Vigilante Hacker Hijacked Twitter Accounts To Prove Security Issue

According to a report on the portal Independent, an online hacking security agency claims to have “hijacked” multiple Twitter accounts to prove their point how regarding online security issues.

A number of celebrities woke up to the message: “This account has been temporarily hijacked by Insinia Security,” that appeared on the Twitter accounts including Eamonn Holmes and Louis Theroux. The tweet also appeared on the Twitter feed of The Independent’s travel correspondent Simon Calder.

According to a post on Medium by Insinia Security, which explains the hijacking, it was done to highlight the security dangers of having a phone number associated with a Twitter account.

Mike Godfrey, the CEO of Insinia Security, confirmed to The Independent the reason behind the hacking, explaining: “Insinia have warned for years that using text messaging for authentication, interaction or security is totally unacceptable and leaves people vulnerable to attack.

“This issue was highlighted to Twitter in 2007, again in 2009, again in 2011 and almost every year since. Quite simply; Twitter doesn’t listen. The campaign today was to highlight these vulnerabilities, how serious they can be and how someone with a relatively low skill set and a range of tools can control social media that people use to control their brands, career, image and much more. People have a right to know the truth about the state of insecurity that huge companies like Twitter leave innocent users in.”

Today, everyone is active on social media, and companies are implementing social media strategies to communicate with their customers on their own terms and on their preferred platforms. According to Godfrey, hijacking the accounts was easy – “In this case, it was a simple task of ‘spoofing’ the Twitter users MSISDN (mobile phone number) and sending texts that appeared to be from their phone to Twitter, which will automatically accept commands provided it believes that the text has come from the users phone number, which it did.”

While Godfrey would not disclose “how these numbers were obtained,” he did say the entire attack “took less than 10 minutes to carry out and complete.” He emphasized about the dangers this lack of security poses.

“We used this method to successfully control the targets Twitter account, allowing us to send DM’s, retweet and like tweets, follow and unfollow people and much more,” the post reads.

According to Insinia Security, this flaw in security could lead to potential risks such as the spread of offensive or extremist material and the spread of fake news.

Godfrey said “To protect oneself, the best way is to use a “separate number for TFA (two-factor authentication) on Twitter.”

“People must understand that even someone having your phone number puts you at risk,” he continued. “We shouldn’t be so relaxed with who we give our numbers to and Twitter certainly shouldn’t be allowing people to tweet and control accounts by sending texts with no authentication.”