Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Rod Bitten of Union Bay won $500,000 in the Lotto Max draw on Jan. 15. Photo supplied
Union Bay electrician gets shocking surprise with $500K Extra win

Rod Bitten has been hard at work with home renovations, which is… Continue reading

Eighteen-year-old Aidan Webber died in a marine accident in 2019. He was a Canadian Junior BMX champion from Nanaimo. (Submitted)
Inadequate safety training a factor in teen BMX star’s workplace death in 2019

Aidan Webber was crushed by a barge at a fish farm near Port Hardy

Oyster River Fire Rescue members were called out to a suspicious fire in Black Creek. Two vehicles parked at a private residence were destroyed by fire. Photo courtesy Oyster River Fire Rescue
Suspicious fire destroys two vehicles at Black Creek residence

Oyster River Fire Rescue personnel were dispatched to a fire at a… Continue reading

The Northeast Woods in Comox is a popular area for hikers and mountain bike riders. It's also a protected park and conservation area. Photo by Scott Stanfield
Comox Valley RCMP seeking witnesses to ‘indecent act’ in Northeast Woods

Comox Valley RCMP are looking for witnesses after a man was seen… Continue reading

Courtenay Mayor Bob Wells is pictured in December 2018 presenting Marla Ayre, and her children Hunter and Marissa, with keys to their new home at the Habitat For Humanity Vancouver Island North’s Lake Trail Road project. File photo
Courtenay council gives green light to next Habitat build

Courtenay council adopted a bylaw to allow Habitat for Humanity to construct… Continue reading

Maj.-Gen. Dany Fortin, vice-president of logistics and operations at the Public Health Agency of Canada, speaks at a news conference on the COVID-19 pandemic in Ottawa, on Friday, Jan. 15, 2021. THE CANADIAN PRESS/Justin Tang
B.C. records 500 new COVID-19 cases Wednesday, 14 deaths

Outbreak at Surrey Pretrial jail, two more in health care

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

A suspect has been arrested in connection with fires at Drinkwater Elementary (pictured) and École Mount Prevost. (Kevin Rothbauer/Citizen)
Arson suspect arrested after fires at Cowichan Valley schools

Drinkwater Elementary and Mount Prevost schools hit within a week

A woman writes a message on a memorial mural wall by street artist James “Smokey Devil” Hardy during a memorial to remember victims of illicit drug overdose deaths on International Overdose Awareness Day, in the Downtown Eastside of Vancouver, on Monday, August 31, 2020. THE CANADIAN PRESS/Darryl Dyck
B.C. paramedics respond to record-breaking number of overdose calls in 2020

On the front lines, COVID-19 has not only led to more calls, but increased the complexity

Nanaimo RCMP are seeking the public’s help after a man allegedly assaulted a clerk at James General Store on Victoria Road on Jan. 18. (Submitted photo)
Suspect screams at customer then assaults store clerk in Nanaimo

RCMP asking for information about Jan. 18 incident at James General Store

Chartwell Malaspina Care Residence in Nanaimo. (News Bulletin file photo)
Two Nanaimo care-home residents have died during COVID-19 outbreak

Death reported Monday was the second related to Chartwell Malaspina outbreak, says Island Health

Members of the BC RCMP Explosive Disposal Unit (EDU) is on route to Drummond Park opposite of Fulford Habour on Saltspring Island after the discovery of a suspicious cylindrical-shaped device. (Google/Screencap)
Bomb disposal unit en route to Salt Spring Island after suspicious device found in park

Police say a resident discovered the device Wednesday morning in Drummond Park opposite BC Ferries terminal

Seven streets in downtown Duncan, including Station Street, will soon have new native names added to their signage. (Submitted graphic)
New Duncan street signs will be in English and Hul’q’umi’num

Seven streets to get additional names in First Nations language

Southern resident killer whales in B.C. waters. Research shows the population’s females are more negatively influenced by vessel traffic than males. (Photo supplied by Ocean Wise Conservation Association)
Female orcas less likely to feed in presence of vessel traffic: study

Research the southern resident population raises concerns over reproduction capacity

Most Read