At the end of last week, the Twitter account of Jack Dorsey, CEO of Twitter, was hacked. After compromising the account, the attackers began posting offensive and racist content on Dorsey’s behalf, and even claimed that a bomb had been planted at the company’s headquarters. The hacking group Chuckle Gang claimed responsibility for the attack.
According to official figures, the attack was due to an oversight by the mobile carrier, which reportedly compromised and allowed an unauthorized person to use Dorsey’s phone number to send SMS messages. The fact is that, until recently, Twitter could be used via SMS text messages, which was quite popular at the dawn of the service. The main requirement: that the feature be supported by the telecom operator. The 140-character limit once existed precisely for this reason: because of the maximum length of SMS messages.
Twitter has long been aware of this “weakness.” Thus, at the end of 2018, experts at Insinia Security warned about the dangers of using SMS messages as a second authentication factor and explained why it was difficult to use Twitter’s features via SMS. What’s more, articles on the dangers of this feature dating back to 2007 and 2009 can still be found online.
The problem is that, in recent years, cybercriminals have increasingly “stolen” user SIM cards by carrying out what is known as a SIM swap. The essence of these attacks is that the criminal approaches the victim’s mobile operator representatives and uses social engineering. For example, by posing as the owner of the number, the attacker claims to have lost or broken the SIM card and attempts to transfer the number to the new SIM card. The attackers then take over accounts linked to the phone number, thereby stealing other people’s identities. These attacks are often used to steal large amounts of cryptocurrency or to compromise high-value Instagram accounts .
Twitter’s developers announced that, following the hacking of Dorsey’s account, they had decided to disable the ability to send tweets via SMS text messages. It is emphasized that the suspension is temporary; however, no timeline has yet been given for when this feature will be restored. Interestingly, at the same time, the developers somewhat place responsibility on mobile carriers, stressing that they need to fix vulnerabilities on their end.
