What We Can Learn From Twitter's Massive Breach

Every day, hackers are seeking to attack targets that will reap the most reward. Oftentimes, hackers will target small companies that do not have the resources to fund a cybersecurity department. Other hackers will spend time looking for vulnerable individuals who would make for easy targets. However, Mason Sheppard, Nima Fazeli, and Graham Clark are no ordinary hackers. These young hackers put their minds together to target Twitter accounts as part of a bitcoin scam.

Mason Sheppard, Nima Fazeli, and Graham Clark were all found guilty of conspiracy to commit money laundering, conspiracy to commit wire fraud, and the intention to gain access to a private computer. However, Graham Clark was the real mastermind behind this major scam. Clark, at only 17 years old, has been charged with 30 felonies pertaining to fraud and scams.

On July 15, Graham and his team managed to obtain access to roughly 130 twitter accounts, including many celebrities, public figures, and large corporations. Some of these include Kanye West, Jeff Bezos, Barack Obama, Elon Musk, Apple, and Uber. Out of the 130 accounts, 45 of these were tweeted from successfully (Wired). These tweets urged millions of people to donate money to a specific bitcoin wallet in return for double the money being sent back to the donator. Many people quickly fell for this attack and began sending money to the bitcoin wallet. Within a matter of hours, the bitcoin wallet had over $100,000 (The Hacker News). It is unclear how authorities identified Clark, but there are many lessons to be learned from this attack.

This whole attack started because Clark gained access to a Twitter employee account. While there is no evidence for how the account was compromised, the Twitter employee and Twitter should have taken multiple steps to prevent this attack from happening.

Here are some things to keep in mind when properly securing an online account:

Use a Strong Password

• Having a strong password will prevent hackers from conducting a successful brute force attack. A brute force attack occurs when a hacker utilizes software that automates the process of attempting to login to an account. This automated attack tries to log in to an account using a bunch of common passwords and phrases. The best way to protect against this type of attack is to make sure that your password is complex. We recommend using multiple special characters, numbers, and a mix of upper and lower case letters. Passwords should also be at least 14 characters long, but the longer, the better. 

Implement Restrictions for User Accounts

• Not everyone needs admin access for their accounts. Administrator rights should be used sparsely. Administrator rights allow anyone with these rights to have full access to everything within a system or network. The Twitter employee that was hacked during this attack most likely had admin rights, which is why Graham Clark could gain access to so many twitter accounts. System Administrators need to make sure that they do not allow many users to have admin access. This will further prevent hacks like this from being successful. When in doubt, practice the principle of least privilege: only grant the privileges needed to complete the job.

Cybersecurity Awareness Training

• It doesn’t matter if you use computers on a daily basis or if you never use them. Cybersecurity awareness is important for everyone. This training should cover topics such as social engineering, phishing, malware, threat types, etc. This training will help you understand the risks involved with cybercrime and how to be aware when a hacker is targeting you. YouTube offers many videos on cybersecurity and the fight against cybercrime. These videos will help prepare you to know what to look for, and how to better secure your accounts and information.

Hackers are never going to rest. It’s our job to educate ourselves on the best cybersecurity practices. Twitter will have to improve its cybersecurity moving forward in order to prevent the same attack from occurring in the future. It’s important that they properly train their employees on how to assess, identify, and prevent cyber-crime from succeeding.