Obama, Musk, Gates hacked in Twitter bitcoin scam

“We’re looking into what other malicious activity they may have conducted or information they may have accessed,” Twitter’s spokesman added. “We’ve taken significant steps to limit access to internal systems and tools while our investigation is ongoing.”

Jack Dorsey, Twitter’s chief executive, said in a post Wednesday night that it was a “tough day for us at Twitter. We all feel terrible this happened. We’re diagnosing and will share everything we can when we have a more complete understanding of exactly what happened.”

The hackers did not use their access to take aim at any important institutions or infrastructure — instead just asking for bitcoins. But the attack was concerning to security experts because it suggested that the hackers could have easily caused much more havoc. There was little immediate evidence for who conducted the attack. One of the most obvious culprits for an attack of this scale, North Korea, has been documented to have used Bitcoin extensively in the past. But its nature — “effective, but also amateurish” in the words of one senior American intelligence official — led U.S. intelligence agencies to an initial assessment that this was most likely the work of an individual hacker, not a state.

Had it been Russia, China, North Korea or Iran, said the official, who would not speak on the record because they were not authorized to discuss an intelligence investigation, the effort would have probably focused on trying to trigger stock market havoc or perhaps the issuance of political pronouncements in the name of Biden or other targets. Officials also noted that the breach did not affect the account of one of the most watched and powerful users of Twitter: President Donald Trump. Trump’s account is under a special kind of lock and key after past incidents, the official noted.

Security experts said that the wide-ranging attacks hinted that the problem was caused by a security flaw in Twitter’s service, not by lax security measures used by the people who were targeted. Alex Stamos, director of the Stanford Internet Observatory and the former chief security officer at Facebook, said there were a range of other theories, but all of them suggested that the attackers got inside Twitter’s system, he said, rather than stealing the passwords of individual users. One American official called that a “scary possibility” in a world where national leaders, sometimes imitating Trump’s techniques, have adopted Twitter as a primary source of unfiltered communications.

There were a range of other theories, he said, but all suggested that the attackers got inside Twitter’s system, rather than stealing the passwords of individual users. One American official called that a “scary possibility” in a world where national leaders, sometimes imitating Trump’s techniques, have adopted Twitter as a primary source of unfiltered communications.

“It could have been much worse. We got lucky that this is what they decided to do with their power,” Stamos said.

The hacker or hackers made some rookie errors. Stamos said that because the attackers had sent identical messages from the compromised accounts, they were easy to detect and delete. The decision to ask for money through Bitcoin, he added, showed that the attackers were most likely unable or unwilling to launder money or use their access for a more sophisticated scam.

The messages were a version of a long-running scam in which hackers pose as public figures on Twitter, and promise to match or even triple any funds that are sent to their Bitcoin wallets. But the attacks Wednesday were the first time that the real accounts of public figures were used in such a scam.

Bitcoin is a popular vehicle for this type of scam because once a victim sends money, the design of Bitcoin, with no institution in charge, makes it essentially impossible to recover the money.

By Wednesday evening, the Bitcoin wallets promoted in the tweets had received over 300 transactions and held bitcoins worth over $100,000, according to websites that track Bitcoin’s public ledger of transactions, which is known as the blockchain.

Twitter initially handled the attacks by taking down the offending tweets. A spokesman for the Biden campaign said that Twitter had removed the tweet promoting the scam and locked down Biden’s account.

But the hackers kept control of many of the accounts, such as those of Musk and West, and sent out new messages as soon as the old ones were taken down.

As Twitter locked down verified accounts in an attempt to stop the attack, the company also hampered its function as a real-time news service. Derrick Snyder, a meteorologist in Kentucky, said in a series of tweets that the National Weather Service could not issue warnings about a tornado in Illinois because its account, one that Twitter had verified, was shut down.

“What a mess,” Snyder wrote. “There is a tornado warning in effect.”

Twitter has fallen victim to breaches before. In August, hackers compromised Dorsey’s account, and posted racist messages and bomb threats. His account was taken over after hackers transferred his phone number to a new SIM card, which stores a phone’s number. The practice, known as SIM-swapping, allowed hackers to tweet from Dorsey’s account. In 2017, a rogue worker at the company used their access to Twitter’s systems to briefly delete Trump’s Twitter account. The account was restored within minutes, but the incident raised questions about Twitter’s security as it serves as a megaphone for politicians and celebrities.

And in 2010, Twitter settled a complaint brought by the Federal Trade Commission, in which the regulator claimed that the company did not do enough to protect users’ personal information. The FTC charged that “serious lapses” in Twitter’s security allowed hackers to take control of company systems and send out phony tweets from high-profile accounts, including Obama’s. As part of the settlement, Twitter agreed to undergo security audits for 10 years. On Wednesday evening, Sen. Josh Hawley, R-Mo., wrote a letter to Dorsey asking for information on the attack, including how many users were compromised.

Shares in the social media company fell 3% in after-hours trading.

Cybersecurity experts said the attack showed how vulnerable social media remains to attacks.

“This demonstrates a real risk for the elections,” Stamos said. “Twitter has become the most important platform when it comes to discussion among political elites, and it has real vulnerabilities.”