How Twitter CEO Jack Dorsey’s Account Was Hacked – TheNigerialawyer

* Like so many Twitter attacks lately, it was a SIM
swap.

Jack Dorsey’s ongoing mission to increase the civility of public
discourse suffered a setback Friday, when an anonymous hacker took
over his Twitter account for 20 minutes and retweeted
@taytaylov3r’s claim that “nazi germany did nothing wrong.”

Twitter, as you likely know if you’ve spent any time there, has
an ongoing, well-documented problem with Nazis, white supremacists,
and other extremists. It appears taytaylov3r’s account has since
been suspended.

The hijacking of the company CEO’s account appears to have
started at around 3:45 pm Eastern time, when the @jack account
fired off nearly two dozen tweets and retweets.

Several of the tweets were tagged #ChucklingSquad, the name of
an apparent group of hackers who have been on an account-takeover
spree this week.

Before Dorsey, they hit numerous influencers, including Zane
Hijazi of the popular Zane and Heath podcast, and Anthony Brown,
who goes by BigJigglyPanda. Chuckling Squad also appears to have
compromised and posted mocking messages to the account of YouTuber
Etika, who was found dead in June.

Which makes the @jack hack potentially just the latest, and most
high-profile, in a string of takeovers.

Twitter confirmed the incident in a tweet—in case anyone thought
Dorsey was intentionally making bomb threats from his account—and
said that the company was “investigating what happened.”

BRIAN BARRETT VIA TWITTER

Some of the influencers who got hit in the last two weeks have
blamed so-called SIM swap attacks, with a particular focus on
AT&T. In a SIM swap, a hacker either convinces or bribes a
carrier employee to switch the number associated with a SIM card to
another device, at which point they can intercept any two-factor
authentication codes sent by text message. (It’s hard to stop a
determined SIM swapper, but at the very least you should switch
from SMS two-factor to an authenticator app). AT&T did not
immediately respond to an inquiry from WIRED about the spate of
hacks this month, or whether the @jack incident was related.

Twitter confirmed that it was a SIM issue in a tweet Friday
evening.

The phone number associated with the account
was compromised due to a security oversight by the mobile provider.
This allowed an unauthorized person to compose and send tweets via
text message from the phone number. That issue is now resolved.

— Twitter Comms (@TwitterComms) August
31, 2019^[1]

One potential clue lay in the tweets themselves, which displayed
as having been sent from the Cloudhopper client. Cloudhopper was a
messaging infrastructure company that Twitter acquired in 2010 to
better integrate its service with SMS. That’s led to some
speculation that Dorsey was somehow still signed into Cloudhopper
for all these years, and the hackers got a hold of that account.
But that’s not quite right.

It turns out that the Twitter API marks any tweet that comes
from a text message as coming from the “Cloudhopper” client. This
also explains a mini-mystery from 2017, when Apple CEO Tim Cook
tweeted a lone smiley face and soon deleted it with no further
commentary. The tweet declared itself as having come from
Cloudhopper as well; in fact, Cook had errantly sent a text to his
Twitter account. That classification of SMS persists today, as
demonstrated below:

BRIAN BARRETT

It’s notoriously easy to manually change what client displays
with your tweets, which could have happened here. But it would
certainly be the simplest explanation, and the easiest way for an
interloper to fire off tweets from @jack. In the past, hacking
groups have taken advantage of password reuse to compromise
high-profile Twitter accounts. But by tweeting from the phone
number associated with Dorsey’s Twitter account, Chuckling Squad
wouldn’t have needed to know his password at all. As you can see in
Twitter’s published workflow for setting up SMS tweets, at no point
do you need to enter one. Texting from that phone number serves as
proof of your identity. You can also retweet the most recent tweet
from any given account from SMS—although all of the accounts the
hackers tweeted appear to have been suspended already, so it’s hard
to confirm that’s what happened.

What’s even less clear is how Dorsey recovered his account
intact, although hopefully Twitter will provide a full post mortem
at some point. If and when it does, it should also consider the
consequences of putting so much faith in a SIM card, whether that’s
what happened here or not. Otherwise, the Chuckling Squad is always
going to have the last laugh.

Culled from wired.com

Subscribe ToNairalaw News!