Main Highlights:
- The Twitter breach demonstrated that the corporation was unprepared to deal with an incursion into its internal tools that provided access to high-profile accounts.
- Twitter accused a “social engineering” campaign by hackers who exploited accounts belonging to important persons such as Joe Biden, Elon Musk, and Bill Gates to tweet a bitcoin fraud.
- As the investigation proceeds, the corporation will need to address several important issues in order to reassure the public that its systems are safe.
We have some terrible news for you if you have a hidden Twitter account.
Twitter stated that a security flaw allowed a hostile actor to obtain the account names linked with specific email addresses and phone numbers associated with an existing Twitter account. This implies that the bad actor may have uncovered people’s hidden celebrity stan accounts.
The Twitter breach was not only unprecedented; it also revealed that the firm is ill-equipped to handle the security of a network that serves as the backbone of breaking news, government policy, and market-moving events on the internet.
Twitter verified the news on Friday. After receiving a tip through its bug bounty programme, Twitter patched the hole in January, but a hacker exploited it before Twitter even knew about it.
The vulnerability, which resulted from a June 2021 upgrade to the platform’s code, remained unreported until early this year. This offered hackers many months to exploit the hole, while Twitter stated at the time of its discovery that it “had no evidence to imply someone had taken advantage of the vulnerability.”
According to reports, Twitter fixed the hole in January after receiving a tip about it through its bug bounty programme, but the hacker had already exploited it by then. The vulnerability stemmed from a June 2021 update to Twitter’s code, but it went unnoticed until earlier this year.
This offered hackers many months to exploit the hole, while Twitter stated at the time of its discovery that it “had no evidence to imply someone had taken advantage of the vulnerability.”
The hacker was able to exploit the flaw while remaining undetected by Twitter. Using the weakness, the hacker collected a database of over 5.4 million accounts, which he then attempted to sell on a hacker site for $30,000. Twitter verified that its user data had been hacked after evaluating the data provided on the site.
While it is yet unknown how many people have been impacted, Twitter does not appear to know. While Twitter claims it will contact affected users, it is unable to “confirm every account that may have been impacted.”
Twitter recommends that anybody worried about their hidden accounts establish two-factor authentication and link an email address or phone number that is not publicly known to the account they do not want to be affiliated with.
A vulnerability in Twitter’s infrastructure was reported through the bug bounty programme in January 2022. As a result of the vulnerability, if someone submitted an email address or phone number to Twitter’s systems, Twitter’s systems would inform the individual of what Twitter account, if any, the given email address or phone number was linked with.
This implies that if you had someone’s email address or phone number, you could simply determine whether or not they had a Twitter account. Say you got Elon Musk’s address and investigated it, and discovered that he had a different account from the one he regularly tweets from – bang, you’ve just discovered his hidden account. Not ideal for anyone wishing to tweet anonymously or privately.
Did the Twitter employee(s) cooperate with the hackers?
If Vice’s claim is correct, there was some sort of collaboration between the hackers and at least one corporate employee. Given the Saudi Arabia case from last autumn and the attack on Wednesday, Twitter should publish how it evaluates workers before granting them access and what measures it has in place to ensure that access does not leak out. How could the hackers mislead an employee into handing up access if there was no cooperation, and what is being done to prevent this from occurring again?
So far, Twitter has only confirmed that at least one of its workers was involved in the hack. Twitter called it “social engineering,” which implies a hacker tricked someone into surrendering their login credentials for access. Twitter has not released any further information on the incident, but has stated that more will be released as the investigation proceeds.
However, a study published on Wednesday painted a considerably harsher picture. According to Vice’s reporter, he spoke anonymously with at least some of the hackers engaged in Wednesday’s Twitter attack, and they claimed to have paid off a Twitter employee in order to acquire access to a technology that allows extensive control over high-profile Twitter accounts.
If this is true, it would be the second time Twitter has been supposedly hacked from within. The Department of Justice accused two Twitter workers late last year with transmitting private information from Twitter users to Saudi nationals.
The attack might have been far worse than a straightforward bitcoin fraud reposted by numerous famous accounts. Consider how much harm the hackers could have caused if they had coordinated messages warning of an oncoming economic collapse, a new epidemic, or even war.
With all of this in mind, Twitter will have a lot of questions regarding the security of its systems to address in the coming days. The entire saga has demonstrated the importance of Twitter in the flow of news, information, and even government policy throughout the world. After all, it’s not uncommon for President Trump to issue policy directives, fire officials, or make market-moving statements with the click of a “tweet” button.