In 2020, the Twitter account of Elon Musk was hacked to promote a Bitcoin scam… followed by the compromise of other celebrity accounts including Obama, Bill Gates, Joe Biden, Jeff Bezos, Apple, Uber… A total of 130 high-profile accounts in one single shot.

When this news surfaced, everyone had one intriguing question: Who did this and how was it possible to land such a large-scale hack?

Everyone thought it must be the work of a sophisticated and advanced threat actor.

But it turns out that the 'mastermind' was a 17-year-old teenager!

How the attack was performed:

The attacker starts with LinkedIn, then Searches for Twitter employees who might have access to internal admin tools, and Uses LinkedIn's job recruiter feature to obtain phone numbers of those targeted profiles.
The attacker now calls those employees Convinces them they are authorized Twitter IT staff and directs them to a site mimicking an internal Twitter VPN.
This is the most interesting part: As soon as an employee enters their credentials in the fake VPN site, the attacker enters those same credentials into the real Twitter VPN portal and so the employee receives the real OTP, then enters that into fake VPN site, and Attacker steals the OTP, then Attacker now is in the Twitter internal network.
Using the internal admin tool, the attacker searches celebrity accounts and do something which i can not share it here,.........
Finally Posts tweets on Bitcoin scams. If you want to know all these, Signup with NODO, use smartrogo-11250 as reffaral code, upvote all my content , share and comment then reachout to me. Smartrogo

There are several lessons from this story:

Need for zero trust implementation involving risk-based sign-ins
The need for conditional policies at the device level
Need for securing admin accounts
Need for employee training. And so, on and on…

But the key takeaway to me is this:

If a teenager with no resources can bring a company like Twitter to its knees, imagine what threat actors with nation-state funding & sophisticated knowledge can do! That just puts into context the enormous challenge that enterprises face in the current world.

The teenager started with a LinkedIn search and ended up taking over Twitter. That's something from almost nothing.

They got Twitter, Are you next?

Okay. Maybe you don’t own a business or work for a company as large as Twitter. And perhaps you don’t have clients as well-known as Jeff Bezos and Bill Gates. It doesn’t matter.

Cyber security is a game of unpredictability. No system is impervious. No threat is too improbable.

Photo Credit: Malwarebytes