Name: Twitter’s massive attack: What we know after Apple, Biden, Obama, Musk, and others tweeted a bitcoin scam
Brand: theverge.com
SKU: theverge-com-203
Availability: OnlineOnly

critic

Twitter’s massive attack: What we know after Apple, Biden, Obama, Musk, and others tweeted a bitcoin scam

preview

The Verge logo. The Twitter accounts of major companies and individuals were compromised on Wednesday in one of the most widespread and confounding breaches the platform has ever seen, all in service of promoting a bitcoin scam that earned its creators nearly $120,000. , including one from the Federal Bureau of Investigation, are now actively probing the situation over far a deeper concern: that the exploited vulnerability in Twitter’s systems — a result it seems of mid-level employees having powerful access to site-wide admin tools that can fall into the wrong hands — has exposed serious security risks for the platform’s most powerful users. Lawmakers are , and it seems likely the attack will have longstanding consequences not just for Twitter’s own internal tools and security, but for the broaden cybersecurity industry and every high-profile Twitter user on the platform, too. We still don’t know how exactly the hack happened or even to what extent Twitter’s own systems were compromised. But following the unprecedented hacks of accounts including President Barack Obama, Joe Biden, Elon Musk, Bill Gates, Kanye West, Michael Bloomberg, and Apple, Twitter took the drastic step of blocking new tweets from every verified user, compromised or no, as well as locking all compromised accounts. The Twitter attack has exposed serious security risks for the platform’s most powerful usersOne notable exception in the attack was the account of President Donald Trump. that Trumps’s account has special protections in place following past incidents — including when a third-party Twitter contractor used internal company tools to . Those protections may have spared Trump’s account from being taken over, although it is not clear right now whether the hackers even attempted to assume control of his account. Regardless, the national and international security implications of the Twitter attack are now becoming frighteningly clear, as hackers could have caused far more serious damage with access to such high-profile accounts. Twitter says it won’t restore access to their owners “until we are certain we can do so securely.” As of Thursday, the company is still working to restore access to locked accounts, although it has confirmed that in control of the affected accounts, seemingly all of which were verified accounts belonging to high-profile companies and individuals. Twitter says that , with the attackers managing to take control of a “small subset” of those. Even some accounts not affected by the attack remain locked, as Twitter continues its investigation. Twitter has not yet disclosed whether private and sensitive direct message threads were compromised as part of the account takeovers; the company it is “continuing to assess whether non-public data related to these accounts was compromised.”We have locked accounts that were compromised and will restore access to the original account owner only when we are certain we can do so securely.— Twitter Support (@TwitterSupport)On Wednesday evening, the company , which may explain why even accounts that claimed to have two-factor authentication were still attempting to fool followers with the bitcoin scam.The account takeovers have subsided, but new scam tweets were posting to verified accounts on a regular basis starting shortly after 4PM ET and lasting more than two hours. Twitter acknowledged the situation after more than an hour of silence, writing on its support account at 5:45PM ET, “We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly.”We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly.— Twitter Support (@TwitterSupport)The company took the unprecedented measure of preventing verified accounts from tweeting at all starting sometime around 6PM ET. This would seem to be the first time Twitter has ever done this in the company’s history. Twitter updated its stance on limiting tweets at 7:18PM ET, writing, “We’re continuing to limit the ability to Tweet, reset your password, and some other account functionalities while we look into this. Thanks for your patience.” At 8:41PM ET, Twitter said “most” verified accounts should be able to tweet, adding, “As we continue working on a fix, this functionality may come and go.”We’re continuing to limit the ability to Tweet, reset your password, and some other account functionalities while we look into this. Thanks for your patience.— Twitter Support (@TwitterSupport)Most accounts should be able to Tweet again. As we continue working on a fix, this functionality may come and go. We're working to get things back to normal as quickly as possible.— Twitter Support (@TwitterSupport)Late in the evening, Twitter CEO Jack Dorsey , “Tough day for us at Twitter. We all feel terrible this happened. We’re diagnosing and will share everything we can when we have a more complete understanding of exactly what happened.” Product chief Kayvon Beykpour also released a public statement on his personal account, , “Our investigation into the security incident is still ongoing but we’ll be posting updates from @TwitterSupport&nbsp;with more detail soon. In the meantime I just wanted to say that I’m really sorry for the disruption and frustration this incident has caused our customers.”Tough day for us at Twitter. We all feel terrible this happened.We’re diagnosing and will share everything we can when we have a more complete understanding of exactly what happened. 💙 to our teammates working hard to make this right.— jack (@jack)The chaos first began to snowball when Tesla CEO Elon Musk’s Twitter account was seemingly compromised by a hacker intent on using it to run a bitcoin scam. Microsoft co-founder Bill Gates’ account was also seemingly accessed by the same scammer, who posted a similar message with an identical bitcoin wallet address. Both accounts continued to post new tweets promoting the scam almost as fast as they were deleted, and Musk’s account in particular was still be under the control of the hacker as late as 5:56PM ET. A spokesperson for Gates tells Recode’s Teddy Schleifer, “We can confirm that this tweet was not sent by Bill Gates. This appears to be part of a larger issue that Twitter is facing. Twitter is aware and working to restore the account.”NEW — statement from a spokesperson for Bill Gates."We can confirm that this tweet was not sent by Bill Gates. This appears to be part of a larger issue that Twitter is facing. Twitter is aware and working to restore the account.” — Teddy Schleifer (@teddyschleifer)Shortly after the initial wave of tweets from Gates and Musk’s accounts, the accounts of Apple, Uber, former President Barack Obama, Amazon CEO Jeff Bezos, Democratic presidential candidate Joe Biden, hip-hop mogul Kanye West, and former New York City mayor and billionaire Mike Bloomberg, among others, were also compromised and began promoting the scam. It’s unclear how widespread the operation was, but it appears to have affected numerous major companies and extremely high-profile individuals. That suggests someone, or a group, found a severe security loophole in Twitter’s login or account recovery process or those of third-party app — or that the perpetrator has somehow gained access to a Twitter employee’s admin privileges. , numerous underground hacking circles have been sharing screenshots of an internal Twitter administration tool allegedly used to take over the high-profile verified accounts. Twitter is now removing images of the screenshot from its platform and in some cases suspending users who continue to share it. So far, Twitter has , but not which ones or more than a theory as to how hackers might have gotten access. “We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools,” read a tweet from the company’s support account recounting in broad terms how the attack happened, in what was Twitter’s first explanation of the incident released Wednesday evening. “We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf.”1/13The origin of the scam can be traced to the moment when Musk’s account issued a mysterious tweet at 4:17PM ET reading, “I‘m feeling generous because of Covid-19. I’ll double any BTC payment sent to my BTC address for the next hour. Good luck, and stay safe out there!” The tweet also contained a bitcoin address, presumably one associated with the hacker’s crypto wallet. The tweet was then deleted and replaced by another one more plainly laying out the fake promotion. “Feeling grateful doubling all payments sent to my BTC address! You send $1,000, I send back $2,000! Only doing this for the next 30 minutes,” it read before also getting deleted. The tweet posted to Gates’ account echoed the Musk tweets, with an identical BTC address attached. It was also deleted shortly after posting, only for a similar message to take its place a few minutes later. Hacked accounts were almost all posting the same bitcoin wallet addressSquare’s Cash App appears to be one of the other rare company accounts compromised. However, it’s not clear if the culprit is the same or if this is some form of a coordinated scam on behalf of a group, as the tweet contained a different BTC address than the ones posted to the other accounts. In addition to the Cash App, popular crypto Twitter accounts, including those of Cameron and Tyler Winklevoss’ Gemini cryptocurrency exchange and widely used wallet app Coinbase, were also compromised. Cameron Winklevoss claims the Gemini account was protected by two-factor authentication and used a strong password, and the company is now investigating how it was hit. ALL MAJOR CRYPTO TWITTER ACCOUNTS HAVE BEEN COMPROMISED.2FA / strong password was used for account. We are investigating and hope to have more information shortly. — Cameron Winklevoss (@winklevoss)Some people apparently fell for the scam and sent money to the associated BTC address, as due to the nature of the blockchain-based cryptocurrency. The scammer amassed nearly $120,000, although it seems as if the account owner is indeed sending money back out as the daily final balance has fluctuated up and down throughout the afternoon, although those accounts may simply be alternative addresses for the same group who perpetrated the attack. It's an actual wallet address and there are transactions happening. It's unclear if these transactions are legit. Scammers often seed their own scams to give them the appearance of authenticity. — Ryan Mac 🙃 (@RMac18)Musk has long been the target of bitcoin scammers on Twitter, many of whom create fake accounts designed to look like the entrepreneur and respond to his tweets promoting the scams so that they appear legitimate. Twitter even went so far as to that change their name to “Elon Musk,” and the company as a source of known manipulation and deception that it was aiming to root out through bans and other moderation strategies. Update July 15th, 7:33PM ET: Added new details regarding the Twitter hack and the company’s response. Update July 15th, 8:53PM ET: Added that Twitter restored verified accounts’ tweeting ability.Update July 15th, 11:56PM ET: Added Twitter’s first attempt to explain what happened, including the confirmation that Twitter’s own internal tools were compromised. Update July 16th, 7:41PM ET: Added additional details regarding investigations launched into the attack, Twitter’s ongoing investigations into how it happened, and the company’s attempts to restore access to locked accounts. Update July 16th, 11:24PM ET: Added further details on the extent of the attack.&nbsp;Most Popular DVictoria Song says the new Fitbit Inspire 3 feels like a product from 2015.Where is the lie?NThe Westworld subreddit is anxious the show will be canceled before the final season.Viewership was way down this season, and the recent changes — including — don’t seem to bode well for what’s been a very expensive show. That said, this season started strong and ended with a whimper, so maybe it’s all for the best.fromWorshippers of Elon Musk have flocked to the middle of nowhere in Texas to watch SpaceX’s attempts to build a space-worthy rocket — and to find friends JNintendo will announce a release date for the delayed Advance Wars reboot “once it has been determined,” the company told Axios.Advance Wars 1 + 2: Re-Boot Camp, a Nintendo Switch remaster of the first two Advance Wars titles, was delayed from an April launch . It was absent from .I asked Nintendo if Advance Wars 1 + 2 has been cancelled, given the lack of news about it since it was delayed due to the invasion of Ukraine.Nintendo rep's reply: "The release has been delayed. We will announce the new date once it has been determined."— Stephen Totilo (@stephentotilo)AAlex Jones is on trial yet again.The InfoWars host lost a defamation case over the Sandy Hook shooting by default, and now, a Connecticut jury will decide what he should pay. It’s a near-repeat of a similar case in Texas — but without that state’s limits on financial damages. Jones’ company has filed for bankruptcy, though, setting up a fight over the money.[The New York Times]Revolutionizing the media with blog postsMust ReadsMust ReadsEThe retail revolution comes for Congress: Rep. Angie Craig found out her son was trading behind her back.“As a mom, I would be grateful if my college student son was not allowed to own or trade stocks. And as a member of Congress, I’m working to pass a law to force him to listen to his mother,” she told The New York Times.[The New York Times]AApparently Motorola built a fully functional electric Chevy Corvette prototype in the 1990s.The Drive’s Kevin Williams has made what could be one of the greatest EV archeological discoveries of a generation: a 1987 Chevy Corvette EV built by cell-phone pioneer Motorola. This raises so many questions. First and foremost, why the hell was Motorola making cars? Electric cars for that matter? And can I drive it? There’s loads of pics and fun backstory, so I recommend you go check it out. [The Drive]EElon is Elonning again.Musk is wading into the fight between Twitter and security researcher Peiter “Mudge” Zatko again, after. Good luck to whoever at his law firm has been assigned to !Anyone know who the secret clients are? Let’s out them on Twitter rn haha. — Naughtius Maximus (@elonmusk)AThe Twitter whistleblower says he’ll work with Congress on “sorely needed” laws.Peiter “Mudge” Zatko’s attorneys say they hope he offered a window into Twitter’s business operations, including details about potential national security risks, during a Senate hearing today. Lawmakers focused on the threat of foreign agents inside Twitter and proposals to reform the FTC.An attorneys' statement:&nbsp;"Mr. Zatko is hopeful that the Committee’s work today has helped educate the public about just how dire the security and privacy situation is at Twitter ... He remains ready, willing and able to be part of the legislative reform that is sorely needed." — Adi Robertson (@thedextriarchy)RMark Zuckerberg has very good lawyers.As a way of dragging its heels in , Meta is trying to get as much court-ordered information as it possibly can on rivals like Snapchat and TikTok.The threat here is less that Meta will discover Snapchat’s secret sauce, and more that this (and a dozen other motions) will overwhelm the FTC’s ability to properly try the case with its existing resources.[Bloomberg.com]EWaze has more torture for your return to the office.The new “pokes fun at the people we can all become at work — acronym-slinging, jargon-parroting, catchphrase machines,” and features phrases like “Make a U-turn: Or what I call ‘circling back.’” Thanks, Waze, but I think I’ll stick with my Boy Band voice directions for now.Our driving experience for the month is designed to help you drive synergy.Let’s table this discussion and see if you can figure out what it is. — waze (@waze)ASpecialized teases its new e-bike brand Globe with a poem and a cheeky logo.Earlier this year, a new sub-brand called Globe dedicated to building high-quality electric utility bikes that are designed specifically to replace car trips. We still don’t know what these bikes will look like, but today the company released its brand statement in the form of a poem, which is cute. Specialized promises it will have more to say on September 27th, so mark you calendars. PodcastsPodcastsMA woman is suing San Francisco after the city used DNA from her rape kit to arrest her for an unrelated crime.The police’s practice of using DNA from sexual assault victims to identify suspects in other cases came to light . At the time, legal experts said the practice likely violated California’s constitution. It’s yet another example of the posed by growing DNA databases. [CBSNews]MUbisoft’s AAA games are getting more expensive.In an interview with Axios, CEO Yves Guillemot said that “the big AAA games will come at $70,” starting with Skull and Bones. , however, is listed for $50 .[Axios]Most PopularMost PopularJI’m convinced Tears of the Kingdom is going to feature time travel in a big way.The for the game is the second to seemingly show Link . The game’s logo is an ouroboros. And , Nintendo says that “Link’s endless adventure begins again” on the game’s release date, May 12th. If only I could time travel to then. EDoesn’t seem like Twitter shareholders see anything new in today’s congressional hearing.Twitter is down less than one percent as I write this, while the rest of the exchange it trades on — the NYSE — is down a little more than two percent.DThe Rick and Morty season 6 premiere is free on YouTube.Putting your show’s pilot or premiere on YouTube is , and I love it. The latest to go free is , everybody’s favorite buddy comedy about space travel and MeeSeeks. A lot about this episode might be confusing if you’ve never seen the show before... but a lot about Rick and Morty is confusing anyway. So enjoy!RTwitter whistleblower Pieter “Mudge” Zatko is testifying before Congress.Twitter’s abandoned plan for an OnlyFans competitor is not popular with Republicans. Two Republican Senators (Kennedy, Blackburn) have now inquired about Twitter's plans to monetize adult content – and failure to deal with child abuse material. &amp; covered the story here: — Corin Faife (@corintxt)AThe cheapest Amazon Kindle got a much-needed update to USB-C,but for me the more exciting news is this thing has 300ppi. That means the display should be nearly as crisp and easy to read as all the other Kindles, but for a lot less money.KNew Verge logo means new Verge merch.Refreshed t-shirts, and even stickers. Get them while you can.[DFTBA]DHP’s Dragonfly Chromebook is a computer without a market.Monica Chin published her today, a computer I’ve been excited about ever since it was announced at CES back in January.Sadly, while the hardware is incredible, the experience ChromeOS provides just doesn’t align with the stratospheric price tag HP is asking. It makes me wonder — who does it think is going to buy this thing? Photo by Amelia Holowaty Krales / The Verge

The Verge logo. The Twitter accounts of major companies and individuals were compromised on Wednesday in one of the most widespread and confounding breaches the platform has ever seen, all in service of promoting a bitcoin scam that earned its creators nearly $120,000. , including one from the Federal Bureau of Investigation, are now actively probing the situation over far a deeper concern: that the exploited vulnerability in Twitter’s systems — a result it seems of mid-level employees having powerful access to site-wide admin tools that can fall into the wrong hands — has exposed serious...

Twitter’s massive attack: What we know after Apple, Biden, Obama, Musk, and others tweeted a bitcoin scam

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS