Twitter says hack targeted employees using 'spear phishing'

Twitter says hack targeted employees using 'spear phishing'

Twitter said bitcoin scammers who accessed dozens of high-profile accounts used
Twitter said bitcoin scammers who accessed dozens of high-profile accounts used "spear phishing" to trick a handful of employees into giving up their credentials to access the system

SAN FRANCISCO - The hackers who accessed dozens of high-profile Twitter accounts in mid-July gained access to the system with an attack that tricked a handful of employees into giving up their credentials, according to a company update.

Twitter said in a security update late Thursday that the July 15 incident by bitcoin scammers stemmed from a "spear phishing" attack which deceived employees about the origin of the messages.

The hackers "targeted a small number of employees through a phone spear phishing attack," according to a Twitter Support statement.

"This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems."

Twitter said that following the incident it has "significantly limited access to our internal tools and systems" and is taking additional steps to tighten security.

The massive hack of high-profile users from Elon Musk to Joe Biden affected at least 130 accounts as part of an effort to dupe people into sending hackers the virtual currency bitcoin.

The official accounts of Apple, Uber, Kanye West, Bill Gates, Barack Obama and others were also affected.

Faked tweets were sent from 45 accounts, according to Twitter, and the hackers accessed private messages of 36 and downloaded Twitter data from seven.

Law enforcement is also investigating the incident which has raised concerns about the security of the platform increasingly used for conversations on politics and public affairs.

John Dickson of the security firm Denim Group said the latest disclosure does not necessarily suggest a sophisticated attack from a nation-state.

"They conned people over the phone," Dickson said, saying it may have been possible to find targets through research on LinkedIn or Google.

"This is like the original hackers from the 1980s and 1990s; they were very good at conning people and getting them to give their credentials."

Dickson said the origin of the hack is still not clear but added that "I would not assume" it came from a state-backed operation.

Do you like the content of this article?
COMMENT (1)

Govt to consider fresh stimulus measures to revive economy

The government is considering offering tax incentives to its middle and upper income groups to bolster consumption as part of new measures to revive an economy reeling under the impact of the coronavirus pandemic.

16:58

Thai workers leave for jobs in Israel

About 200 Thais left to work on farms in Israel on Wednesday on a flight arranged by the Labour Ministry, which declared the Covid-19 situation is "easing".

16:48

Beaches won’t reopen fully until vaccines become available

Thailand is set to welcome the first batch of foreign tourists in six months, but the government is unlikely to fully throw open beaches and national parks to overseas visitors until a vaccine against the coronavirus is widely available.

16:12