Twitter logo. (AP Photo/Jeff Chiu)

Twitter logo. (AP Photo/Jeff Chiu)

Twitter racing to unravel mystery cyberattack

Some of the world’s most prominent names had their Twitter accounts post invitations for an apparent Bitcoin scam

As Twitter Inc. grapples with the worst security breach in its 14-year history, it must now uncover whether its employees were victims of sophisticated phishing schemes or if they deliberately allowed hackers to access high-profile accounts.

On Wednesday, some of the world’s most prominent names, including former president Barack Obama and Democratic candidate and his former vice president Joe Biden, along with Bill Gates, Elon Musk and Warren Buffett, had their Twitter accounts post invitations for an apparent Bitcoin scam. Twitter reacted by blocking further posts from all verified accounts on the service and said it had detected “a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

The company’s explanation has ignited speculation over the identity of the perpetrators and what they were actually targeting in the attack. The scale of the endeavor and its timing —months before the November U.S. elections —have given rise among cybersecurity experts to theories that the attack masked a more nefarious campaign to seize sensitive data.

In its investigation of the incident, Twitter will now likely focus on employee logs, email and phone records. At question will be any failures in authentication processes that might have allowed hackers to hijack verified accounts, and also what other information, such as direct messages, might have been compromised in the breach. The Bitcoin wallets promoted in the tweets collected around $120,000 in cryptocurrency.

Twitter shares were down about 6% in pre-market trading on Thursday.

A social engineering attack means “leveraging the human element of security” and there are many different ways to do that, said Rachel Tobac, Chief Executive Officer of San Francisco-based SocialProof Security.

“I can phish someone who has administrative access and try and gain access to their credentials and log into their account,” she said, or the less technical method would be to develop “a relationship with someone who works on those panels and convincing them to do your bidding for you.”

Security awareness at companies like Twitter would be mandatory, but ultimately it’s hard to track insider attacks when it’s the employees rather than the technology who fall under the microscope, Tobac said.

“It used to be the Nigerian prince letter with a bunch of spelling mistakes, and now it’s something that almost looks legitimate, but it always starts with a person,” said Frances Dewing, the CEO of cybersecurity firm Rubica Inc., based in Seattle.

“There’s a playbook for doing this, there are cybercriminal organizations that make millions of dollars. It’s the fastest growing business in the world,” she said.

And there is no accounting for disaffected workers, as Twitter learned in 2017 when an employee deactivated President Donald Trump’s account before it was quickly restored.

Identifying potential Twitter employees to target wouldn’t be difficult for the hackers, given the way most smartphone apps hungrily vacuum up location and other contextual data from users —data which is often then sold on to marketing companies. Anyone frequenting the same coffee shops and businesses or entering and leaving a workplace at particular hours can give away clues about themselves.

Cybersecurity experts can only speculate until Twitter itself reveals what happened and where the failures occurred, but even this kind of show of force —a demonstration by hackers to earn credibility or gain infamy —isn’t convincing them that a Bitcoin scam was all there was to the operation.

With U.S. elections looming, the cyber landscape is ripe for a major attack. Stas Protassov, co-founder and president of global technology firm Acronis said the attack was “too prepared to be just a cryptocurrency scam.”

“We don’t believe that’s all the hackers went into once they got access,” he said in an email. “The attack is too big and too noisy and likely covering a bigger play. We’ve yet to see the full impact of what this was about.”

Tobac also raised the possibility that the attack could have been a distraction while hackers harvested private direct messages and any other confidential data to be able to deploy at a more critical time. So while the initial disruption to Twitter’s service appears to have been patched over and the company is gradually restoring normal operation, the lingering effects of this breach might have much wider effects than Wednesday’s spectacle.

“Maybe they were doing something insidious and this was just a cover up,” she said. “There’s no way for us to know, we can just speculate.”

Whatever happened, Twitter must be completely candid about the cause of attack once it’s established, Tobac said. “This was such a public meltdown that if they’re not completely transparent it would damage their brand further.”

Jamie Tarabay, Bloomberg News

Like us on Facebook and follow us on Twitter.

Want to support local journalism? Make a donation here.

social media

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Zaudanawng “Jay-Dan” Maran in his Creston home. Hanging on the wall behind him is a logo of Kachin’s Manaw festival. Photo: Aaron Hemens
From Myanmar to Creston: The story of a refugee

In October 2007, Zaudanawng “Jay-Dan” Maran and his friends encountered a woman being sexually assaulted by two Myanmar soldiers.

Toronto’s Mass Vaccination Clinic is shown on Sunday January 17, 2021. THE CANADIAN PRESS/Frank Gunn
Interior Health reports 2 more deaths, 83 new COVID-19 cases

Health authority also identifies new virus cluster in Fernie

The Piper Computer, a build-your-own-computer, is one of the kits available for loan at the Creston Public Library. Photo: Aaron Hemens
At-home, STEM-based learning kits available for loan at Creston Public Library

There are over a dozen learning kits available to borrow, which includes a build-your-own computer kit, circuit board kits, robot kits, a drone and more.

South Columbia Search and Rescue called in the Nelson Search and Rescue and Kootenay Valley Helicopters to provide a long line rescue. Photo: BCSAR submitted.
Long-line rescue needed for injured hiker near Trail

Members of South Columbia and Nelson SAR and Kootenay Valley Helicopters did a long-line evacuation

A sign indicating a COVID-19 testing site is displayed inside a parking garage in West Nyack, N.Y., Monday, Nov. 30, 2020. The site was only open to students and staff of Rockland County schools in an effort to test enough people to keep the schools open for in-person learning. (AP Photo/Seth Wenig)
4 more deaths, 54 new cases of COVID-19 in Interior Health

This brings the total to 66 deaths in the region

British Columbia Health Minister Adrian Dix looks on as Provincial Health Officer Dr. Bonnie Henry addresses the media during a news conference at the BC Centre of Disease Control in Vancouver B.C. (THE CANADIAN PRESS/Jonathan Hayward)
B.C. announces 485 new COVID-19 cases, fewest deaths in months

‘The actions we take may seem small, but will have a big impact to stop the virus,” urges Dr. Henry

Keith Thorpe/Peninsula Daily News
Search called off for small plane that went down in rough water south of Victoria

Plane bound for Port Angeles from Alaska believed to have one occupant, an Alaskan pilot

Royal B.C. Museum conservator Megan Doxsey-Whitfield kneels next to a carved stone pillar believed to have significance as a First Nations cultural marker by local Indigenous people. The pillar was discovered on the beach at Dallas Road last summer. Museum curatorial staff have been working with Songhees and Esquimalt Nation representatives to gain a clearer picture of its use. (Photo courtesy Royal BC Museum)
Stone carving found on Victoria beach confirmed Indigenous ritual pillar

Discussion underway with the Esquimalt and Songhees about suitable final home for the artifact

Former Vancouver Giants forward Evander Kane is seen here in Game 7 of the second round of the 2009 WHL playoffs against the Spokane Chiefs (Sam Chan under Wikipedia Commons licence)
Gambling debts revealed in details of bankruptcy filing by hockey star Evander Kane

Sharks left winger and former Vancouver Giants player owes close to $30 million total

Othman “Adam” Hamdan, pictured in front of Christina Lake’s Welcome Centre, was acquitted of terrorism related charges in 2017. He has been living in Christina Lake since November 2020. Photo: Laurie Tritschler
Man acquitted on terrorism charges awaits deportation trial while living in Kootenays

Othman Ayed Hamdan said he wants to lead a normal life while he works on his upcoming book

Cannabis bought in British Columbia (Ashley Wadhwani/Black Press Media)
Is it time to start thinking about greener ways to package cannabis?

Packaging suppliers are still figuring eco-friendly and affordable packaging options that fit the mandates of Cannabis Regulations

B.C. Premier John Horgan wears a protective face mask to help prevent the spread of COVID-19 prior to being sworn in by The Honourable Janet Austin, Lieutenant Governor of British Columbia during a virtual swearing in ceremony in Victoria, Thursday, November 26, 2020. THE CANADIAN PRESS/Jonathan Hayward
Premier Horgan calls jumping COVID vaccine queue ‘un-Canadian’

Horgan says most people in B.C. are doing their best to follow current public health guidelines

Prime Minister Justin Trudeau, left, and Vancouver Mayor Kennedy Stewart share a laugh while speaking to the media before sitting down for a meeting at City Hall, in Vancouver, on Friday August 30, 2019. (THE CANADIAN PRESS/Darryl Dyck)
Vancouver mayor, Health Canada to formally discuss drug decriminalization

Kennedy Stewart says he’s encouraged by the federal health minister’s commitment to work with the city

Royal Inland Hospital in Kamloops. (Dave Eagles/Kamloops This Week file photo)
COVID-19 outbreak at Kamloops hospital grows to 66 cases

A majority of cases remain among staff at Royal Inland Hospital

Most Read