This article is from the source 'nytimes' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at https://www.nytimes.com/2020/07/15/technology/twitter-hack-bill-gates-elon-musk.html

The article has changed 11 times. There is an RSS feed of changes available.

Version 3 Version 4
Twitter Accounts for Biden, Gates, Musk and Others Are Hacked Twitter Accounts for Biden, Gates, Musk and Others Are Hacked
(32 minutes later)
SAN FRANCISCO — One by one, the Twitter accounts of some of the most prominent people in American business and politics started displaying the same message on Wednesday afternoon: Send Bitcoin to the link below and you will double your money. The names included Joseph R. Biden Jr. and Barack Obama, Kanye West and Bill Gates, and countless more. It was about 4 in the afternoon on Wednesday on the East Coast when chaos struck online. Dozens of the biggest names in America — including Joseph R. Biden Jr., Barack Obama, Kanye West, Bill Gates and Elon Musk — posted similar messages on Twitter: Send Bitcoin and the famous people would send back double your money.
But it was all a scam, the result of one of the most brazen online attacks in memory. It was all a scam, of course, the result of one of the most brazen online attacks in memory.
A first wave of attacks went after cryptocurrency-related companies and personalities at midday on the East Coast, but over the course of a few hours the prominence of the victims increased. Many of the tweets were quickly removed, but in some cases similar tweets were sent again from the same accounts. A first wave of attacks hit the Twitter accounts of prominent cryptocurrency leaders and companies. But soon after, the list of victims broadened to include a Who’s Who of Americans in politics, entertainment and tech, in a major show of force by the hackers.
Twitter appeared to be essentially powerless to stop them. The company eventually disabled broad swathes of its service as it worked to stop the attack. “You may be unable to Tweet or reset your password while we review and address this incident,” the company said in a statement. Twitter quickly removed many of the messages, but in some cases similar tweets were sent again from the same accounts, suggesting that Twitter was powerless to take back control of the accounts.
The attack was a major show of force by attackers who seized a key means of communication for a Who’s Who list of Americans. The hackers did not use their access to take aim at any important institutions or infrastructure like the stock market — instead deciding to just ask for Bitcoin. The company eventually disabled broad swaths of its service, including the ability of verified users to tweet, as it scrambled to prevent the scam from spreading further. The company sent a tweet saying that it was investigating the problem and looking for a fix. “You may be unable to Tweet or reset your password while we review and address this incident,” the company said in a second tweet.
But the attack was frightening because the hackers could have easily caused much more havoc. There was quickly speculation on what would have happened had the attackers instead tried to move the financial markets or sow political chaos. The attack exposed the vulnerability of a company, Twitter, that has become the nation’s de facto real-time news source. The hackers did not use their access to take aim at any important institutions or infrastructure — instead just asking for Bitcoin. But the attack was concerning to security experts because it suggested that the hackers could have easily caused much more havoc.
The messages were a version of a long-running scam in which hackers pose as public figures on Twitter, and promise to match or even triple any funds that are sent to their Bitcoin wallets. In the past, hackers have created fake accounts to try to convince users that the funds will be going to public figures like Mr. Musk or Mr. Gates. The attacks Wednesday were the first time that the real accounts of public figures were used in the scam. It was the nature of the attack — “effective, but also amateurish” in the words of one senior American intelligence official — that led American intelligence agencies to an initial assessment that this was most likely the work of an individual hacker, not a state. Had it been Russia, China, North Korea or Iran, said the official, who would not speak on the record because they were not authorized to discuss an intelligence investigation, the effort would have probably focused on trying to trigger stock market havoc, or perhaps the issuance of political pronouncements in the name of Mr. Biden or other targets.
Accounts belonging to Mr. Musk, the Tesla chief executive, and Mr. Gates, the Microsoft mogul, were among the first prominent Twitter accounts to be compromised. Within the hour, Mr. West’s account was hit along with many more. The accounts have huge followings. Over 51 million accounts follow Mr. Gates, while Mr. Musk’s Twitter account is followed by 36.9 million. Officials also noted that the breach did not affect the account of one of the most watched and powerful users of Twitter: President Trump. Mr. Trump’s account is under a special kind of lock-and-key after past incidents, the official noted.
Mr. Musk has frequently been a target of scammers seeking to steal Bitcoin. In the past, scammers have created accounts that imitated Mr. Musk and replied to his tweets, trying to trick users into sending them money. Security experts said that the wide-ranging attacks hinted that the problem was caused by a security flaw in Twitter’s service, not by lax security measures used by the people who were targeted. Alex Stamos, director of the Stanford Internet Observatory and the former chief security officer at Facebook, said one of the leading theories among researchers was that the hacker, or hackers, had obtained the encryption keys to the system, which enabled them to essentially imitate or steal the “tokens” that grant access to individual accounts.
A spokesman for the Biden campaign confirmed that Twitter had removed the tweet promoting the scam and locked down Mr. Biden’s account. But the message was repeatedly posted and deleted on Mr. Musk’s and Mr. West’s accounts. There were a range of other theories, he said, but all suggested that the attackers got inside Twitter’s system, rather than stealing the passwords of individual users. One American official called that a “scary possibility” in a world where national leaders, sometimes imitating Mr. Trump’s techniques, have adopted Twitter as a primary source of unfiltered communications.
“It could have been much worse. We got lucky that this is what they decided to do with their power,” Mr. Stamos said.
The hacker or hackers made some rookie errors. Mr. Stamos said that because the attackers had sent identical messages from the compromised accounts they were easy to detect and delete. The decision to ask for money through bitcoin, he added, showed that the attackers were most likely unable or unwilling to launder money or use their access for a more sophisticated scam.
The messages were a version of a long-running scam in which hackers pose as public figures on Twitter, and promise to match or even triple any funds that are sent to their Bitcoin wallets. But the attacks Wednesday were the first time that the real accounts of public figures were used in such a scam.
Bitcoin is a popular vehicle for this type of scam because once a victim sends money, the design of Bitcoin, with no institution in charge, makes it essentially impossible to recover the money.
By Wednesday evening, the Bitcoin wallets promoted in the tweets had received over 300 transactions and held Bitcoin worth over $100,000, according to websites that track Bitcoin’s public ledger of transactions, which is known as the blockchain.
Twitter initially handled the attacks by taking down the offending tweets. A spokesman for the Biden campaign said that Twitter had removed the tweet promoting the scam and locked down Mr. Biden’s account.
But the hackers kept control of many of the accounts, such as those of Mr. Musk and Mr. West, and sent out new messages as soon as the old ones were taken down.
Twitter has fallen victim to breaches before. Last August, hackers compromised the account of Twitter’s chief executive, Jack Dorsey, and posted racist messages and bomb threats. Mr. Dorsey’s account was taken over after hackers transferred his phone number to a new SIM card, which stores a phone’s number. The practice, known as SIM-swapping, allowed hackers to tweet from Mr. Dorsey’s account.Twitter has fallen victim to breaches before. Last August, hackers compromised the account of Twitter’s chief executive, Jack Dorsey, and posted racist messages and bomb threats. Mr. Dorsey’s account was taken over after hackers transferred his phone number to a new SIM card, which stores a phone’s number. The practice, known as SIM-swapping, allowed hackers to tweet from Mr. Dorsey’s account.
This is a developing story. Check back for updates. In 2017, a rogue worker at the company used their access to Twitter’s systems to briefly delete President Trump’s Twitter account. The account was restored within minutes, but the incident raised questions about Twitter’s security as it serves as a megaphone for politicians and celebrities.
And in 2010, Twitter settled a complaint brought by the Federal Trade Commission, in which the regulator claimed that the company did not do enough to protect users’ personal information. The F.T.C. charged that “serious lapses” in Twitter’s security allowed hackers to take control of company systems and send out phony tweets from high-profile accounts, including Mr. Obama’s. As part of the settlement, Twitter agreed to undergo security audits for 10 years.
On Wednesday evening, Senator Josh Hawley, a Republican from Missouri, wrote a letter to Mr. Dorsey asking for information on the attack, including how many users were compromised.
Shares in the social media company fell 3 percent in after-hours trading.
Cybersecurity experts said the attack showed how vulnerable social media remains to attacks.
“This demonstrates a real risk for the elections,” Mr. Stamos said. “Twitter has become the most important platform when it comes to discussion among political elites, and it has real vulnerabilities.”