most Read