Pierluigi Paganini
December 28, 2017
The official Twitter account of legendary security expert John McAfee was hacked today, attackers used it to send several tweets promoting alternative cryptocurrencies like Siacoin, NXT, XRP, PTOY, and BAT.
At the time of writing, there aren’t further info related to the attack, John McAfee explained that its account was protected with a two-factor authentication process.
This suggests that the attackers have found a way to obtain the authentication code sent by Twitter, this is possible by compromising the mobile device or via an SS7 attack.
In this latter scenario, hackers can exploit a flaw in the SS7 protocol to steal the victim’s identity on the messaging services with just basic skills.
The principal instant messaging services, including WhatsApp and Telegram, rely on the SMS authentication as the primary security verification mechanism, which is routed through SS7 signalling. This means that hackers exploit the SS7 to compromise the verification mechanism and take over the victim’s account and impersonate him.
According to McAfee, someone has compromised his smartphone.
If it can affect me it can affect anyone. Most likely my phone was compromised
— John McAfee (@officialmcafee) December 28, 2017
Urgent: My account was hacked. Twitter has been notified. The coin of the day tweet was not me. As you all know… I am not doing a coin of the day anymore!!!!
— John McAfee (@officialmcafee) December 27, 2017
“The first indication that I had been hacked was turning on my cell phone and seeing the attached image,” he told BBC.
“I knew at that point that my phone had been compromised.” he added
“I was on a boat at the time and could not go to my carrier (AT&T) to have the issue corrected.
“All that the hacker did was compromise my Twitter account. It could have been worse.”
John knows very well that he is a privileged target of several types of attackers, including haters.
Though I am a security expert, I have no control over Twitter's security. I have haters. I am a target. People make fake accounts, fake screenshots, fake claims. I am a target for hackers who lost money and blame me. Please take responsibility for yourselves. Adults only please.
— John McAfee (@officialmcafee) December 28, 2017
The reality is that is not complex for a persistent attacker to compromise your social media account.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – John McAfee, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
