The Twitter hack in July proved to be the biggest cyber security incident of the year so far. The accounts of some of the world’s most prominent figures such as Barack Obama, Jeff Bezos and Elon Musk were compromised. Luckily, the attack proved to be less catastrophic than it could have been.
Initial theories were that Twitter’s systems have been compromised, though it was discovered that one of the biggest social media hacks had been perpetrated on social engineering. Not only does the attack show the potential of social engineering and “phone spear phishing”, it also highlights the vulnerabilities of work from home.
Twitter is not the only big social media platform to become embroiled in a cyber-security incident – Facebook has had its fair share too.
What is phone spear phishing?
Also called “vishing” (short for voice phishing), phone spear phishing involves someone calling employees and persuading them to hand over passwords to internal tools. This means the attacker may not directly ask for the password to, say Twitter, but an app that is used to schedule posts on Twitter.
Don’t think this type of attack is rare or isolated. Leading up to the Twitter hack and since then there has been a marked increase in phone spear phishing. Web hosting companies, banks and many other businesses are reporting their employees are being targeted.
Cyber dangers of work from home
After initial worries of a large scale hack of Twitter’s servers, it transpired that access to internal tools had been coerced from a Twitter employee who had recently started ‘work from home’ because of Covid-19. The incident highlights some of the biggest risks associated with a remote workforce.
- Less effective communication – With staff and managers working remotely communication is reduced, forcing employees to take decisions with insufficient information.
- Sensitive information less secure – Things like passwords and documents are less secure since they must be shared with a larger number of people.
- Reduced data security – People become less careful with information over time as they fall into routines at home and become lackadaisical about security.
- Harder to detect attacks – Cyber threats originating at remote terminals take much longer to detect and address.
How can small and mid-sized businesses protect themselves from Twitter-style attacks?
Socially engineered attacks like email phishing and vishing target human behavior. A business must counteract this in two ways:
- Create policies for information sharing that don’t force employees to act hastily
- Regular corporate security training sessions to prepare employees for social engineering
We have helped businesses across Toronto and the GTA transition to remote operations safely. Our IT security teams refresh your staff about safe working practices and keep them updated with new cyber threats.
One more thing…another twist in the Twitter saga
The Twitter employee was arrested and tried before a court in the United States. The hearing was carried out over Zoom, due to Covid-19, but had to be suspended because it kept being interrupted by Zoombombers (people hijacking publicly listed Zoom meetings). These users mimicked CNN and BBC employees to join the hearing and then played unsavoury content in the meeting, prompting the judge to remark “next time he’ll require a password.”
Another lesson for your staff: make sure Zoom meetings are protected by passwords and meeting IDs are not made public.
