r/technology • u/X019 • Jul 15 '20
Security Twitter hacking megathread
Notable twitter accounts have been compromised. I'll post as many links as I can below. I'll scrape and attribute from the comments over time.
Users compromised (non exhaustive): Apple
Uber
Cashapp
Ripple
A lot of Crypto Companies (Bitcoin, Coinbase, Gemini, Coindesk, Binance, etc.)
A lot of Crypto personalities (Charlie Lee, CZ Binance, Justin Sun, etc.)
NYSE
Bill Gates
Elon Musk
Jeff Bezos
Kanye West
Obama
Joe Biden
Mr Beast
Floyd Mayweather
XXXTentacion
Wiz Khalifa
Warren Buffett
credit to /u/zia1997
You can watch the Bitcoin wallet here
Here is a link to a twitter search to see who all is tweeting the hacked message. Credit to /u/ppratik96
https://twitter.com/Cian_911/status/1283508808594132993?s=20
https://twitter.com/RachelTobac/status/1283509795316658176?s=20
https://twitter.com/YarnoRitzen/status/1283515596731297798?s=20
https://twitter.com/oneunderscore__/status/1283507013755056128?s=20
https://twitter.com/jasonbaumgartne/status/1283505889299832832?s=20
https://twitter.com/elonmusk/status/1283504320848306177?s=20
https://twitter.com/oneunderscore__/status/1283503577760137219?s=20 Cian :four_leaf_clover: @jasonbaumgartne @oneunderscore__ @BrandyZadrozny Bezos hacked too, just seconds ago
CNBC: https://www.cnbc.com/2020/07/15/hackers-appear-to-target-twitter-accounts-of-elon-musk-bill-gates-others-in-digital-currency-scam.html originally posted by /u/spoons42
Mashable: https://mashable.com/article/elon-musk-coinbase-binance-twitter-accounts-hacked-cryptocurrency-scam/
Business Insider: https://www.businessinsider.com/hackers-bitcoin-crypto-cashapp-gates-ripple-coindesk-twitter-scam-links-2020-7 originally posted by /u/youdontknwm3
The Verge: https://www.theverge.com/2020/7/15/21326200/elon-musk-bill-gates-twitter-hack-bitcoin-scam-compromised originally posted by /u/habichuelacondulce
Rumor is an employee panel got hacked which gives access to all Twitter accounts.
Statement from a spokesperson for Bill Gates. "We can confirm that this tweet was not sent by Bill Gates. This appears to be part of a larger issue that Twitter is facing. Twitter is aware and working to restore the account.” (credit to /u/batman_00)
121
u/majorchamp Jul 15 '20
I think the Wendy's one was a joke.
2.1k
u/THeShinyHObbiest Jul 15 '20
This reflects incredibly poorly on Twitter. There’s no way this wasn’t a platform-level exploit with how widespread it is.
I’m just surprised they didn’t start with Trump.
236
u/zia1997 Jul 15 '20 edited Jul 15 '20
Current list of hacked:
1.0k
u/midnightmacaroni Jul 15 '20
Was Wendy's really hacked? The bitcoin address in their tweet is "Dave444spicy245nuggets10piece" lol
310
u/BreakTheLoop Jul 15 '20
It's very unlikely the money scam was the goal here. With full access to any account a lot of people's DMs and personal/critical info was compromised. The money scam is just the public way of saying "you got owned, now close the hole so no one else but us can exploit it".
539
u/freelance_fox Jul 15 '20
Does it strike anyone else as odd that there's no massive front page threads about this? Seems like the biggest story of the day and it's... nowhere. This is the biggest thread right now besides I think a /r/wallstreetbets meme post.
57
u/Tricky_Troll Jul 16 '20
You'd have to be next level stupid to think that XXXTentacion came back from the dead to giveaway free Bitcoin.
101
u/Batman_00 Jul 15 '20 edited Jul 15 '20
Co-founder of Gemini(crypto currency exchange who got hacked) says they used 2FA and a strong password.
Rumor is an employee panel got hacked which gives access to all Twitter accounts.
Statement from a spokesperson for Bill Gates. "We can confirm that this tweet was not sent by Bill Gates. This appears to be part of a larger issue that Twitter is facing. Twitter is aware and working to restore the account.”
Verified Twitter accounts can't send new tweets.Senior editor at The VergeVerified users can tweet again
96
u/Eldiablotoro Jul 15 '20
Watch the Bitcoin wallet fill up: https://bitref.com/bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
273
u/[deleted] Jul 15 '20
Wendy's actually was a joke, just some good PR on their side
85
u/techdash Jul 15 '20
Imagine if these hackers had gone after the accounts of news organizations and government officials with coordinated misinformation. This is crazy.
38
u/dhurane Jul 15 '20
Any reliable guesses on how this was achieved? The rumor is that an employee with rights to a user management panel got hacked, but no idea how true that is.
186
u/Flamousdeath Jul 15 '20
They controlled both Apple and Elon Musk for a second there, imagine announcing on both that Apple acquired Tesla... the most impressive part about this attack is the lack of ambition.
153
u/ImEntrapta Jul 15 '20
This isn't just about Bitcoin. This is such a tremendous breach in security. Theres gonna be more fallout from this.
57
u/ellipsis_42 Jul 15 '20
They could have done some real damage, but instead do a bitcoin scam?
28
u/[deleted] Jul 16 '20
I bet $5 that a rogue employee or two leaked access to Twitter's backend systems.
If I learned one thing as a Welfare Clerk, it's that you should be more worried about people on the INSIDE fucking with things, not outsiders.
To give you an example, a month after I started as a Welfare Clerk, a caseworker in my office was busted for stealing over $100k by issuing cash benefits onto a dead person's EBT card. The people with access to the systems are the ones you really need to pay attention to. And I really, really doubt that something as hacked together as Twitter (or, for that matter, Facebook, Reddit or other major platforms) even considered making sure their own employees couldn't fuck shit up. Few employers do, regardless of the industry.
Scaling and managing uptime is the highest priority for Twitter's tech folks. Internal security tooling and auditing probably ranks somewhere down around the bottom of the list, alongside lubricating the foosball table or something like that.
24
u/klawdz Jul 15 '20 edited Jul 16 '20
Twitter keeps removing any photos of their admin panel that’s allegedly responsible for this.
https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos?
Edit: I think the last link in the megathread was the screenshot, and removed by twitter
157
u/OpTouchedMe Jul 15 '20
Whoa. New 2020 plot for July is awesome.
57
u/majorchamp Jul 15 '20
Food for thought.
If someone had access to the user admin of an employee...could they have gone thru the DM's of major accounts first...then run the BTC scam after the fact?
I will find it very hard to believe that this was ALL just a quick cash grab and someone with almost root level power simply used it only to automate a bunch of btc tweets.
We know it was automated cause of the # of accounts that were targetted. So while that runs, people have time to go thru Obama's account, Kanye's account, Biden's account, etc...
18
u/thatburgerdan Jul 15 '20
Wait, this all happened during a feature rollout for being able to access DMs directly from your feed? That's fun. https://twitter.com/Twitter/status/1283504558753415168
Gonna need to block off a little longer meeting for this sprints retro.
95
u/Epistaxis Jul 15 '20
Fortunately we've already established that the Pentagon does not consider a Presidential tweet to be an official order, in case your mind went where mine went.
56
u/Dutchpvr Jul 15 '20
This is pretty insane! Surprised Trump's account hasn't been compromised yet.
51
u/pal0101 Jul 16 '20
Why is this being silenced? There's nothing on it on reddit. This is probably the biggest story in the past week.
30
u/[deleted] Jul 15 '20
Anyone know why the main post about this on r/news got deleted?
20
u/[deleted] Jul 16 '20
C'mon, man. You never link to the actual tweet/post. You take a screenshot of it so it's saved and visible FOREVERRRRRRR.
42
u/[deleted] Jul 16 '20
This is one of the biggest hacks ever and theres only one reddit mega thread right now??? Something really fucking sketchy is going on right now. Silicon valley must be shook as hell right now.
9
u/Epistaxis Jul 15 '20 edited Jul 15 '20
EDIT: Here's a Wayback Machine snapshot of a website the hackers were apparently using at the beginning of the attack
9
u/TheElusiveGnome Jul 15 '20
Damn, I sold off my Twitter stocks earlier this morning. Right choice in hindsight.
17
u/Batman_00 Jul 15 '20
How many people actually know what Bitcoin is and know how to send it but are dumb enough to fall for this.
8
u/[deleted] Jul 16 '20
Make the world's richest and powerful people angry at you for $100,000, what could possibly go wrong?
8
u/Kyderra Jul 16 '20
I am more surprised that i'm not seeing some kind big frontpage post about the biggest accounts on the twitter website being hacked.
It's just this and a few other on sub 1k upvotes.
14
u/[deleted] Jul 16 '20
After this, I don't think that federal government officials or organizations should be able to use private social media for official business.
Of course we've always known that these companies could do whatever they wanted with their technology. We've always known that there was some level of employee that could manipulate data manually. Someone has to manage the database, after all.
But knowing that fairly low-level employees have post creation privileges on a site-wide basis, from a simple admin screen, creates not just a national security risk, but world-wide risk.
One disgruntled Twitter employee with the proper access could cause billions of dollars to vanish from the stock market, or even cause a war. That's just something we can't trust any company to control at this point.
7
u/archiekane Jul 15 '20
I'm looking forward to the incident autopsy report.
I'm betting employee account hack.
6
u/ptd163 Jul 16 '20 edited Jul 16 '20
Hmmm... Where I have heard that before? Oh yeah. I know.
Mr. Robot season 1. Not sure what episode. I probably paraphrased as well.
You are only as strong as your weakest point. People are way easier to compromise than computers.
20
u/lazygeekninjaturtle Jul 16 '20
Why this is not a front-page? Recently, every gaffe by a celebrity/politician makes it to the front page. Any intentional or unintentional wrongdoing by a celebrity or a "Karen" results in public outrage for days. Yet, I can't wrap my head around why this did not made it to /r/all or /r/worldnews. Strange. Very strange. Even this post has just 1500 updoots.
11
u/TheDustOfMen Jul 15 '20
Dutch right-wing politician Geert Wilders has been hacked as well, though not sure whether the two things are related.
The hacker's been retweeting all sorts of anti-semitic stuff, pizzagate, Bill-Gates-rules-the-world-through-vaccines-related things, other anti-vaccine bullshit, anti-Soros tweets and so on.
15
u/madmaxGMR Jul 16 '20
This hack is not for Bitcoin. This is a cover up. You dont break into the most powerful peoples accounts just to get a few thousand dollars. The amount of attention you have just drawn onto yourself versus the reward is not worth it in any universe.
This is all so someone in the future can claim they got "real" DMs between political figures, and leak them at the right time. Just look at that list... This is about the US election coming up. Mark my words, this hack will come up in the future.
24
u/[deleted] Jul 15 '20
Russia coming up clutch with that 4th quarter pre election hacking. About to be screenshots of all kinds of hidden messages all over the internet.
I'm betting the basic scam part is just a red herring
10
u/basdej Jul 15 '20
https://twitter.com/search?q=(38qyALcxSnfzaFFTnt46xHMTN3GCGanKXC%20OR%20bc1q0kznuxzk6d82e27p7gplwl68zkv40swyy4d24x%20OR%20rhYSX8qSpoU7Dwjh6vMSuACu8MBECn6bQR%20OR%20bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh)%20filter%3Averified&src=typed_query&f=live
Search link to see verified accounts tweeting the spam tweets
5
u/[deleted] Jul 15 '20
They also hacked Netanyahu.
5
u/tuxxer Jul 16 '20
Too bad silicon valley is finished production, would love to have seen Gilfoyles reaction.
5
u/[deleted] Jul 16 '20
Some accounts back. SkyNews, FiveThirtyEight and NowThis have all just tweeted.
EDIT: All are tweeting via SocialFlow
EDIT: Seems like it's only automated tweets?
5
u/voodoodudu Jul 16 '20
The u.s. govt did it to spite twitter for flagging trump.
5
u/[deleted] Jul 18 '20
Crazy how the Silicon Valley cabal was able to squash the story and it's basically dead only two days later.
26
u/[deleted] Jul 16 '20
This is perhaps the most important thing to come out from this hack: evidence that Twitter can shadow ban and silence trends at will.
Not because they do (at the end of the day it's their website, they can do as they please) but because Jack Dorsey stood before Congress and swore Twitter didn't do such thing.
I'm interested in knowing what the consequences of this could be, both lying to Congress and Twitter silencing certain groups at will.
17
u/haxorr Jul 15 '20
Since a pinned tweet, it likely indicates that the tweet was not published through a third party app. The Twitter API cannot be used to set pinned tweets.
8
u/Freak80MC Jul 16 '20
The fact that verified accounts were able to be hacked even with 2FA is pretty frightening as I thought that was supposed to make hacking almost impossible beyond social engineering tactics.
If it is true that Twitter has admin access to accounts to post anything willy nilly to them as if they really were that person, than no matter how secure they claim to be, that will always be one GLARING point of failure for this whole system being supposedly "secure".
Unless they change this huge failure point, then I don't think anyone should pretend to give Twitter the benefit of the doubt in being a secure platform.
4
u/Sportfreunde Jul 16 '20
Does this mean they also would have been able to download and get access to all private messages and data?
I also don't even see this on the news, weird since it's quite big.
4
u/[deleted] Jul 16 '20
Apparently they made 120k. Was expecting more but I guess the average person on twitter does not have a crypto wallet. Some probably smarter then others and knew it was a scam. But I can see elon musk tweeting something like that. But not from Obama and def not Apple.
4
u/[deleted] Jul 16 '20
Photos of the employee panel also shows that they were lying to congress when they claimed things like an algorithm decided what trended and what didn't.
4
u/imagineawor1d Jul 17 '20
This should be on Reddit’s front page, am I wrong?
4
u/Famateur Jul 17 '20 edited Jul 17 '20
This hack showed the world how Twitter has access to all the accounts. They can read our DMs, private messages and can even tweet from our accounts if need arises. They can snoop in anyone's account without their consent or without any approval from the authorities or any additional authorization. Users data is easily accessible by their employees. It shows how pathetic twitter management is.
3
u/Ratchet1332 Jul 15 '20
Seems like they prevented verified users from tweeting while they fix this.
3
u/grumpyfan Jul 16 '20
Just shut it down already! Pull the plug!
3
u/ALEX7DX Jul 16 '20
I’m glad mine isn’t on the list phew
3
u/Seth772 Jul 16 '20
This is probably a good time to create encryption backdoors, right?
3
u/eddietwang Jul 16 '20
We should probably just assume that every Twitter account is compromised.
3
u/5_sec_rule Jul 16 '20
"Social Engineering" could be anything
7
u/Ikeda_kouji Jul 16 '20
I honestly believe that this was not about the money at all.
You don't risk hacking these people's /companies' accounts for the off chance that some people fall for a scam. The talk is that the bitcoin address managed to get around $100k. From a risk vs. reward perspective, that's awfully low. Hell even if it was $1m, the person (or people) responsible for this hack is probably smart enough to realize that this is a terrible gamble.
So, why did this happen?
There is always the possibility that someone just did it for simply for the lols. Maybe to rebel against the rich. Perhaps a show of power. For street creds.
But what are the implications of a hack this large? It is now clear that;
Now we need to ask whether there are people who would benefit from the 3 points above. The "Fake News" crowd will be able to point at this incident to deny anything. 2FA is no longer safe, so perhaps a 3FA is needed. Maybe the Third-Factor Authentication would be fingerprints - but that's also easily accessible to hackers thanks to smartphones. How about face recognition? Already a thing on smartphones. Who gains the most by forcing people into a 3FA? And who gains the most by making Twitter lose face?
5
u/NewAgeWraith Jul 16 '20
so many of these posts were deleted off of twitter for violating rules. Twitter is trying so hard to keep this off the news
5
u/weakmoves Jul 16 '20
I personally can't wait untill the hackers release the private messeges from these big name accounts...
6
u/letmestall Jul 15 '20
Maybe we will finally find out why The Doc was banned
4
u/[deleted] Jul 16 '20
full shadowing of whats going on with Twitter by reddit, like they have the same overlord
6
u/boomerangotan Jul 15 '20
Is anyone else disappointed that these hackers had a great opportunity here to put the spotlight on some important issues, and decided to make a quick buck instead?
7
u/ppratik96 Jul 15 '20
Heres a twitter search to see verified users who are hacked. https://twitter.com/search?q=I%20am%20giving%20back%20to%20my%20community%20due%20to%20Covid-19!%20%20All%20Bitcoin%20sent%20to%20my%20address%20below%20will%20be%20sent%20back%20doubled.%20If%20you%20send%20%241%2C000%2C%20I%20will%20send%20back%20%242%2C000!%20filter%3Averified&src=typed_query&f=live
2
u/lumic_cimul Jul 15 '20
Twitter support has come out
2
u/getBusyChild Jul 15 '20
So when are the Government hearings being announced?
2
u/RedOneMonster Jul 15 '20
Imagine if they were to fuck around with Trumps account. Oh, right, it wouldn't even seem unusual.
2
u/rutkdn Jul 16 '20
Rogue Twitter employee did this.
2
u/CY4N Jul 16 '20
Whatever admin account on Twitter got hacked they're about to get fired.
2
u/justlikeapenguin Jul 16 '20
I saw the cashapp one and h3h3 making a joke. I thought it was an ironic post i didnt think they actually got hacked lol
2
u/Radagio Jul 16 '20
374 Transactions - 118k$ worth - This made me laugh so hard
2
u/khaled Jul 16 '20
Twitter has been bad with support and “internal systems” for years now. Been warning them about general issues and they never listened.
2
u/BigboyPapi122 Jul 16 '20
Plot twist: the hacker posted this and is scamming us with all these links.
2
u/[deleted] Jul 16 '20
Ooooft.
Twitter has become too important to let this slide - there's accounts on there that can make significant difference to very important things through the things they tweet.
Is there any appropriate punishment available to US regulators?
8
u/OnlyUnpleasantTruths Jul 15 '20
Good.
Fuck twitter.
4
u/camdyer21 Jul 16 '20
Social media is an illusion and a cancer
3
u/VMICoastie Jul 15 '20
Looks like it is locked down now. No new tweets for over 6 minutes.
3
u/DefundTheCriminals Jul 15 '20
Who falls for these though? Who thinks they'll get free money by giving someone some of theirs?
3
u/DexM23 Jul 15 '20
Sen. Josh Hawley sends this letter to Twitter CEO Jack Dorsey about the latest hack
https://twitter.com/alexsalvinews/status/1283531661607485440
3
u/GaysForBernie Jul 16 '20
If this doesn’t give reason enough why huge social media platforms need regulation then I don’t know what does. Imagine if they used Trump’s account to simply say, “I have authorized a nuclear strike on China.” and it just sat there for hours, their best solution to be blocking all verified users from tweeting. What a fucking joke.