Skip to main content

The Great Twitter Hack has exposed the precarity of our online existence


Sometimes, a security breach is so startling in its reach and audacity that it becomes a stark reminder of the precarious nature of our collective dependence on computer systems. The particular nature of the attack also serves as a commentary on the times.
The Sony hack of 2014, later blamed on North Korea, exposed deeply embarrassing — and costly — personal and business secrets. The Snowden leaks of 2013 were an unprecedented dump of national security information. The attack on the Democratic National Committee in 2016 led to the leak of emails that might have influenced the outcome of an election.
It’s time for a farcical new addition to this list: the Great Twitter Hack of 2020. If the earlier cases demonstrated the sinister repercussions of computer insecurity, this was apparently a comedy without severe consequence. Attackers briefly took over the Twitter accounts of famous business people, celebrities, politicians and companies to try to trick people into sending them bitcoin.
The proceeds from this scam came to little more than $100,000 — a paltry pay-off given the startling success of the undertaking, and certainly much less than the value of the “earned media” that might normally be associated with tweeting from such influential accounts. The attackers had control for only a brief period — but that was still significant for a system whose value lies in holding mass attention in real time.
Inevitably, the apparently half-baked cryptocurrency element to the attack has led to suspicions that more was going on than meets the eye. While the accounts of Barack Obama, Joe Biden and Michael Bloomberg were taken over, for instance, no senior Republican figures were compromised — so was this really a disguised political assault of some kind? Maybe the miscreants used their access to pry into the direct messages of famous people, and will use these to attempt blackmail — or even to carry out the kind of political leaks that followed the DNC hack?
Until Twitter gets to the bottom of the incident, there’s no way to be sure. But given how much public discourse now takes place in the hall of mirrors that is social media — and the outsized influence now conferred by Twitter celebrity — it has already become an emblematic hack for our times. In the process, it has underlined two things.
The first is that there are some system-wide vulnerabilities that may be impossible to plug. According to Twitter, the attackers tricked some of the company’s employees in order to get internal access to its systems.
To the non-expert, it might seem inexcusable that individuals inside a company should have such control. But security expert Bruce Schneier points out that there is always a human somewhere with a hand on the lever: “Systems need trusted people to operate. Someone had to have control of everything.”
Those humans, in turn, are social creatures who are not above being fooled. The greater the prize, the more effort an attacker will put into the deceit.
The second point highlighted by this week’s debacle is the world’s growing dependence on information networks that are, by their very nature, built on unverified information. As the US enters the final months of a deeply divisive presidential election campaign, it might be tempting to think that the guardians of the most influential information systems have learnt the lessons from the campaign of 2016. Also, the people who rely on those systems — both to communicate and inform themselves — might be expected to be more on guard.
But the scale of the networks, and the world’s dependence on them, has only grown in the past four years. Many official agencies now use Twitter as the default mechanism for pushing out important information. The president of the US has frequently used it as a way to announce new policy — often, before his own advisers know about it. The media’s recourse to treating tweets as the definitive soundbites of our age has turned them into a fetish.
In this environment, what havoc might a more canny and manipulative attacker cause by secretly taking over the accounts of the powerful? What extra doubts might that seed in the public mind about the trustworthiness of political leaders? And how long will it be before the tweeter-in-chief at the White House, after a particularly controversial tweet, claims his Twitter account has been hacked?

Originally published at https://www.ft.com on July 17, 2020.

Comments

Post a Comment

Popular posts from this blog

Ransomware's Dangerous New Trick Is Double-Encrypting Your Data

  Ransomware groups have always taken a more-is-more approach . If a victim pays a ransom and then goes back to business as usual-hit them again. Or don’t just encrypt a target’s systems; steal their data first, so you can threaten to leak it if they don’t pay up. The latest escalation? Ransomware hackers who encrypt a victim’s data twice at the same time. Double-encryption attacks have happened before, usually stemming from two separate ransomware gangs compromising the same victim at the same time. But antivirus company Emsisoft says it is aware of dozens of incidents in which the same actor or group intentionally layers two types of ransomware on top of each other. “The groups are constantly trying to work out which strategies are best , which net them the most money for the least amount of effort,” says Emsisoft threat analyst Brett Callow. “So in this approach you have a single actor deploying two types of ransomware. The victim decrypts their data and discovers it’s not act...
Post a Comment
Read more

Babuk ransomware is back, uses new version on corporate networks

  After announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have slipped back into their old habit of encrypting corporate networks. The criminals are currently using a new version of their file-encrypting malware and have moved the operation to a new leak site that lists a handful of victims. Gang’s still in the game The Babuk ransomware group became known at the beginning of the year but the gang says that their attacks had started in mid-October 2020, targeting companies across the world and demanding ransoms typically between $60,000 and $85,000 in bitcoin cryptocurrency. In some cases, victims were asked hundreds of thousands for data decryption. One of their most publicized victims is the Washinton DC’s Metropolitan Police Department (MPD). This attack likely pushed the threat actor into announcing its retirement from the ransomware business only to adopt another extortion model that did not include encryption....
Post a Comment
Read more

Microsoft Teams Phishing Attack Targets Office 365 Users

  Up to 50,000 Office 365 users are being targeted by a phishing campaign that purports to notify them of a “missed chat” from Microsoft Teams. Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials. Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote workforces during the pandemic  — making it an attractive brand for attackers to impersonate. This particular campaign was sent to between 15,000 to 50,000 Office 365 users, according to researchers with Abnormal Security on Thursday. “Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification,” said researchers in a Thursday analysis . The initial phishing email displays the name ...
Post a Comment
Read more