The Guardian
Email YouTube Facebook Instagram Twitter WhatsApp

Twitter says hack targeted employees using ‘spear phishing’

Related

(FILES) This file photo taken on November 20, 2017 shows logos of US online news and social networking service Twitter displayed on computers’ screens. – Twitter said July 28, 2020 it had withdrawn a video retweeted by President Donald Trump in which doctors made allegedly false claims about the coronavirus pandemic, after Facebook took similar action. “Tweets with the video are in violation of our COVID-19 misinformation policy. We are taking action in line with our policy,” a Twitter spokesperson said, declining to give details on how many people had watched the video.The video was also removed by Facebook on Monday evening, said a company spokesperson, explaining that the footage shared “false information about cures and treatments for COVID-19.” (Photo by LOIC VENANCE / AFP)


The hackers who accessed dozens of high-profile Twitter accounts in mid-July gained access to the system with an attack that tricked a handful of employees into giving up their credentials, according to a company update.

Twitter said in a security update late Thursday that the July 15 incident by bitcoin scammers stemmed from a “spear-phishing” attack which deceived employees about the origin of the messages.

The hackers “targeted a small number of employees through a phone spear-phishing attack,” according to a Twitter Support statement.

“This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems.”

Twitter said that following the incident it has “significantly limited access to our internal tools and systems” and is taking additional steps to tighten security.

The massive hack of high-profile users from Elon Musk to Joe Biden affected at least 130 accounts as part of an effort to dupe people into sending hackers the virtual currency bitcoin.

The official accounts of Apple, Uber, Kanye West, Bill Gates, Barack Obama and others were also affected.

Faked tweets were sent from 45 accounts, according to Twitter, and the hackers accessed private messages of 36 and downloaded Twitter data from seven.

Law enforcement is also investigating the incident which has raised concerns about the security of the platform increasingly used for conversations on politics and public affairs.

John Dickson of the security firm Denim Group said the latest disclosure does not necessarily suggest a sophisticated attack from a nation-state.

“They conned people over the phone,” Dickson said, saying it may have been possible to find targets through research on LinkedIn or Google.

“This is like the original hackers from the 1980s and 1990s; they were very good at conning people and getting them to give their credentials.”

Dickson said the origin of the hack is still not clear but added that “I would not assume” it came from a state-backed operation.


In this article:
Twitter
Receive News Alerts on Whatsapp: +2348136370421

No comments yet