Twitter Hacked: The Golden Age of Social Engineering

In a series of tweets posted on Twitter’s support account, the company revealed that hackers compromised its internal systems. Twitter admitted that the attack could have been conducted only with access to the company’s internal tools, including employee privileges.

The company described it as a case of ‘social engineering’, where a hacker uses psychological manipulation to trick someone into giving away their login credentials or other sensitive information.

According to Ponemon Institute’s study on the cost of a data breach, negligence by employees or contractors contributed to 63% of insider security incidents. According to the study, the average global cost of ​Insider Threats​ has risen by ​31% since 2018 and amounts to $11.45 million. The frequency of incidents spiked by ​47%​ over the same time period. The study also found that the average cost of rectifying an incident caused by user negligence is $307,111.

Social engineering attacks make use of almost any means of communication, but most are carried out over a phone call, email, social media, or text message

“The scale of the incident just proves that even a company as large as Twitter can be vulnerable, and that no enterprise is completely safe in the virtual world. Security should be at the top of the corporate agenda, as it is also a cost-effective way for enterprises to reduce risks. Confidential data, intellectual property, and digital systems are only as secure as their weakest users. Without a security awareness program, risk management strategies can become less effective,” explained Juta Gurinaviciute, Chief Technology Officer at NordVPN Teams.

Companies also need to enforce multi-factor authentication (MFA). Even with such security measures as antivirus software, firewall, encryption technology, and regular vulnerability tests, a perpetrator can bypass them all if there is no MFA. And even then, Twitter’s recent case proves that social engineering can still cause a breach. However this is a low complexity and easy addition which should be taken seriously.

Companies like Gartner recommend implementing Zero Standing Privileges as part of a company’s defense strategy. This means that a user is granted an access privilege only for a particular task and only for a time needed to complete it. Afterwards, the privilege is rescinded. If the user’s credentials get compromised, even an insider perpetrator will not have immediate access to the business’s data and systems.

According to the NordVPN Teams expert, social engineering and unpatched software will remain the top two root causes of successful exploits, as they have been for more than 30 years.

“As the Twitter attack has received so much attention from the press, there might be many attempts to copy the attack. Some will target social media platforms, but others might go even further. For example, the healthcare industry could become a prime target. In fact, hackers have already started targeting healthcare providers and research labs in attempts to gain access to vaccine research. Cybercriminals capitalize on instability, which is one reason why social engineering attacks are on the rise during COVID-19,” the NordVPN Teams expert concluded.