 Tom here from Lawrence Systems, and we have some closure and some details of what happened with the Twitter attack So the speculation part started when everyone was thinking maybe there's something bigger going on this can't be as simple as some kids doing a Bitcoin scam or could it and Now that we have three people have been charged in this and been arrested and indictments have been issued and the Northern District of California the United States Attorney Office of that fell under jurisdiction So they have an entire all the write-ups and everything so we can dive into some of the details now We'll start here hackers tell the story of the Twitter attack from the inside this was posted in New York Times and it almost seemed implausible by those following the story that this could happen with such a large publicly traded company because what had happened at least according to this story, which people told me seemed implausible was They claimed that they were able to access through the slack messaging system now if you're not familiar with slack Slack is a very popular messaging platform used by a lot of companies And it is great for doing teamwork and coordinating projects and company private messaging is in there But private messaging if someone gets in there It means you probably don't want to keep your credentials stored in there And what they had said here in this article was Twitter's internal slack messaging channel Was compromised by this individual so they started with a spear phishing attack Which means they targeted an individual specifically someone who worked at Twitter. They got into this person's slack channel Basically impersonating that employee and found in there the company's high-level access the credentials pinned inside of this slack channel That is the equivalent to putting a post-it note on your monitor Only in this case of Twitter if they would have physically stuck a post-it note with the credentials on a monitor It would have been safer because someone would have had to physically come to that person's place of You know wherever they're working from to get those credentials instead They sent them some type of email that allowed them to impersonate being this Twitter employee that gave them access to a slack channel And the chaos ensued and what I mean chaos is essentially Literally as we found out from the indictments now that a 17-year-old was the ringleader of all this his name's been withheld because this person's a minor and They were not quite so clever and this was not exactly a sophisticated attack There is a lot of speculation was going on of this has to be almost maybe state-sponsored or maybe some type of high-level You know anti-government attack and Sophisticated hackers with amazing skills, but nope. It's a kid in Florida and Is much as they thought this might be fun the fun came to an end because according to federal agents He had they had used a personal driver's license to verify themselves with Binance and Koi based cryptocurrency exchanges And these were the cryptocurrency exchanges where once they had posted after compromising all these accounts on Twitter They had posted bitcoins address saying to send money people did indeed send money And then they pulled the money out through because when you want to convert Bitcoin back into actual like US dollar currency For example, that's what these currency exchanges do and they had registered with their own driver's license So they were smart enough to figure out who worked at Twitter and target that individual and gain access then discovered that they had access to basically all of Twitter in God mode and Then came up with a scam to launch some bitcoins that has now landed them And I'll leave links to all this where you can find and read through the details in more depth if you would like but Organizational fraud one count communications fraud 17 count fraudulent use of personal information 30 more victims one count fraudulent use of personal information 10 counts access to computer and electronic device without authority one count penalty sheets Five years on computer intrusion So if they would have stopped at the shenanigans of computer intrusion and being curious and poking around which is really Where a lot of hackers start they go let's poke around. I just am curious about things But they went a lot further. They went so deep that they decided to Commit financial fraud once they stepped into the money laundering conspiracy wire fraud and conspiracy and committed that type of fraud That was going to get them to 20 plus years in prison and of course this being such a large public act and a very Notable one because of all the celebrities and public figures that took over their Twitter accounts to do this They're likely going to not get light or lenient sentencing on here now one of the three is from the uk So i'm going to guess extradition may be happening there, but they got them They're in trouble the hack was not very sophisticated and of course Almost embarrassing for twitter because it sounds like when the court trial comes out in the details when people will be watching When we get a reasonable debrief of whatever incidents and everything that led up to this We're probably going to find a more disappointment in laughs and security And this happens all the time man. We don't just see this at small businesses. We see this all the way up the corporate ladder This could have been mitigated. This should have not been pinned credentials These level of access granted by these credentials should have been on a lockdown having a better compartmentalized method Practicing principles of lease privilege that would have solved much of this and mitigated it Of course the spearfishing. I mean you can get spearfished This is if someone's really targeting and sending emails that look very legitimate to you Um, they're they have a high success rate with these That's why you have to make sure and this applies to all businesses because this is happening at such a rapid rate these days That what level of access someone has is only what they need access to and not necessarily everything And hopefully any type of high level passwords or high level functions an employee may have access to Especially in the case of this twitter They should have another factor On top of those credentials where maybe it's authorized by a secondary person That way two people kind of take a second look at it because that'll bring up a few more questions And these type of processes do scale like I said even to the small business level So it's always something you have to be very aware of be very thoughtful of is that email? Should I click on it? Is that real and yes, even companies as big as twitter? We've just got some insight into a publicly traded company that yes, they probably didn't have the best security practices But I'll leave links where you can read all the details and the indictments will follow the story kind of as it goes And I thought it was interesting that it wasn't quite as clever as people thought and even a company size of twitter Still sometimes just sticks them on a post-it note even if they're just pinning it in Uh a slack channel. All right. Thanks And thank you for making it to the end of the video If you like this video, please give it a thumbs up If you'd like to see more content from the channel, hit the subscribe button and hit the bell icon If you like youtube to notify you when new videos come out If you'd like to hire us head over to laurancesystems.com fill out our contact page And let us know what we can help you with and what projects you'd like us to work together on If you want to carry on the discussion head over to forums.laurancesystems.com Or we can carry on the discussion about this video other videos or other tech topics in general Even suggestions for new videos. They're accepted right there on our forums, which are free Also, if you like to help the channel in other ways head over to our affiliate page We have a lot of great tech offers for you. And once again, thanks for watching and see you next time