Twitter admits 130 A-lister accounts compromised to promote Bitcoin scam after 'social engineering' attack
- Reference: 1594992056
- News link: https://www.theregister.co.uk/2020/07/17/twitter_blue_tick_hack_latest/
- Source link:
The estimate comes days after the social media biz admitted the blitz – which snared the accounts of Bill Gates, Elon Musk, Jeff Bezos, Apple, Uber and former President Barack Obama – [2]was the result of "coordinated social engineering" .
In a post at 4am GMT of Friday morning, the Twitter support account [3]said :
Based on what we know right now, we believe approximately 130 accounts were targeted by the attackers in some way as part of the incident. For a small subset of these accounts, the attackers were able to gain control of the accounts and then send Tweets from those accounts. — Twitter Support (@TwitterSupport) [4]July 17, 2020
"We're working with impacted account owners and will continue to do so over the next several days," the company added. "We are continuing to assess whether non-public data related to these accounts was compromised, and will provide updates if we determine that occurred."
Twitter said it was "taking aggressive steps to secure our systems while our investigations are ongoing".
News outlet Vice [5]claimed earlier this week that hackers boasted they had paid a Twitter insider to take control of the accounts.
The [6]scam itself posted fake tweets in which followers were encouraged to send Bitcoin to a specific address with the promise that double the money would be returned.
The Bitcoin address in question has received almost $118,000.
In the aftermath of the 15 July attack, Twitter said yesterday: "We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools."
Today, the Twitter support account [7]said it had no evidence that attackers accessed people's actual passwords, hashed or otherwise.
It appears the hijackers were able to, directly or indirectly, access an internal Twitter control panel disable multi-factor authentication on the popular accounts and change their email addresses, at least in some cases, allowing passwords to be reset and profiles taken over.
"Currently, we don't believe resetting your password is necessary," Twitter said, referring to its users in general. ®
Get our [8]Tech Resources
[1] https://www.theregister.com/2020/07/15/mass_twitter_account_hacking_bitcoin/
[2] https://www.theregister.com/2020/07/16/twitter_account_hijack_latest/
[3] https://twitter.com/TwitterSupport/status/1283957911841054721
[4] https://twitter.com/TwitterSupport/status/1283957911841054721?ref_src=twsrc%5Etfw
[5] https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos
[6] https://www.theregister.com/2020/07/15/mass_twitter_account_hacking_bitcoin/
[7] https://twitter.com/TwitterSupport/status/1283843495354970114?s=20
[8] https://whitepapers.theregister.com/
Complete this sentence: Twitter is for tw*ts .
Bitcoin is for bats?
Follow the money?
Any guesses on which country the currency is extracted through?
Re: Follow the money?
The only country scamming for money is North Korea and they are very good at it - which is odd because this scam wasn't that efficient. Rather than tracking the total amount, how many transactions were there and when did they take place?
But when a scam like this happens all we know is what happens, knowing who's behind it is just guesswork.
Re: Follow the money?
Doesn't have to be a country and who knows if pushing the scam was all the were interested in?
But, as long as it's just Twitter, who really cares?
A foolish move
Never harm people who have the influence to turn the FBI onto you hard and the money to use other means to hurt you if you are beyond the FBIs direct reach
Re: A foolish move
This reminds me of a line from the TV show Law & Order, "Never attack people with virtually unlimited money, for they can afford to be vindictive and indulge their whims."
What I want to know is whose account raised the most money? Who has the stupidist followers? While I'm sure that some of the people who were fooled by this rather obvious SCAM are desperately trying to make ends meet, and I feel sorry for them. But for all the others, you lost what you deserve for being so greedy and stupid. Why on earth would people like Bill Gates and Obama want to send you bitcoins? You should have sent your money to me. I really will send it back doubled… Honest!
> What I want to know is whose account raised the most money?
I don't believe there is any way of ascertaining that, though my understanding of bitcoin is limited.
Not very ambitious?
Just over 100,000 dollars seems like a small haul compared to what could have been made by using the fake tweets to manipulate the stock market... ...though I guess it would be easier to trace people who made suspicious trades just before the fake tweets.
Re: Not very ambitious?
My understanding is that the blatant insider trade at the start of the 2008 mortgage collapse was never traced. I don't know any more than that.
Your passwords are safe - phew!
> Today, the Twitter support account said it had no evidence that attackers accessed passwords.
So, Twitter accounts themselves weren't compromised but there was social engineering. Which means the attackers compromised Twitter admin accounts and then sent out those scam tweets. Let that just sink in for a moment: Twitter staff can send tweets from anyone's account as if the account owner had sent them.
Why is that even a function in the system? Suspend an account: yep. Delete a tweet: yep. Delete an account: yep. But impersonate a user?
Perhaps it's not that kind of breach at all. Maybe the attackers social-engineered access to the 'fake twitter accounts department' - the one that is used to pretend to advertisers that there are 100m active users every second of the day.
Grand Exchange Doublers
Anyone who has played more than 30 minutes of Runescape would have known not not fall for this.
'The Bitcoin address in question has received almost $118,000'
A fool and their money...
Having seen some of the sample Tweets I'm saddened that anyone fell for it but not hugely surprised.