The accounts of multiple high-profile individuals were hacked after hackers targeted Twitter employees with a Bitcoin phishing scam earlier last week to gain access to their accounts. “The attackers successfully compromised a small number of employees and used their credentials to access Twitter’s internal systems, including through two-factor protection mechanisms.” The incident has been called the biggest security breach in the company's history. Twitter released a full blog revealing the hacked account information, including US Democratic presidential candidate Joe Biden, former President Barack Obama, Tesla CEO Elon Musk, Microsoft co-founder Bill Gates, Kanye West, Michael Bloomberg, etc. Screenshot from Obama's previous post: All bitcoins sent to my account will be returned double. Send $1,000 and I will return $2,000. According to Twitter's official description, hackers can directly see and download the data archives of these accounts, such as phone numbers, emails, and private direct messages (DM). Moreover, hackers may even be able to obtain the DMs that these eight accounts tried to delete, because Twitter will store DMs on its servers as long as any party in the conversation stores them on its servers. These messages can contain other personal information such as addresses, images, videos, etc. However, the good news is that Twitter claims that none of the eight accounts are verified accounts, which means that the individuals represented by the eight accounts do not reveal personal information on the accounts. Twitter also said that the hackers initially targeted 130 accounts and successfully triggered password resets from 45 of them and logged in to post tweets. In the end, the hackers only tried to download data from up to 8 unverified accounts. "It is impossible to know how many accounts the hackers scanned for personal information, or whether they may have accessed or read only these private messages." Currently, Twitter has given a solution of locking the access rights of all verified accounts (130). In the future, after restoring these locked accounts, it plans to continue investigations with law enforcement agencies, strengthen security mechanisms, and conduct internal security training for employees. After the incident, some media said that the Twitter attack would sound the alarm for the US presidential election in November. Four years after the American people learned that elections could be easily manipulated through media, the country still does not have relatively complete protection measures. Twitter should be clearly aware that it is likely to become a target of attack again in the future and be prepared for various emergencies. According to the New York Times, the attack was initially a prank by three young hackers. The attack began with a user named "Kirk" who boasted to two teenagers that he could access the accounts of celebrities. The other two teenagers, "lol" and "ever so sear", admitted to participating in the hacking attack. The identity of "Kirk" is still unknown. It is understood that the 21-year-old British famous hacker Joseph O'Connor was accused of being Kirk's true identity, but there is no conclusive evidence. (Leifeng.com) |