Musk, Gates, Biden, Apple Among Accounts Taken Over

Breach scale implies Twitter admin takeover

Twitter’s protection has been compromised this night, with the breach utilised to get in excess of Elon Musk’s, Jeff Bezos’ and Monthly bill Gates’ and other’s well known Twitter accounts in a Bitcoin scam that has their followers directed to deposit Bitcoin in a selected wallet with the false guarantee that contributions will be doubled.

Twitter has confirmed a protection incident, saying “You might be not able to Tweet or reset your password when we evaluation and address this incident”.

We are informed of a protection incident impacting accounts on Twitter. We are investigating and getting methods to take care of it. We will update absolutely everyone shortly.

— Twitter Aid (@TwitterSupport) July fifteen, 2020

The incident, which for as soon as does basically deserve the adjective “unprecedented” has also viewed the accounts of Apple, Uber and Kanye West taken in excess of. Presidential candidate Joe Biden’s account is among these who have also Tweeted the scam. Numerous look to have been equipped to quickly take away the Tweets. The scenario is creating.

Yikes, strongest hypothesis is that the attackers have owned Twitter’s employee admin panel which permits Twitter personnel means to transform pw/disable MFA to make it possible for an attacker to get in excess of a well known account and tweet on their behalf with no working with their password or MFA.

— Rachel Tobac (@RachelTobac) July fifteen, 2020

Twitter Hacked: Admin Entry Appears Probably

The scale of the incident implies an attacker either received obtain to a Twitter employee’s administrative privileges or uncovered a sweeping vulnerability in the social platform’s login protocols. Specified that several of the accounts are probably, supplied their substantial profile, to have enabled two-factor authentication, it seems plausible that a person senior at Twitter has been compromised and their privileges abused.

Be aware the electronic mail addresses transform. Twitter has no rationale to give personnel native obtain to impersonate users.
Accounts are getting stolen, auth token produced, and tweeted from. Be aware how legitimate users continue to have tokens to delete tweets. Not a clear hit.https://t.co/grlhbkhVhR

— Swift⬡nSecurity (@SwiftOnSecurity) July fifteen, 2020

Security business RiskIQ claims it has recognized infrastructure tied to the cryptocurrency scammers. The unverified record is on Pastebin right here. 

RiskIQ researchers just doubled the variety of IoCs in the Pastebin. Be sure to keep on to monitor it for updates as this scenario evolves https://t.co/D99QOpfbFc #twitterhack #twitterhacks #ThreatIntel #IOCs https://t.co/HZkJmDjRmM

— RiskIQ (@RiskIQ) July fifteen, 2020