On July 15th, 2020, sometime in the afternoon, Twitter saw one of its worst hacks since its creation. While Twitter CEO Jack Dorsey termed it a “bad day” for Twitter, the implications are far-reaching and disturbing.
Imagine using your Cox essential package like you always do – scrolling through social media sites. Suddenly you see a tweet from a verified account, promising to double your bitcoin wealth. All you have to do is send it to a wallet shared in the tweet. Seems too good to be true, right? But what if a bunch of very popular verified Twitter accounts posted the same thing? Would you be convinced? As it turns out, may people were. This blog explores everything we know so far about the Twitter Bitcoin Hack.
The Hack – What Exactly Happened
From the information that has emerged so far, a hacker (or group of hackers) gained control over several verified Twitter accounts. Many of these accounts were owned by legitimate financial exchanges, business leaders, and Bitcoin and tech gurus. The hackers tweeted variations of the same message, claiming to give back 5000 bitcoins and directing audiences to a cryptoforhealth.com website. This website told visitors to send Bitcoin to a specific address, after which it would be doubled and sent back.
Many prominent verified accounts fell victim to the attack. Tech industrialist Elon Musk’s account is believed to be the first one to be hacked. It was quickly followed by former president Barrack Obama, presidential hopeful Joe Biden, and billionaire Bill Gates. Soon, Amazon founder Jeff Bezos, investment guru Mike Bloomberg, and rapper Kanye West followed. Even the verified accounts of tech corporations like Apple and Uber weren’t safe.
How Twitter Reacted
All of these accounts tweeted more or less the same message. They all directed users to the same webpage. They also added a 30-minute time window to how long they were willing to double the bitcoins sent to the specified wallet. Many ardent Bitcoin owners and fans of these accounts fell victim to the scam. Many have reported sending Bitcoin to the wallet but never receiving anything in return.
By this time, Twitter finally became aware that all was not well in the Land of Tweets. To prevent hackers from tweeting more scams, Twitter temporarily suspended Tweets for verified users. The owners of verified accounts could only retweet existing tweets or create temporary accounts. Around 8:30 pm EST Twitter finally had the situation under control and restored functionality to verified accounts. However, it seems the damage was already done. And not just to the victims of the scam.
What Twitter Has Confirmed
Twitter has announced that its investigation into the breach is still ongoing. In terms of conclusive evidence, there isn’t a lot of verified material available. However, Twitter has confirmed that some of its employees were targets of a ‘social engineering attack”. This attack was meant to gain the employees’ access to Twitter’s internal control systems and tools.
However, the nature of the social engineering attack is still not clear. We do know that the hackers succeeded in taking control of multiple high-profile verified accounts, and use them to publish scam tweets. As of now, Twitter has announced it has limited the number of people who can access its internal controls and systems. Since sharing this information, the official Twitter Support account has been silent. But disturbing information continues to emerge from other sources.
Rumors persist that the social engineering Twitter refers to may actually mean the hackers bribed mid-level Twitter employees. Motherboard published a report in which it interviewed sources claiming to have hijacked some accounts. These sources revealed the existence of a control panel that many mid-level employees have access to. Among other things, this control panel allows users to change the email address associated with a Twitter account. It seems the hackers bribed at least one mid-level employee for access to the control panel. This was then used to temporarily change the email addresses of verified Twitter accounts to allow hackers to post on their behalf.
The Reaction from Lawmakers and Law Enforcement Agencies
Obviously, the news of the hack has caused widespread fear and dismay. Members of the United States, especially Senator Josh Hawley, have called for Twitter to answer questions about the scope and detail of the breach. Senator Hawley also raised questions about potential personal data loss as well the controls Twitter has in place to guard against such incidents. These are all valid concerns because the problem won’t have a simple fix like changing a Cox Wi-Fi Password.
Government bodies and regulators are also reportedly looking at Twitter with more scrutiny following the hack. Brian Fung from CNN Business laid down the possibility that Twitter could face increased scrutiny from the Federal Trade Commission, even hinting at a full-blown investigation. Across the Atlantic, the EU may also be gearing up to place Twitter under the microscope. Yes, most victims of the scam were Americans, but it raises serious questions about security standards and practices within Twitter. If the EU finds that the platform was lax in protecting its users, it could slap a sizeable fine on Twitter.