![\"Twitter](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/06\/fileless-malware-mod.jpg\")
<\/p>\n<\/p>\n
What happened at Twitter was a cyber attack almost unprecedented in scope and publicity. One of the largest social media platforms in the world suffered at the hands of as-yet-unknown hackers.\u00a0<\/span><\/p>\n The full effects of the hack continue to reverberate. To learn a little more and gain a fresh perspective<\/a> on the attack, we turn to Sivan Omer, Product Manager of <\/span>empow<\/span><\/a>.<\/span><\/p>\n By Sivan Omer, Product Manager of<\/span><\/i> empow.<\/span><\/i><\/a><\/p>\n COVID-19 is causing immeasurable hardship around the world, and many people are facing sudden personal or financial ruin. Good people are trying to help, and we\u2019re seeing an increase in donations\u2014the<\/span> LA Times<\/span><\/a> called the increase in charity \u201coff the charts.\u201d Most of the donations are done through crowdfunding sites and social media initiatives that target people with a history of donating.<\/span><\/p>\n The dark side of this targeting is similar to social engineering conducted by bad actors, trying to get people to divulge information or take action.<\/span><\/p>\n It\u2019s hard to fathom that hackers are taking advantage of people\u2019s kindness in this global catastrophe but, unfortunately, they\u2019re hard at work. Cybercriminals will do anything to accomplish their goals, unhindered by things like morals. One of the ways for them to achieve their goals is to communicate around topics that are relevant to the target audience.\u00a0\u00a0\u00a0<\/span><\/p>\n Let\u2019s take for example the brazen<\/span> Twitter<\/span><\/a> attack last week, in which the profiles of Joe Biden, Barack Obama and other very high profile users were taken over, earning the attackers $120,000 in Bitcoin and causing immeasurable damage to Twitter\u2019s reputation, not to mention posing a threat to democracy in an era when the President of the United States tweets out policy regularly. In picking such high-profile targets, it\u2019s clear the attackers wanted to create an immediate impact and reach a large audience within seconds, even at the cost of the attack being quickly mitigated.<\/span><\/p>\n Twitter shared: \u201cWe detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.\u201d According to<\/span> The Verge<\/span><\/a>, the near-simultaneous account takeovers of a number of highly sensitive Twitter accounts\u2014<\/span>including those of presidential candidates and those with two-factor authentication enabled<\/span><\/a>\u2014suggest the attackers did not simply exploit individual account owners and had at the very least indirect access to employee tools.<\/span><\/p>\n To get insider access like this, hackers use different techniques like emails, social media, and SMSs to fool users. One of the known techniques is<\/span> Spearphishing<\/span><\/a>: sending an email to specific and well-researched targets while purporting to be a trusted sender to gain initial access into the victim\u2019s systems. Such an email may include either an attachment carrying exploit code or a link to a malicious website.\u00a0<\/span><\/p>\n If the victim believes this email is legitimate and opens the attachment or clicks on the link, the exploit code executes and compromises the system. It can also download additional tools such as a RAT (Remote Access Tool) to take complete control of the user\u2019s system.<\/span><\/p>\n Once the attacker gains control of the end user\u2019s system, they can now attack other systems on the internal network and steal data. The data can then be exfiltrated to offshore servers managed by the attacker over a different protocol than that of the existing command and control channel. This kind of attack technique is called Exfiltration Over Alternative Protocol.<\/span><\/p>\n To secure your organizations from this type of attack a number of different actions need to be taken. Firstly, it\u2019s important to raise awareness among the company employees to attacks like social engineering, Browsing, Ransomware, and Advanced Persistent Threat. Second, the organization needs to equip itself with effective technological solutions.<\/span><\/p>\n From the technology side, the key lies in a security analytics layer that will be able to identify abnormal behavior including insider behavior using internal organizational tools\u2014but with potentially malicious intent\u2014and correlate it together with other alerts and indications coming from other security technologies. This approach would protect organizations in the best possible way, while quickly identifying attacks and prioritizing entities at risk, or in the Twitter case \u201caccounts\u201d, that require immediate attention.\u00a0\u00a0<\/span><\/p>\n One of the best platforms that would enable this level of protection is a Next-Generation SIEM (NG-SIEM), one that includes built-in behavioral analysis capabilities and the ability to automatically connect the dots between all the steps described above and raise a red flag to the team about a potentially high-risk attack, while it\u2019s still possible to stop it.<\/span><\/p>\n An effective NG-SIEM can neutralize the problem of \u201csiloed\u201d security tools that don\u2019t know how to \u201ctalk\u201d to one another, a major pain point for security teams.\u00a0<\/span><\/p>\n Without having insider knowledge, it\u2019s safe to assume Twitter has at its disposal the most advanced security tools available today, probably including a next-generation SIEM or a data lake analytics platform that they built on their own. But organizations of this size and complexity can be especially vulnerable to the \u201csilos syndrome\u201d\u2014what probably happened was that different security groups and technologies \u201csaw\u201d different aspects of the attack, but the big picture was missed because all the information was not fed into one \u201cbrain.\u201d<\/span><\/p>\n Surely Twitter is now working on ways to better protect public accounts (<\/span>one conjecture<\/span><\/a> is that Trump\u2019s profile wasn\u2019t hacked because there were special protections in place for it due to past attempts, Twitter is likely planning to use them more widely). An effective advanced SIEM, or a security analytics system that includes the required capabilities, can help organizations avoid the massive damage suffered by Twitter in this latest high-profile attack.<\/span><\/p>\n Thanks to By Sivan Omer, Product Manager of<\/span><\/i> empow<\/span><\/i><\/a> for her time and expertise. Learn more in our SIEM Buyer\u2019s Guide<\/a>.\u00a0<\/span><\/i><\/p>\n What happened at Twitter was a cyber attack almost unprecedented in scope and publicity. One of the largest social media platforms in the world suffered at the hands of as-yet-unknown hackers.\u00a0 The full effects of the hack continue to reverberate. To learn a little more and gain a fresh perspective on the attack, we turn […]<\/p>\n","protected":false},"author":41,"featured_media":2607,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[353,95,145,112,86,1131,1355,21,57,22,108,1356],"acf":[],"yoast_head":"\n
Widget not in any sidebars
\u00a0\u00a0\u00a0<\/span><\/p>\nPhishing Has Been Around for a Long Time. Why Did Twitter Fall for It?<\/b><\/h3>\n
<\/div>\n
Widget not in any sidebars
\u00a0\u00a0\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"