It also partially shut the social network down. Twitter said in a tweet that some users weren’t able to tweet while it was working on the incident. Users with the check mark to indicate their accounts were verified by the social media company reported they weren’t able to tweet.
Twitter spokeswoman Aly Pavela said earlier in the day that the company was investigating. The company said in a tweet it was “taking steps to fix” the security incident and would provide an update
The breach will create major optics challenges for Twitter, and it will make it more challenging moving forward to verify the authenticity of messages on the service, cybersecurity experts warned. That could have wide-reaching implications for politicians, celebrities and brands that rely on Twitter as an essential channel for communication.
“The problem is that we all rely on Twitter as this public space that is safe and secure, and we know that the tweets that someone like a Joe Biden is sending out are authentic,” Harper Reed, an entrepreneur who served as the 2012 Obama campaign chief technology officer. “Twitter has proven to us that may not be true.”
President Donald Trump in particular is an avid user of the platform, frequently tweeting to his more than 83 million followers his thoughts. Trump’s Twitter account was taken down for 11 minutes in 2017 by a departing employee for the company. After the incident, Twitter tweeted that it had “implemented safeguards to prevent this from happening again.” It declined to share more details at the time.
Cybersecurity experts warned that this type of breach, where influential accounts are taken over, could have devastating effects if used for something more dangerous than to scam money off unsuspecting users. The consequences could be greater if it involved an account like Trump’s or spread misinformation on some type of global security threat.
Disinformation expert Clint Watts compared it to a 2013 incident in which hackers seized control of the Associated Press Twitter account and falsely tweeted that the White House was under attack. That caused a brief plunge in the stock market that quickly corrected once the hoax was exposed.
If US adversaries gained similar control of politician’s accounts during election day, they could wreak havoc by spreading misinformation about polling locations or phony rumors about voter fraud, he said.
“Russia’s most dangerous play is how do you inflict the maximum amount of chaos on election day. They want to further erode confidence in Democracy and this is emblematic of a way they can do that,” he said.
Some of the people who were hacked specified they had turned on two-factor authentication and were using strong passwords, which typically makes any account more difficult to break into.
SocialProof Security’s Tobac said one likely scenario could be that hackers gained access to the back end of Twitter’s employee administration panel, which could include access to change other account passwords. This could have happened by a hacker stealing an employee’s credentials, especially if an employee didn’t have secure multi-factor authentication turned on.
Early in the afternoon Wednesday on the West Coast, Tesla chief executive Musk’s account was one of the first to tweet the scam to his nearly 37 million followers.
“Feeling grateful, doubling all payments sent to my BTC address! You send $1,000, I send back $2,000! Only doing this for the next 30 minutes,” the now-deleted tweet said.
His account continued to tweet similar posts as they were deleted.
“This is a SCAM, DO NOT participate!” Cameron Winklevoss, a bitcoin investor and co-founder of Gemini, wrote of Musk’s tweet.
Gemini’s account was hacked earlier in the day, Winklevoss tweeted, despite the account using two-factor authentication to secure it.
Gates’ was one of the next high-profile accounts to tweet. Gates spokesperson Bridgitt Arnold confirmed the tweet was not sent by Gates, and said Twitter was working to restore his account.
Meanwhile, Uber’s corporate account posted a tweet that read, “Due to Covid-19, we are giving back over $10,000,000 in Bitcoin! All payments sent to our address below will be sent back doubled.”
Uber confirmed in a tweet that its account had been hacked.
“Like many others, our @Uber account was hit by a scammer today. The tweet has been deleted and we’re working directly with @Twitter to figure out what happened,” the company’s communication team tweeted.
Then came a tweet from Amazon chief executive and Washington Post owner Bezos’ account. “I have decided to give back to my community.” The tweet said it would be limited to $50 million.
Democratic presidential candidate Biden was also a target of the hack, his campaign confirmed. His account tweeted out the same bitcoin wallet address.
Representatives for Musk, Bezos and Apple did not immediately respond to requests for comment.
The bitcoin wallet the tweets pointed to appeared to receive more than $US115,000. It’s unclear how much of that was driven by the hacked tweets and what may have originated from the scammers.
It’s also unclear how much information the hackers were able to cull from the accounts they compromised. If they were able to access the accounts’ direct messages they might have stolen information they could leak later to embarrass the victims or to sow chaos during the 2020 election or another major event, said Theresa Payton, CEO of the cybersecurity company Fortalice Solutions and a former White House technology official.
This is a serious reminder of how important Internet security is, especially leading up the election, she said. “Today should be a tsunami bell warning for all social media companies,” she said.
The breach is sure to increase scrutiny of Twitter’s data security practices in Washington, especially as lawmakers are concerned about attacks on social media in the lead up to Election Day.
Sentor Josh Hawley swiftly wrote a letter to Twitter’s Dorsey on Wednesday evening, US time, calling on the company to take immediate measures to secure the service and to reach out to the Federal Bureau of Investigation and Department of Justice.
“As you know, millions of your users rely on your service not just to tweet publicly but also to communicate privately through your direct message service,” Hawley wrote. “A successful attack on your system’s servers represents a threat to all of your users’ privacy and data security.”
The Washington Post