Twitter confirms hacker had access to its “admin tools” to push cryptocurrency scam

Some hours ago, Twitter world was set ablaze by a spate of attacks that took over prominent Twitter accounts including the likes of Bill Gates , Elon Musk, Jeff Bezos, Kanye West, President Barack Obama, Joe Biden, Michael Bloomberg, Wiz Khalifa, Warren Buffett and Apple.

Twitter has now confirmed via a series of tweets that a hacker had access to its internal systems and tools to conduct the hack.

“We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

— Twitter Support (@TwitterSupport) July 16, 2020

“We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf”

We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf. We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it.

— Twitter Support (@TwitterSupport) July 16, 2020

There are interesting theories about how the Twitter hack happened and how access was gained.

A report by Motherboard claims the hackers convinced a Twitter employee to help them hijack accounts.

“We used a rep that literally done all the work for us,” one of the sources told Motherboard. The second source added they paid the Twitter insider. Motherboard granted the sources anonymity to speak candidly about a security incident.

According to screenshots seen by Motherboard, at least some of the accounts appear to have been compromised by changing the email address associated with them using the tool.

In all, four sources close to or inside the underground hacking community provided Motherboard with screenshots of the user tool. Two sources said the Twitter panel was also used to change ownership of some so-called OG accounts—accounts that have a handle consisting of only one or two characters—as well as facilitating the tweeting of the cryptocurrency scams from the high profile accounts.

Another theory from Techcrunch states that the hacker goes by the name “Kirk”

A person involved in the underground hacking scene told TechCrunch that a hacker, who goes by the handle “Kirk” — likely not their real name — generated over $100,000 in the matter of hours by gaining access to an internal Twitter tool, which they used to take control of popular Twitter accounts. The hacker used the tool to reset the associated email addresses of affected accounts to make it more difficult for the owner to regain control. The hacker then pushed a cryptocurrency scam that claimed whatever funds a victim sent “will be sent back doubled.”

The person told TechCrunch that Kirk had started out by selling access to vanity Twitter accounts, such as usernames that are short, simple and recognizable. It’s big business, if not still illegal. A stolen username or social media handle can go for anywhere between a few hundred dollars or thousands.

Kirk is said to have contacted a “trusted” member on OGUsers, a forum popular with traders of hacked social media handles. Kirk needed the trusted member to help sell stolen vanity usernames.

Kirk allegedly had access to an internal tool on Twitter’s network, which allowed them to effectively take control of a user’s account. A screenshot shared with TechCrunch shows the apparent admin tool. (Twitter is removing tweets and suspending users that share screenshots of the tool.)

The tool appears to allow users — ostensibly Twitter employees — to control access to a user’s account, including changing the email associated with the account and even suspending the user altogether. (We’ve redacted details from the screenshot, as it appears to represent a real user.)

The person did not say exactly how Kirk got access to Twitter’s internal tools, but hypothesized that a Twitter employee’s corporate account was hijacked. With a hijacked employee account, Kirk could make their way into the company’s internal network. The person also said it was unlikely that a Twitter employee was involved with the account takeovers.

Twitter has locked accounts that were compromised and says it will restore access to the original account owners and they have taken steps to internal systems and tools.

Internally, we’ve taken significant steps to limit access to internal systems and tools while our investigation is ongoing. More updates to come as our investigation continues.

— Twitter Support (@TwitterSupport) July 16, 2020

Twitter has given the assurance that it is working assiduously to get all this under control.

What does this mean for Twitter and its customers?

• Unless Twitter gets this under control, this reduces the importance attached to the verification of accounts
• Can Twitter truly guarantee the safety of its numerous customer accounts?
• What gives me the confidence that this kind of Twitter hack will not happen again?

Twitter will need to do a lot to regain the confidence of its customers and users.