Twenty-four hours after a major security breach at Twitter saw the verified accounts of world leaders, celebrities, and corporate brands hijacked to publish fraudulent messages, few things were clear about the hack except this: it could have been much, much worse.
“Imagine this happening the night before the election,” said Bruce Schneier, a prominent security technologist and fellow at Harvard Kennedy School. “It doesn’t take a lot of imagination to go: ‘Wow!’”
The hours-long breakdown of Twitter’s systems, both by the hackers who published messages and by Twitter as it attempted to take back control, provided a stark demonstration of how much of the information ecosystem, especially in the US, relies on Twitter and its verification system – and the vulnerabilities inherent to that dependency.
The fiasco raises a host of questions, chief among them: should we still trust Twitter? And even if we don’t, what can we do about it?
Twitter has yet to release much information about the attack, beyond that it was a “coordinated social engineering attack” on its own employees that enabled hackers to gain access to the company’s internal tools and thereby take control of users’ accounts.
“To me the vulnerability is on the social side,” said Schneier, who urged the public and press not to speculate too much about the technical details of the attack. “We over-rely on Twitter. These platforms have an enormous amount of power and they’re not regulated … What you have to do is stop allowing these monopolies to exist. It’s not about Twitter; it’s that there’s only one.”
On Friday, the Federal Bureau of Investigation said it had launched an investigation into the attack. The bureau’s San Francisco office said the motivation for the attack appears to have been “cryptocurrency fraud”.
But several US lawmakers also raised concerns about potential for fallout from the attack that goes beyond hackers scamming a few hundred unfortunate victims out of $100,000. Senator Josh Hawley of Missouri called on Twitter to “give the public an accounting of how much of their personal info” it lost, raising the question of whether the attackers might have stolen users’ private messages, known on the platform as direct messages or DMs.
Senator Ron Wyden of Oregon revealed that Twitter chief executive Jack Dorsey had told him in 2018 that the company was working on bringing end-to-end encryption to DMs. “It’s been nearly two years since our meeting, and Twitter DMs are still not encrypted, leaving them vulnerable to employees who abuse their internal access to the company’s systems, and hackers who gain unauthorized access,” Wyden said. “If hackers gained access to users’ DMs, this breach could have a breathtaking impact for years to come.”
If the attack was a straightforward financial crime with no geopolitical motivations or implications, that would be a best case scenario. But it’s still not clear if that is the case, nor if Twitter is prepared for the much more complicated and frightening alternatives.
On Friday afternoon, the company said that it has “no evidence that attackers accessed passwords”, and that it is still investigating the attack.
Thursday’s attack created a uniquely unstable information event. First, Twitter’s systems were compromised, resulting in a tsunami of disinformation. Then, in order to regain control of its systems, Twitter shut down the ability of all verified accounts to tweet anything at all, preventing both the victims of the attack, public officials, and the news media from publishing reliable information and creating a vacuum for misinformation.
“The nightmare scenario isn’t someone hacking into [the Twitter account of] US Strategic Command and saying a nuclear missile had been launched,” said Heather Williams, an assistant professor at King’s College London and co-author of a new report on the impact of Twitter in diplomacy and crisis escalation. “It’s someone hacking into Trump’s account and saying something believable.”
“That’s the real nightmare scenario: where you really can’t tell if something is real or not,” she added.
That prospect does not appear to have put Trump off tweeting. The White House said Friday that his account was not compromised and he will remain on the platform.
Schneier questioned why tech companies do not have to follow similar rules as banks when it comes to allowing employees access to customers’ accounts. “If this were a bank, there would be lots of regulations,” he said. “More importantly, senior executives would get fired.”
“Unregulated monopolies are bad for society,” he added. “And this is an example of unregulated monopolies being bad.”