One week ago, Twitter (NYSE: TWTR) suffered from a massive site-wide hack that compromised dozens of major verified accounts. The hack was part of a cryptocurrency scam that saw hundreds of thousands of dollars worth of Bitcoin transactions being made to the hackers. In the days after the hack, new developments are causing experts to question Twitter's ability to protect users.
Foremost of the developments that have arisen over the last week is Twitter's revelation of how the hackers managed to obtain admin tools: social engineering. The "art" of social engineering involves the manipulation of victims to divulge information, usually passwords or other means of accessing a computer, server, or network. At Twitter, social engineering was used to gain access to internal communications, specifically a Slack (NYSE: WORK) chat used by Twitter employees. While it is unknown how hackers got into Twitter's slack chat, an employee may likely have fallen victim to a phishing attack and divulged a password.
The attack showed evidence of meticulous planning, specifically that hackers had studied the company's corporate structure and appeared to have known who to target for information and how to go about obtaining the tools required for the hack.
In the days after the hacking campaign, it was also revealed that multiple cryptocurrency exchanges had caught onto the scam rather quickly and were able to prevent many users from turning over Bitcoin to the hackers. According to Coinbase, one of the crypto exchanges, a comparatively small number of users actually tried to send Bitcoin through the scam links posted to Twitter. Of its 35 million users, only 1,100 users tried to send Bitcoin to the scammers through Coinbase. Of those users, only 14 successfully sent Bitcoin, Coinbase having stopped the transactions of the other users. Other exchanges such as Gemini and Kraken were also able to prevent many users from sending Bitcoin through their service. Despite the efforts of crypto exchanges, it is believed that the scammers stole around $120,000 worth of Bitcoin.
In hindsight, many are finding that the hack could have been much worse and that Twitter could potentially be used as a platform for far more devious hacking campaigns in the future if measures aren't taken. Twitter is home to 330 million accounts, a significant fraction of which belong to major corporations, world leaders, politicians, journalists, corporate executives, and government offices. In last week's attack, the accounts of several politicians, such as Joe Biden and Barack Obama, as well as those belonging to major names in the business world such as Elon Musk, Bill Gates, and Jeff Bezos, were hacked, giving scammers access to their accounts and the ability to post as them.
Such methods are extremely dangerous considering the rapid dissemination of information in the modern digital world; a well-placed provocative tweet from the hacked account of a president, prime minister, CEO, or corporation could have far-reaching consequences well before Twitter can rectify the situation. The dangers of unchecked tweets has already been tested by U.S. President Donald Trump, whose propensity to use Twitter at all times of the day to make questionable statements has caused numerous scandals.
Policing such a massive social network is difficult, even with artificial intelligence and crowd-sourced reporting methods. To make matters worse, policing a social network and preventing its abuse has no precedence, meaning that any attempts to address security concerns stemming from the hack will have to rely on experimental, unproven methods.
The threat is, at least, acknowledged by both Twitter and many cybersecurity experts. The danger is also recognized by the U.S. government, as the FBI has since launched an investigation into the hacks. In the U.K., the National Cyber Security Centre also reached out to Twitter regarding the incident.
An FBI investigation, however, should hopefully serve as a catalyst to provoke a more extensive response by the federal government. Addressing the dangers posed by a massive social media hacking campaign will require more than the corporate world; governments will need to take comprehensive action, from developing contingencies to deal with potential misinformation to assisting social media companies in their immediate response.