Last weekend, the Twitter account of Jack Dorsey, founder and CEO of Twitter, was hacked. After compromising the account, the attackers began posting offensive and racist content on Dorsey’s behalf, and even claimed that a bomb had been planted at the company’s headquarters (such threats can hardly be dismissed as pranks, and may lead to a federal investigation under US law).
Responsibility for the attack was claimed by the hacking group Chuckle Gang, which had previously hacked other public figures on social networks. Almost nothing is known about the makeup and goals of this group. Dorsey’s fake tweets remained online for about half an hour before being deleted.
Security professionals and users quickly found that CloudHopper was the source of the unauthorized messages. This company, specializing in SMS-to-Twitter technology, was acquired in 2010. CloudHopper allows users, among other things, to send tweets by SMS. A theory then emerged in the community that the attackers had captured Dorsey’s real phone number using a SIM swap attack and had interacted with his account via SMS.
Soon, this theory received official confirmation. Twitter representatives stated that the attack was due to the surveillance of a mobile carrier that had been compromised and allowed an unauthorized person to use Dorsey’s number to send SMS messages.
Interestingly, Twitter has been aware of this “weakness” for a long time. Thus, at the end of 2018, experts at Insinia Security warned about the dangers of using SMS messages as a second authentication factor and explained why it was difficult to use Twitter’s features via SMS. Even worse, articles about the dangers of this feature can be found online dating back to 2007 and 2009.
The fact is that Twitter can still be used via SMS messages, which was quite popular when the service first appeared. The main condition: the feature must be supported by the telecom operator. The problem is that in recent years, cybercriminals have increasingly “stolen” SIM cards by carrying out what is known as a SIM swap.
The essence of these attacks is that the criminal approaches the victim’s mobile operator representatives and uses social engineering. For example, by posing as the owner of the number, the attacker claims to have lost or broken the SIM card and tries to transfer the number to the new SIM card. The attackers then steal accounts linked to the phone number, thereby taking over other people’s identities. These attacks are often used to steal large amounts of cryptocurrency or to compromise valuable Instagram accounts.
If an attacker takes over a person’s phone number, the user immediately faces many problems, one of which may be Twitter. Indeed, to take control of another person’s account on the microblogging network, it is enough to enter the phone number associated with that account.
Allow me to remind you that Jack Dorsey had already been hacked in 2016. At that time, the hacking group OurMine claimed responsibility for the attack, and the hackers explained that they had compromised Dorsey’s Dropbox, where they found “all sorts of Vine files,” including screenshots of the control panel. It turned out that the control panel operator can see people’s personal information and passwords, which the attackers did not hesitate to exploit.
