We know you couldn’t miss it. If you did, this week multiple high profile accounts, such as Barack Obama, Joe Biden, Elon Musk, Kim Kardashian, and Apple, had their Twitter accounts hacked. But you really should not sent your bitcoins to this address.
It all began with with a teasing message between two naive hackers late Tuesday on the online messaging platform Discord.
“yoo bro,” wrote a user named Kirk. “i work at twitter / don’t show this to anyone / seriously.” according to a screenshot shared to The New York Times.
Kirk proceed with a demonstration. He could take control of any and all valuable Twitter accounts, as if he had gained access to the inside Twitter system that was not for public use. However, later a hacker with the name “lol” decided that Kirk was not actually apart of Twitter, simply because he was too willing to damage the company.
However, Kirk did have access to some of Twitters most sensitive and dangerous tools which allowed the hacker to take control of Barack Obama, Joe Biden, Elon Musk, Kim Kardashian, and Apple’s twitter accounts. This is not the full list, and does not include a long list of other celebrities.
So what happened? Well, it turns out Kirk, who is actually apart of group that sells “OG” social media accounts such as @dark, @w, @l, @50 and @vague (at least half of these are now suspended), had hacked into some of Twitters internal systems. These internal systems were tools that gave the hacker full access to manage accounts however the hacker wanted.
Twitters Response
Twitter reported on their blog about their “security incident” that the attackers had targeted 130 accounts, gaining access and tweeting from 45 of that set. Twitter explained this as more of a Social Engineering attack, however the tool seems to also expose adding and removing email accounts, which could easily be used to reset the password to a Twitter account.
Attackers were able to view personal information including email addresses and phone numbers, which are displayed to some users of our internal support tools.
In cases where an account was taken over by the attacker, they may have been able to view additional information. Our forensic investigation of these activities is still ongoing.
A social engineering attack usually requires convincing someone to give you information that can then be used to reset your password by means of say, your security questions, or by talking to a support member with valuable information.
Twitter now seems to have caught up with the situation. However, it seems they are still piece together exactly how they got access.
The hackers brought in 20 BTC, which roughly translates to over 250,000 AUD.