Skip to main content

This professional hacker says the Twitter attack was a 'big wake-up call.' Here's the advice she gives other tech companies to avoid a similar fate. (TWTR)

* Twitter just experienced an unprecedented hack. On Wednesday, several high-profile accounts were hijacked and tweeted out bitcoin scams. * Twitter has confirmed the hackers gained access to its internal systems by coordinating a social engineering attack on an employee. * One hacker who's often hired by companies to find weaknesses in their systems explains why she saw this coming, and what companies like Twitter can do to better avoid these types of hacks. * Visit Business Insider's homepage for more stories. On Wednesday, Twitter experienced an extraordinary coordinated attack in which several high-profile accounts including those of Kanye West, Elon Musk, and Barack Obama were hijacked. The attack was so colossal that the Federal Bureau of Investigation is now looking into it. And while many of the details are still unknown,  Twitter has confirmed that the hackers gained access to its internal systems by coordinating a social engineering attack on an employee. According to reports from Motherboard and TechCrunch, the hackers accessed an internal dashboard that would have allowed them to reset the passwords on select accounts and take control. Early into the attack, some people started theorizing that this was exactly what was happening. Rachel Tobac, CEO of SocialProof Security, is a hacker hired by companies to break into their security systems and expose their vulnerabilities. As the attack was starting to unfold, Tobac tweeted out a theory: the attackers had likely gained access to Twitter's employee admin panel. "It's one of those moments where a lot of the things I've been recommending for years have come to a head," she told Business Insider. The types of admin privileges the hackers may have accessed is common among tech firms, said Tobac. "It's very common, and a lot of people are shocked that admin access or 'God mode' exist," she said. "Many organizations have a lot of admin access and it's pretty unchecked. It's pretty rare that I get stopped when I'm doing an attack and can't get admin access. Oftentimes, I can get that within 5 minutes." Tobac, whose company has worked with Facebook, Uber, and PayPal, suggested a few things that all companies with these sorts of admin systems should be enforcing, including a requirement for multiple employees to sign off on certain decisions. "Have at least two sets of eyes when you need to make a really big decision, like changing the email on former President Obama's account," she said. Tobac also recommends "multi-factor authentication, hopefully tokenized, for even logging in with those credentials at work." "You can also have threat detection, so if you have an insider threat, and you mark a couple of high value behaviors as possible threat actions, when you see them going off multiple times in an hour that will alerts you that something strange is happening," she added. "And then, making sure there's multi-factor authentication and, of course, training for folks. Employees will inevitably make mistakes so they need technical tools in addition to their training to protect them." Experts have warned that the Twitter attack could be part of something much larger than bitcoin scams. "Noisy attacks are a great way to distract security teams from other malicious activities," one cybersecurity expert told Business Insider. Some experts even believe the bitcoin scam could have been a way for the hackers to show off. Whatever the truth may be, Twitter is under fire to deliver answers explain to lawmakers how an attack like this could happen. Experts believe this could be a wake-up call for Twitter and others who have watched the events unfolding thankful it wasn't happening to them. "To be really frank with you, I think this is an issue that many companies do not take seriously," said Tobac. "Twitter is not alone in this. It's terrible to see it happen to Twitter, but this is hopefully a big wake-up call for companies all over the world to limit their admin access, to consider the implications of who can make those changes, train their employees, and back them up with technical tools." Join the conversation about this story » NOW WATCH: Pathologists debunk 13 coronavirus myths
https://bit.ly/2DRYFJj

Popular posts from this blog

The 11 most important details we already know about the PlayStation 5, Sony's next-generation video game console set to arrive this year

* The PlayStation 5, Sony's next-generation game console that's deep in production, is scheduled to launch during the 2020 holiday season. * As you might expect, the PlayStation 5 is promised to be more powerful than the existing PlayStation 4 — and we've slowly been learning more about the next-gen console's new features since it was first revealed. * So far, Sony has offered a first glimpse at the new console via its new DualSense gamepad, and a tech demo highlighted the technical prowess of the new machine. * Here's everything we know so far about Sony's next-generation PlayStation console. * Visit Business Insider's homepage for more stories. The PlayStation 5 is almost here. Sony's next-generation PlayStation game console is scheduled to arrive this holiday season, but we already know plenty of details about it right now: how powerful it is, its main features, and we've even gotten a good look at its new gamepad.  Here everything we kno...
Read more

Tokyo installed see-through public toilets in a park to let people inspect their cleanliness before using them, at which point the glass turns opaque

* Two see-through bathrooms have been installed in public parks in Tokyo. * They are made from "smart glass" designed so people can see how clean they are inside before using them. The glass turns opaque when the bathroom is locked and in use. * The stalls are part of a project that is redoing 17 of the city's public bathrooms with different designers to make them more accessible and appealing. * The goal is to fight assumptions that public toilets are "are dark, dirty, smelly, and scary," said the nonprofit foundation behind the project. * Visit Business Insider's homepage for more stories. Tokyo has installed two see-through bathroom facilities in public parks, allowing people to see how clean they are before deciding to use them, at which point they turn opaque. The bathrooms are made of colored "smart glass," which turns opaque when the stalls are locked, said Shigeru Ban, the architect behind the designs. You can see how it works her...
Read more

Bill Gates says the world would need as many as 14 billion doses of a coronavirus vaccine to stop the virus

* The world could need as many as 14 billion doses of COVID-19 vaccines, Bill Gates said on Thursday in a blog post about the race to develop a way to make people immune to the disease. * "We need to make billions of doses, we need to get them out to every part of the world, and we need all of this to happen as quickly as possible," Gates said. * Gates said he had his eyes on eight to 10 promising candidates, adding that healthcare workers and people in low-income countries should be first in line once we find one that works. * While potential vaccines are progressing with historic speed, they're still months, or even years away, and the biggest challenge lies ahead in proving whether they are safe and effective in humans. * Visit Business Insider's homepage for more stories. Bill Gates believes we may eventually need to produce as many as 14 billion doses of COVID-19 vaccines globally and that we're anywhere from nine months to two years away from making tha...
Read more