Uncategorized

17 12 months Outdated Teen Arrested, Stated to be Perp of Twitter Hack and Bitcoin Con

August 1, 2020

 

A 17-year-old teenager in Hillsborough County, Florida has been arrested in relation to the excessive profile Twitter (NYSE:TWTR) hack that lately occurred. Hillsborough county the place Tampa is positioned.

 

State Lawyer Andrew Warren is quoted in a number of stories claiming:

“These crimes had been perpetrated utilizing the names of well-known individuals and celebrities, however they’re not the first victims right here. This ‘Bit-Con’ was designed to steal cash from common People from all around the nation, together with right here in Florida. This huge fraud was orchestrated proper right here in our yard, and we is not going to stand for that … “I need to congratulate our federal legislation enforcement companions—the US Lawyer’s Workplace for the Northern District of California, the FBI, the IRS, and the Secret Service—in addition to the Florida Division of Legislation enforcement. They labored rapidly to research and determine the perpetrator of a complicated and intensive fraud.”

Earlier this month, Twitter was hacked with outstanding accounts hijacked. Names like Apple, Uber, Elon Musk, Invoice Gates, Joe Biden, Warren Buffet, and sure, even Kanye West, and extra had been targets of the rip-off. The tweets had been rapidly scrubbed however not earlier than roughly $100,000 was pilfered.

The person in query is claimed to be charged as an grownup. Two different people are being reported as accomplices.

Allison Nixon, Chief Analysis Officer and Mark Rasch, Chief Authorized Officer, at Unit 221B, a cybersecurity agency specializing in financially motivated cyberattacks, have revealed a weblog submit claiming the hack was a part of a VPN phishing rip-off.

The 2 cybersecurity consultants clarify that the hacker would name an worker, maybe spoofing a telephone quantity after which direct them to a phish web page mimicking an inside VPN portal belonging to the corporate.  The goal could be advised to log into the “inside” company web site which was actually managed by the hacker after which the worker could be induced to enter their entry info:

“With a purpose to entry the VPN, the legit worker was required to have multi-factor Authentication. Usually a consumer ID, a password, after which a pin which might solely be despatched to their safe mobile phone. However because the sufferer was logging into the phish web page and giving up their credentials and time-sensitive one-time-password, the hacker was concurrently getting into the identical info on to the true company VPN. When the company VPN asks for a consumer ID and password, it will ship the pin again to the worker. The worker did precisely what they had been educated to do. They might put within the pin, the multi-factor authentication was handed to the hackers web site and the hacker can seize that pin and enter it into their very own entry to the VPN. Multi-factor Authentication, defeated!”

Yesterday, Twitter posted an replace offering some further perspective on the “social engineering” that focused a small variety of staff by way of the spear phishing assault. The corporate acknowledged that the hack required the attackers to acquire entry to each their inside community in addition to particular worker credentials that granted them entry to inside assist instruments.

The world is stuffed with tender targets, defined the 2 cybersecurity consultants.