Twitter has revealed a little more detail about the security breach it suffered earlier this month when a number of high profile accounts were hacked to spread a cryptocurrency scam — writing in a blog post that a “phone spear phishing attack” was used to target a small number of its employees.
Once the attackers had successfully gained network credentials via this social engineering technique they were in a position to gather enough information about its internal systems and processes to target other employees who had access to account support tools which enabled them to take control of verified accounts, per Twitter’s update on the incident.
“A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all of the employees that were initially targeted had permissions to use account management tools, but the attackers used their credentials to access our internal systems and gain information about our processes. This knowledge then enabled them to target additional employees who did have access to our account support tools,” it writes.
“This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems,” Twitter adds, dubbing the incident “a striking reminder of how important each person on our team is in protecting our service”.
It now says the attackers used the stolen credentials to target 130 Twitter accounts — going on to tweet from 45; access the DM inbox of 36; and download the Twitter data of 7 (previously it reported 8, so perhaps one attempted download did not complete). All affected account holders have been contacted directly by Twitter at this point, per its blog post.
Notably, the company has still not disclosed how many employees or contractors had access to its account support tools. The greater that number, the larger the attack vector which could be targeted by the hackers.
Last week Reuters reported that more than 1,000 people at Twitter had access, including a number of contractors. Two former Twitter employees told the news agency such a broad level of access made it difficult for the company to defend against this type of attack. Twitter declined to comment on the report.
Its update now acknowledges “concern” around levels of employee access to its tools but offers little additional detail — saying only that it has teams “around the world” helping with account support.
It also claims access to account management tools is “strictly limited”, and “only granted for valid business reasons”. Yet later in the blog post Twitter notes it has “significantly” limited access to the tools since the attack, lending credence to the criticism that far too many people at Twitter were given access prior to the breach.
Twitter’s post also provides very limited detail about the specific technique the attackers used to successfully social engineer some of its workers and then be in a position to target an unknown number of other staff who had access to the key tools. Although it says the investigation into the attack is ongoing, which may be a factor in how much detail it feels able to share. (The blog notes it will continue to provide “updates” as the process continues.)
On the question of what is phone spear phishing in this specific case it’s not clear what particular technique was successfully able to penetrate Twitter’s defences. Spear phishing generally refers to an individually tailored social engineering attack, with the added component here of phones being involved in the targeting.
One security commentator we contacted suggested a number of possibilities.
“Twitter’s latest update on the incident remains frustratingly opaque on details,” said UK-based Graham Cluley. “‘Phone spear phishing’ could mean a variety of things. One possibility, for instance, is that targeted employees received a message on their phones which appeared to be from Twitter’s support team, and asked them to call a number. Calling the number might have taken them to a convincing (but fake) helpdesk operator who might be able to trick users out of credentials. The employee, thinking they’re speaking to a legitimate support person, might reveal much more on the phone than they would via email or a phishing website.”
“Without more detail from Twitter it’s hard to give definitive advice, but if something like that happened then telling workers the genuine support number to call if they ever need to — rather than relying on a message they receive on the phone — can reduce the likelihood of people being duped,” Cluley added.
“Equally the conversation could be initiated by a scammer calling the employee, perhaps using a VOIP phone service and using caller ID spoofing to pretend to be ringing from a legitimate number. Or maybe they broke into Twitter’s internal phone system and were able to make it look like an internal support call. We need more details!”
