Over 1,000 people at Twitter had ability to aid the hackers


More than 1,000 employees and contractors at Twitter, as of earlier this year, had access to tools that could change user account settings and hand control over others, two former employees have said.


  • Two former employees at Twitter claim that more than 1,000 employees and contractors had access to internal tools that change user settings
  • Twitter and the FBI are investigating the crime

The social media giant and the Federal Bureau of Investigation are investigating the breach that allowed hackers to repeatedly tweet from verified accounts of the likes of Democratic presidential candidate Joe Biden, Microsoft co-founder Bill Gates, Tesla CEO Elon Musk and former New York City Mayor Mike Bloomberg.

Twitter said on Saturday that the perpetrators “manipulated a small number of employees and used their credentials” to log into tools and turn over access to 45 accounts. On Wednesday, it said that the hackers could have read direct messages to and from 36 accounts but did not identify the affected users.

The former employees familiar with Twitter security practices said that too many people could have done the same thing, more than 1,000 as of earlier in 2020, including some at contractors like Cognizant.

Twitter declined to comment on that figure and would not say whether the number declined before the hack or since. The company was looking for a new security head, working to better secure its systems and training employees on resisting tricks from outsiders, Twitter said. Cognizant did not respond to a request for comment.

Related Article:  India asks ISP's to block banned Chinese apps

“That sounds like there are too many people with access,” said Edward Amoroso, former chief security officer at AT&T. Responsibilities among the staff should have been split up, with access rights limited to those responsibilities and more than one person required to agree to make the most sensitive account changes.

“In order to do cyber security right, you can’t forget the boring stuff.”

Threats from insiders, especially lower-paid outside support staff, are a constant worry for companies serving large numbers of users, cyber security experts said. They said that the greater the number of people who can change key settings, the stronger oversight must be.


The two former employees stated that Twitter had improved in the logging the activity of staff and contractors in the wake of previous incidents, including searches of records by an employee accused back in November of spying for the Saudi Arabian government.

But while logging helps with investigations, only alarms or constant reviews can turn logs into something that can prevent breaches.

Former Cisco Systems Chief Security Officer John Stewart said companies with broad access need to adopt a long series of mitigation and “ultimately ensuring that the most powerful authorised people are only doing what they are supposed to be doing.”

Related Article:  EU top court to rule in landmark Facebook case

Who exactly pulled off the hacking spree isn’t clear, but outside researchers such as Allison Nixon of Unit 221B say the incident appears linked to a cluster of cyber-criminals who regularly traded in novelty handles especially rare two character account names, that are often treated a bit like the vanity license plates of the online world.

Although the public evidence tying the hacking to those was circumstantial, ultra-short Twitter handles were among the first to be hijacked.

In addition, the forums where those hackers were active have long been replete with boasts about having access to Twitter insiders, according to Nixon and Nick Bax, an analyst with StopSIMCrime, a group that lobbies for greater protection against “SIM swapping” – a phone number hijacking technique often used by these kinds of hackers.

Bax said he had seen reference on forums to “Twitter plugs” or “Twitter reps” – the terms used to describe cooperative Twitter employees – since as far back as 2017.

The potential involvement of low-level cyber-criminals has particularly alarmed professionals because of the implication that a hostile government might be able to cause even greater havoc.

Related Article:  US cybersecurity experts see recent spike in digital espionage from China

Access to accounts for national leaders was limited to a much smaller number of people after a rogue employee briefly deleted President Donald Trump’s account two years ago. That could explain why Biden’s account was hijacked but not Trump’s.

Twitter should expand the number of protected accounts, said former Twitter security engineer John Adams. Among other things, accounts with more than 10,000 followers should at least need two people to change key settings.

Security experts said they were worried that Twitter has too much work to do and too little time before the campaign for November’s US election intensifies, with potential inference domestically and from other countries.

Said Ron Gula, a cyber-security investor who co-founded network security company Tenable, “The question really is: Does Twitter do enough to prevent account takeovers for our presidential candidates and news outlets when faced with sophisticated threats that leverage whole-of-nation approaches?”

On a call to discuss company earnings on Thursday, Twitter Chief Executive Jack Dorsey acknowledged past missteps.

“We fell behind, both in our protections against social engineering of our employees and restrictions on our internal tools,” Jack Dorsey told investors.

Via our content partners at Reuters. Reporting by Joseph Menn and Katie Paul in San Francisco and Raphael Satter in Washington. Editing by Greg Mitchell and Grant McCool.

Share This Post