[www.theverge.com]

Early on July 31st, the FBI, IRS, US Secret Service, and Florida law enforcement placed 17-year-old Graham Clark of Tampa, Florida, under arrest. He’s accused of being the “mastermind” behind the biggest security and privacy breach in Twitter’s history, one that took over the accounts of President Barack Obama, Democratic presidential candidate Joe Biden, Bill Gates, Elon Musk, Kanye West, Apple, and more to perpetrate a huge bitcoin scam on July 15th.

Apparently, he wasn’t alone: shortly after the Tampa arrest was revealed and after we published this story, two more individuals were formally charged by the US Department of Justice: 22-year-old Nima Fazeli in Orlando and 19-year-old Mason Sheppard in the UK. They go by the hacker aliases “Rolex” and “Chaewon,” respectively, according to the DOJ. The FBI says that two individuals in total are in custody. An unidentified minor in California also admitted to federal agents that they’d helped Chaewon sell access to Twitter accounts.

But according to an affidavit released late Friday, authorities have probable cause to believe Clark, the Tampa teen, was the one who got access to Twitter’s internal tools and directly carried out the scam. Specifically, he allegedly convinced a Twitter employee that he worked in the Twitter IT department and tricked that employee into giving him the credentials.

From the affidavit:
To wit: Clark without authorization gain [sic] access to Twitter Inc.’s Customer Service Portal. Clack used social engineering to convince a Twitter employee that he was a co-worker in the IT department and had the employee provide credentials to access the customer service portal.

Clark then accessed the Twitter accounts of prominent individuals, including VP Joe Biden, former President Barack Obama and business [sic] such as Apple and Coinbase. Clark then posted on their Twitter accounts a communication that if Bitcoins are sent to accounts they will be doubled and returned to the victim. Clark did not return the funds and he moved the funds to another account. 10 prominent people had their personal identification information in the form of a verifide [sic] Twitter Account use without consent be used [sic] in the fraudulent activity. Clark received approximately $117,000 during the commission of his scheme to defraud.

How Twitter’s systems were accessed had been an open question; Twitter merely said that it fell victim to a “phone spear phishing attack”, and previous reports suggested the hacker either found their way into Twitter’s internal Slack channel or managed to bribe an employee.

According to federal agents, Sheppard was found out partly because he used a personal driver’s license to verify himself with the Binance and Coinbase cryptocurrency exchanges, and his accounts were found to have sent and received some of the scammed bitcoin. Fazeli also used a driver’s license to verify with Coinbase, where accounts controlled by “Rolex” allegedly received payments in exchange for stolen Twitter usernames.

---

Ways to improve web conference image and sound quality. [forums.macresource.com]

An old friend of mine is a tech guy in Tampa. I sent him a link to this story with the note, "I've got bad news about your new intern..."

If they don't allow plea bargains, looks like it would add up to forever in prison. Federal laws don't allow for early release either.

---

********************************************
The police have no duty to respond. See Castle Rock v. Gonzales, 545 U.S. 748 (2005) or Warren v. District of Columbia[1] (444 A.2d. 1, D.C. Ct. of Ap. 1981)



Edited 1 time(s). Last edit at 08/01/2020 02:44PM by Racer X.

Federal laws don't allow for early release either.


Not entirely accurate.

While formal parole is no longer possible in the federal prison system, It is been possible during sentencing for a federal judge to allow for conditional early release, aka supervised release.

It's served at the end of the sentence and while in effect, its conditions can be changed by the courts.

It's also possible to earn good behavior credit to reduce time served.

So while there are no formal parole proceedings available, there is still a little wiggle room for early release.

---

When a good man is hurt,
all who would be called good
must suffer with him.

Everybody matters or nobody matters.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

-An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

Mister, that's a ten-gallon hat on a twenty-gallon head.

I *love* SIGs. It's Glocks I hate.

Didn't know that!

Aren't there now international guidelines on sentancing for computer crimes, because the Internet has no borders? Your ass may be in a chair in Miami, but you are hacking through servers in other countries for example.

---

********************************************
The police have no duty to respond. See Castle Rock v. Gonzales, 545 U.S. 748 (2005) or Warren v. District of Columbia[1] (444 A.2d. 1, D.C. Ct. of Ap. 1981)

how did they hack it? did these people use simple passwords or did the find a security flaw in the software?

Quote
space-time
how did they hack it? did these people use simple passwords or did the find a security flaw in the software?

The ‘hackers’ didn’t need to do anything sophisticated:

“Specifically, he allegedly convinced a Twitter employee that he worked in the Twitter IT department and tricked that employee into giving him the credentials.

The guy just called up someone in Twitter IT and essentially said, “Give me your username and password because...,” and the IT fellow did just that.

---

Saint Cloud, Minnesota, where the weather is wonderful even when it isn't.

Quote
space-time
how did they hack it? did these people use simple passwords or did the find a security flaw in the software?

Looks like an elaborate scheme to appear as employees.

---

Ways to improve web conference image and sound quality. [forums.macresource.com]

Quote
Speedy

Quote
space-time
how did they hack it? did these people use simple passwords or did the find a security flaw in the software?

The ‘hackers’ didn’t need to do anything sophisticated:

“Specifically, he allegedly convinced a Twitter employee that he worked in the Twitter IT department and tricked that employee into giving him the credentials.

The guy just called up someone in Twitter IT and essentially said, “Give me your username and password because...,” and the IT fellow did just that.

And they managed to do that for every account???

No, that just gave them access to the necessary internal software tools, with which it was trivial to access any Twitter user account.

Quote
Speedy

Quote
space-time
how did they hack it? did these people use simple passwords or did the find a security flaw in the software?

The ‘hackers’ didn’t need to do anything sophisticated:

“Specifically, he allegedly convinced a Twitter employee that he worked in the Twitter IT department and tricked that employee into giving him the credentials.

The guy just called up someone in Twitter IT and essentially said, “Give me your username and password because...,” and the IT fellow did just that.

I'd hardly call that hacking. I'm not even sure that all the charges they leveled could be considered valid given what transpired.

This is like charging someone with aggravated armed robbery of a federal bank when what they really did was a call a 1-800 number for cardmember services and convince them to reset a pin and issue a new card and use the card and pin in an ATM machine at a gas station to withdraw a couple grand.

I also cannot believe there are people smart enough to know how bitcoin works but dumb enough to fall for this.

---

C(-)ris
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Throwback Thursday Signature:




Edited 1 time(s). Last edit at 08/02/2020 03:09PM by C(-)ris.

I'd hardly call that hacking.


The term seems to get more and more diluted as time goes on.

Look at all the household hints that are now called 'hacks' by some people.

Cab drivers must be incensed.



I'm not even sure that all the charges they leveled could be considered valid given what transpired.


The major charges refer to hacking the accounts, which will stand regardless of how it was accomplished.

It's common to charge an offender at the time of arrest with every possible iteration and aspect of any and every crime believed to be committed. This keeps bail high until set by the court.

It's up to the charging DA to determine what charges will actually be filed and prosecuted. 'Lesser included' offenses are usually dropped at filing time and the sum total may include plea deals worked out with defense counsel.

Maybe the kid will do a couple years, then land a fat security gig after release, and live the dream.

---

When a good man is hurt,
all who would be called good
must suffer with him.

Everybody matters or nobody matters.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

-An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

Mister, that's a ten-gallon hat on a twenty-gallon head.

I *love* SIGs. It's Glocks I hate.

Quote
space-time
how did they hack it? did these people use simple passwords or did the find a security flaw in the software?

One version of the story has them bribing someone who had admin access for the password. Allegedly, there have been a few similar incidents in the past, just not at this scale.

---

They also hacked Trump's Twitter, but no one noticed...