Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

FILE - In this April 19, 2021, file photo, Keidy Ventura, 17, receives her first dose of the Pfizer COVID-19 vaccine in West New York, N.J. States across the country are dramatically scaling back their COVID-19 vaccine orders as interest in the shots wanes, putting the goal of herd immunity further out of reach. (AP Photo/Seth Wenig, File)
5 more deaths, 131 new cases of COVID-19 in Interior Health over the weekend

Those 18-years and older in high-transmission neighbourhoods can register for the vaccine

Cariboo North MLA Coralee Oakes shared this photo of the binders and binders of letters and paperwork she’s received on area roads in the past few years. (Submitted photo)
Cariboo MLAs call on province to fix region’s roads

Minister Rob Fleming said more resources were on the way to the region

A medical worker prepares vials of the COVID-19 vaccines, Chinese Sinopharm, left, Sputnik V, center, and Pfizer at a vaccine centre, in the Usce shopping mall in Belgrade, Serbia, Thursday, May 6, 2021. Serbian authorities are looking for incentives for people to boost vaccination that has slowed down in recent weeks amid widespread anti-vaccination and conspiracy theories in the Balkan nation. The government has also promised a payment of around 25 euros to everyone who gets vaccinated by the end of May. (AP Photo/Darko Vojinovic)
38 new COVID-19 cases, more than 335k vaccines administered in Interior Health

Interior Health also to start targeted vaccinations in high transmission neighbourhoods

FILE PHOTO
Second doses of COVID-19 vaccine will be available, as AstraZeneca supply runs low: Interior Health

Province expecting large volumes of Pfizer BioNTech as age-based cohort immunization program ramps up

Pharmacist Barbara Violo arranges all the empty vials of the Oxford-AstraZeneca COVID-19 vaccines that she has provided to customers at the Junction Chemist which is an independent pharmacy during the COVID-19 pandemic in Toronto, on Monday, April 19, 2021. THE CANADIAN PRESS/Nathan Denette
B.C.’s 1st vaccine-induced blood clot case detected in Interior Health

Interior Health also recorded 52 new cases of COVID-19

A bullet hole is seen in the windshield of an RCMP vehicle approximately 4 km from Vancouver International Airport after a one person was killed during a shooting outside the international departures terminal at the airport, in Richmond, B.C., Sunday, May 9, 2021. THE CANADIAN PRESS/Darryl Dyck
Homicide team IDs man in fatal YVR shooting as police grapple with spate of gang violence

Man, 20, charged in separate fatal shooting Burnaby over the weekend

RCMP are searching for Philip Toner, who is a ‘person of interest’ in the investigation of a suspicious death in Kootenay National Park last week. Photo courtesy BC RCMP.
RCMP identify ‘person of interest’ in Kootenay National Park suspicious death

Police are looking for Philip Toner, who was known to a woman found dead near Radium last week

Vancouver Canucks goaltender Thatcher Demko (35) makes a save on Winnipeg Jets’ Nate Thompson (11) during second period NHL action in Winnipeg, Monday, May 10, 2021. THE CANADIAN PRESS/Fred Greenslade
Vancouver Canucks see NHL playoff hopes dashed despite 3-1 win over Winnipeg

Montreal Canadiens earn final North Division post-season spot

The B.C. legislature went from 85 seats to 87 before the 2017 election, causing a reorganization with curved rows and new desks squeezed in at the back. The next electoral boundary review could see another six seats added. (Black Press files)
B.C. election law could add six seats, remove rural protection

North, Kootenays could lose seats as cities gain more

The Independent Investigations Office of B.C. is investigating the shooting of an Indigenous woman in the Ucluelet First Nation community of Hitacu. (Black Press Media file photo)
B.C. First Nation wants ‘massive change’ after its 3rd police shooting in less than a year

Nuu-chah-nulth woman recovering from gunshot wounds in weekend incident near Ucluelet

Nurse Gurinder Rai, left, administers the Moderna COVID-19 vaccine to Maria Yule at a Fraser Health drive-thru vaccination site, in Coquitlam, B.C., on Wednesday, May 5, 2021. The site is open for vaccinations 11 hours per day to those who have pre-booked an appointment. THE CANADIAN PRESS/Darryl Dyck
COVID vaccine bookings to open for adults 40+, or 18+ in hotspots, across B.C.

Only people who have registered will get their alert to book

Dr. Victoria Lee, CEO of Fraser Health, hosts an update on efforts to contain B.C.’s COVID-19 transmission in Surrey and the Fraser Valley and protect hospitals in the Lower Mainland, May 6, 2021. (B.C. government video)
B.C.’s COVID-19 infection rate slowing, 20 more people die

Deaths include two people in their 40s, two in their 50s

The Canadian Forces Snowbirds are in the Comox Valley for their annual spring training. Photo by Erin Haluschak
Suspected bird strike on Snowbirds plane during training in B.C.

Pilot followed protocols and landed the aircraft on the ground without any problems

Most Read