FBI Used Information From An Online Forum Hacking To Track Down One Of The Hackers Behind The Massive Twitter Attack

from the not-even-a-third-party-record dept

As Mike reported last week, the DOJ rounded up three alleged participants in the massive Twitter hack that saw dozens of verified accounts start tweeting out promises to double the bitcoin holdings of anyone who sent bitcoin to a certain account.

Three people were arrested. The ringleader appears to be a 17-year-old Tampa, Florida resident. The other two suspects are a 22-year-old Florida man and a 19-year-old from the UK. The hack was achieved through social engineering, giving the suspects access to an internal dashboard used by Twitter employees. This gave them access to multiple accounts, as well as all any direct messages sent to and from those accounts. That it was all just a bitcoin scam is somewhat of a relief, although not so much for victims who were duped out of nearly $100,000 via 400 transactions.

A rather interesting aspect of the investigation was pointed out by CNET reporter Alfred Ng. There are plenty of places investigators can go to obtain evidence stored on websites. But they don't always need a subpoena or warrant. Sometimes the information is already out in the open, having been harvested by malicious hackers and shared online. No paperwork needed.

If you can't read/see the tweet, it says:

wow, the FBI used a stolen database of OGUsers from April to identify one of the people allegedly involved in the Twitter hack

The information is contained in the criminal complaint [PDF] against 19-year-old UK resident Mason John Sheppard, a.k.a. "Chaewon." Ironically, a forum used by social media account hackers was itself hacked, resulting in a stash of info investigators were able to access without having to approach the site directly. From the complaint:

On April 2, 2020, the administrator of the OGUsers forum publicly announced that OGUsers website was successfully hacked. Shortly after the announcement, a rival criminal hacking forum publicly released a link to download the OGUsers forum database, claiming it contained all of the forum’s user information. The publicly released database has been available on various websites since approximately April 2020. On or about April 9, 2020, the FBI obtained a copy of this database. The FBI found that the database included all public forum postings, private messages between users, IP addresses, email addresses, and additional user information. Also included for each user was a list of the IP addresses that user used to log into the service along with a corresponding date and timestamp.

I reviewed records and communications that are part of this publicly-released database. I also found that on February 4, 2020, Chaewon exchanged private messages on OGUsers with another user of the forum during which Chaewon made a purchase of a video game username and was instructed to send bitcoin to address 188ZsdVPv9Rkdiqn4V4V1w6FDQVk7pDf4 (hereinafter, “the Chaewon purchase address”).

From there, the FBI was able to track bitcoin transactions, locate Sheppard's email address, and use that additional information to obtain information from virtual currency exchanges, Binance and Coinbase. With all of this information, the FBI was able to connect "Chaewon" and other usernames to Mason Sheppard to locate him and charge him with assisting in the hacking and bitcoin scam.

No warrants were needed. The info from the forum hack was already in the public domain. Bitcoin transactions are considered financial records, standing outside of the Fourth Amendment's protections. Even if it would possibly be more prudent to directly approach websites with subpoenas or warrants to obtain records, it appears to be far easier to just access data obtained from malicious hacking. And there are companies out there compiling information from data breaches and malicious hackings and selling access to law enforcement agencies who feel judges and additional paperwork will just slow them down.

Filed Under: 3rd party doctrine, 3rd party information, fbi, hacking, mason sheppard, ogusers, twitter hack, warrant

DOJ And Florida Officials Announce Arrests Relating To Twitter Hack

from the that-didn't-take-long dept

This seemed fairly inevitable, after it became quite clear that the Twitter hack from a few weeks ago was done by teen hackers who didn't seem to do much to cover their tracks, but officials in Florida announced the arrest of a Florida teenager for participating in the hack, followed by the DOJ announcing two others as well -- a 19 year old in the UK and a 22 year old in Florida.

As for why the first announced was separate and done by Florida officials, it appears that it involved a 17-year-old, and apparently it was easier to charge him as an adult under state laws, rather than under federal law, as with the other two.

Hillsborough State Attorney Andrew Warren filed 30 felony charges against the teen this week for “scamming people across America” in connection with the Twitter hack that happened on July 15. The charges he’s facing include one count of organized fraud, 17 counts of communications fraud, one count of fraudulent use of personal information with over $100,000 or 30 or more victims, 10 counts of fraudulent use of personal information and one count of access to computer or electronic device without authority.

Hillsborough County Jail records show Clark was booked into jail shortly after 6:30 a.m. Friday.

Warren’s office says the scheme to defraud “stole the identities of prominent people” and “posted messages in their names directing victims to send Bitcoin” to accounts that were associated with the Tampa teen. According to the state attorney, the scheme reaped more than $100,000 in Bitcoin in just one day.

Once again, it's looking like we got incredibly lucky -- that it was just some young hackers mostly messing around, rather than anyone with serious ill-intent and the ability to plan something bigger. It now appears that Twitter's internal security controls were kind of a mess. Over 1,000 employees had access to the control panel that would allow people to make the changes that enabled the hack -- and even that some staffers and contractors somehow made it a game to abuse their powers to spy on users.

Once again, it seems that Twitter needs to fix up a lot of things on the security side, including figuring out how to do end-to-end encryption for direct messages.

Filed Under: doj, fbi, florida, hack, twitter hack

Holy Hell Were We Lucky That Twitter's Big Breach Was Just A Bunch Of SIM Swapping Kids; Can We Please Encrypt DMs Now?

from the not-great dept

Everyone is still sorting out exactly what happened last week with the big hack of Twitter in which a number of prominent accounts -- including those of Barack Obama, Elon Musk, Jeff Bezos, Apple, and Uber -- all tweeted out a Bitcoin scam, promising to double people's money if they sent Bitcoin to a specific wallet (which appeared to receive a little over $100k). However, from what has been reported so far, it appears we actually got fairly lucky and that it was mainly a bunch of SIM swapping social engineers who historically have focused on getting popular short usernames. If you're not familiar with all of this, the Reply All podcast had a fascinating episode about the scam last year.

Meanwhile, Vice has a post describing how the hackers involved convinced a Twitter employee, who had access to a Twitter control panel, to make changes for them. The guy who controls the (formerly Adrian Lamo's) Twitter account @6, provided some details on how the hack got around two factor authentication controls: within the control panel a new email address was added to the account, and then, from the control panel, the two factor authentication would be disabled. An alert would be emailed out about this -- but to the new email address. Brian Krebs provided some details about who he thought was behind all of this (and the connection to the SIM swapped hack of Jack Dorsey's account from last year). Finally, the NY Times scored an interview with the hackers themselves -- again, showing that it was just a crew of SIM swapping kids, mostly doing this for the lulz (and also suggesting that the person Krebs fingered was only peripherally involved, in that he'd made use of the same access to pick up Lamo's old @6 account, but didn't take part in the Bitcoin scheme).

The interviews indicate that the attack was not the work of a single country like Russia or a sophisticated group of hackers. Instead, it was done by a group of young people — one of whom says he lives at home with his mother — who got to know one another because of their obsession with owning early or unusual screen names, particularly one letter or number, like @y or @6.

The Times verified that the four people were connected to the hack by matching their social media and cryptocurrency accounts to accounts that were involved with the events on Wednesday. They also presented corroborating evidence of their involvement, like the logs from their conversations on Discord, a messaging platform popular with gamers and hackers, and Twitter.

What does become clear is that, from the details revealed so far, this wasn't some grand nefarious scheme. This was a bunch of kids having fun, who happened to get access to a control panel through some means or another.

At the very least, we should be thankful that's all this was. As multiple people I spoke to have said, we should be very, very, very glad that this was basically some kids having a laugh and hoping to make a little money, rather than a nation state wishing to start World War III. And while Twitter has not yet said if Direct Messages were accessed, from everything that's been revealed so far, it's pretty clear that whoever controlled these accounts easily had access to DMs.

And that should raise a bunch of questions.

While the hack was still going on, Senator Josh Hawley dashed off one of his infamous letters to Twitter CEO Jack Dorsey, asking a list of questions. Surprisingly, given Hawley's involvement and the usual inanity of his letters, this one was somewhat on point and asked a bunch of mostly reasonable questions:

Did this event represent a breach of users’ own account security or of Twitter’s systems?

Were accounts protected by two-factor authentication successfully targeted in this breach? If so, how was this possible?

Did this breach compromise the account security of users whose accounts were not used to share fraudulent posts? If so, how many accounts were affected? Were all accounts’ security compromised by this breach?

How many users may have faced data theft as a consequence of this breach?

What measures does Twitter undertake to prevent system-level hacks from breaching the security of its entire userbase?

Did this attack threaten the security of the president’s own Twitter account?

However, much more important is the key question asked by Senator Ron Wyden: why hasn't Twitter introduced end-to-end encryption for DMs, which would have prevented the ability for hackers to have read DMs under the circumstances described above.

"In September of 2018, shortly before he testified before the Senate Intelligence Committee, I met privately with Twitter's CEO Jack Dorsey. During that conversation, Mr. Dorsey told me the company was working on end-to-end encrypted direct messages. It has been nearly two years since our meeting, and Twitter DMs are still not encrypted, leaving them vulnerable to employees who abuse their internal access to the company's systems, and hackers who gain unauthorized access," Wyden said in a statement.

Of course, given all that, we should note that despite Hawley asking good questions, he's a bit of a hypocrite here, as he has attacked encryption for years, and is a co-sponsor of the EARN IT Act, which will endanger encryption. If Hawley actually wanted Twitter to better protect user privacy in their data, he should be supporting Wyden's push to have the company encrypt more, not less.

Filed Under: dms, encryption, josh hawley, ron wyden, sim swapping, twitter hack
Companies: twitter