What the PM Modi Twitter breach tells us about hackers

Last weekend some smart alecks managed to breach the defenses of one of the most ubiquitous media platforms, access the mouthpiece of the leader of one of the world’s most populous countries, and grab the opportunity to broadcast whatever they wanted to 73 million followers. And they used it to pump cryptocurrency.

It’s almost laughable that yet another Twitter Inc. hack — this time on the account of Indian Prime Minister Narendra Modi — should once again become the vehicle for spruiking Bitcoin. “India has officially adopted bitcoin as legal tender,” the tweet sent by hackers from his account read. “The government has officially bought 500 BTC and is distributing them to all residents of the country.”

As implausible as that message sounds, the entire incident — from exploit to outcome — tells us a lot about hacking culture and the variety of actors out there trying to break into computer systems.

What’s immediately obvious about this specific event is that the perpetrators were more mischievous than malicious. Pitching Bitcoin has become the Rick Roll of the hacking community — a funny prank rather than a nasty attack.

It’s not the first time.

In July 2020 more than 100 famous accounts were breached including those of Barack Obama, Joe Biden, Bill Gates, Elon Musk, Kanye West and Apple Inc. Once they got access, the attackers went on to promote a Bitcoin scam to millions of these victims’ followers.

The details of that incident are dripping with delicious irony. First up, the hackers’ use of Bitcoin was in fact their undoing — U.S. law enforcement officers tracked down the cryptocurrency accounts and found that they’d used their driver’s licenses for authentication. And, the breach was conducted through old-fashioned social engineering — tricking Twitter staff into giving login credentials, which allowed access to the target accounts.

Finally, true to hacker form, two of them were teenagers, one of whom was underage. Youngsters pulling off epic hacks is a time-honored tradition. Kevin Mitnick, the most infamous of them all, was just 16 when he broke into Digital Equipment Corp.’s systems in 1979 and stole software. Jonathan James, purportedly the first juvenile imprisoned for cybercrime, was 15 when he got going and added the Department of Defense to his list of victims.

Yet since Mitnick and James rose to fame decades ago, the goal of network penetration has gone from scamming cheap long-distance calls to shutting pipelines and destroying centrifuges used in weapons production. And it’s likely that more hacks go unnoticed or unreported than those we hear about.

So even though this was a prank — a somewhat well-trodden one at that — there is a serious side to it. It should be of grave concern that one of the most powerful outlets in the world was once again breached, allowing unauthorized access to the media equivalent of the nuclear codes. Musk, the chief executive officer of Tesla Inc., has made cryptocurrency and equity markets swing by billions of dollars with a few choice words.

Am considering taking Tesla private at $420. Funding secured.

— Elon Musk (@elonmusk) August 7, 2018

One can only image what might have happened if the Twitter account of the democratically elected leader of an increasingly authoritarian government decided to declare a second demonetization or an escalation of its conflicts with China or Pakistan. We should be thankful that the attackers chose Bitcoin as the subject of their tweets, not economic or military destruction.

The world might not be so lucky next time. A few hacks of Twitter has proven to the rest of the community that this is a target with vulnerabilities, and others — possibly with state backing or terrorist links — will think of better ways to abuse that weakness than promoting crypto scams. And clearly Twitter itself continues to drop the ball on the fundamental task of keeping its system robust as it balances usability with security.

May we laugh and appreciate the prankster nature of the best hackers around. But let’s keep in mind that breaching social media is all fun and games until someone gets hurt.