BackTwitter hack may have involved insider: probe
The hackers targeted Twitter employees to gain access to its internal tools, which is unlike usual cyberattacks that tend to exploit vulnerabilities in a platform’s code
PremiumNEW DELHI : The Twitter hack that happened last week could have been caused either by human error or intervention, instead of security loopholes in the company’s systems, according to multiple investigations, including a probe by the social media giant.
The hackers targeted Twitter employees to gain access to its internal tools, which is unlike usual cyberattacks that tend to exploit vulnerabilities in a platform’s code.
On 15 July, multiple Twitter accounts of high-profile users were hacked. The attackers pushed a scam through these accounts, asking users to transfer money to certain Bitcoin accounts, saying that these celebrities would have the amount doubled. They accessed 130 Twitter accounts, including those of SpaceX founder Elon Musk, Microsoft co-founder Bill Gates, and Berkshire Hathaway chairman and chief executive Warren Buffet.
An investigation by technology website Motherboard found that a Twitter insider may have been involved. The person had access to internal tools meant only for Twitter’s employees and misused them to make posts from high-profile accounts. However, other investigations have not been able to confirm whether an insider was involved, though it appears that insider accounts were definitely used.
According to Indian security researcher, Karan Saini, these are likely the same tools Twitter uses for support requests. Most leading platforms have similar tools built in on their back-end, which allow them to do a variety of things, including responding to government data requests and support requests from users, Saini explained.
Such tools allow the platform to fix any issues with an user account, look at their IP addresses where the account was created and much more. By Twitter’s own admission, the hackers had access to personal data for many of these accounts, could initiate password reset requests on 45 of them, and in eight of the cases, they even used the “Your Twitter data" tool to download user data. This is a tool that platforms such as Twitter and Facebook offer so that a user can see what the platform has on the person, and download it if needed.
Milestone Alert!Livemint tops charts as the fastest growing news website in the world 🌏 Click here to know more.
