Scourge · July 15 2020

The Scourge of the Doubled Bitcoin

Chronicle

On 15 July 2020, after phone spear-phishing Twitter employees until they reached internal admin tools, attackers targeted 130 high-profile accounts and posted from 45 of them. The same promise came from Barack Obama, Joe Biden, Elon Musk and Apple: send bitcoin and we'll send back double. The scam collected about $117,000 before Twitter froze tweeting by all verified accounts. A 17-year-old from Florida and two other young men were charged.

Lesson learned

It showed that internal admin tools are the keys to the kingdom and that the telephone remains one of the most effective attack channels.

Prayer of reparation

O doubled bitcoin, miracle that never happens, let no one believe those who promise to multiply money, and let admin panels always ask for a second confirmation. Amen.

How it is remembered

Remembered by limiting who can use admin tools, requiring hardware security keys and distrusting anyone who phones asking for credentials "for IT".