A look at Twitter's hack on July 15, the drastic changes it made in the immediate aftermath, and its plans to prevent an Election Day meltdown

Wired 2020-09-25

Context & Ripple Effects

Two months after the July 15 takeover of high-profile accounts, the picture of how it happened has firmed up: Twitter's own updates traced the breach to a phone spear-phishing attack on a small number of employees, while reporting suggested the attackers may have reached the internal dashboard via credentials pinned in a Slack channel. At the time, commentators warned the incident had profound national security implications — a compromised world-leader account was no longer unthinkable.

First-order effects

Twitter is locking down its internal tools and reshaping employee access after admitting the breach ran through its own staff, not a platform vulnerability — the people with dashboard access become the perimeter.

Second-order effects

Every social platform now faces pressure to prove its own admin-tool chain can survive a targeted phishing run, since Twitter demonstrated that one phoned-in credential can compromise any verified account at scale.

Third-order effects

With Election Day approaching, the pattern points toward insider-access controls becoming a regulatory and national-security concern for platforms whose accounts double as official channels for governments — the July 15 attack served as the proof of concept.

The trend: Platform security is shifting from defending against outside attacks to controlling privileged insider access, with election integrity as the forcing deadline.

Discussion

Twitter Twitter on x
Our continued work to keep Twitter secure
@twittersupport @twittersupport on x
Today we're sharing more information about the way we work and the tools and technology we use to ensure Twitter is secure. ⬇️ https://blog.twitter.com/...
@brbarrett Brian Barrett on x
How broken was Twitter during its July 15 meltdown? Very! https://www.wired.com/... https://twitter.com/...
@codinghorror Jeff Atwood on x
I read this and all I can think is “Twitter employees are not using hardware 2fa and that is insane” https://www.wired.com/...
@ericgeller Eric Geller on x
Interesting article about how Twitter scrambled to respond to the July 15 hack. Imagine this process rippling out through the entire organization. The scale of the disruption allegedly caused by a Florida teenager is remarkable. https://www.wired.com/... https://twitter.com/...
@racheltobac Rachel Tobac on x
Twitter Hack Update: many of the updates we mentioned in our Twitter hack discussions online have made it into their security protocols: reduce admin privileges, hardware MFA, detect abnormal behavior patterns on admin panel (like changing 15+ emails per hour), training, and more…
@kayvz Kayvon Beykpour on x
Since our security incident in July, we've been working nonstop to rework and improve our security and privacy practices to keep our customers safe and ensure the integrity of our internal systems. Here's some more more detail on the work we're doing: https://blog.twitter.com/...
@nxthompson @nxthompson on x
Twitter was completely compromised in July. Can it survive November? @brbarrett and I dug in deep into their response (including making every single person reset passwords on video with boss!) and how they're trying to make things safer. https://www.wired.com/...

Chronicles