Assessment Solutions on Analyse Twitter Bitcoin Scam: COMP7059

Preview text

Running head: -TWITTER BITCOIN SCAM
TWITTER BITCOIN SCAM
Name of the Student
Name of the University
Author Note
1 TWITTER BITCOIN SCAM
Table of Contents
1. Introduction: ………………………………………………………………………………………………………….. 2
2. Anatomy of the Attack: …………………………………………………………………………………………… 3
3. Impact analysis: ……………………………………………………………………………………………………… 7
4. Recommended approach: ……………………………………………………………………………………….. 10
5. Conclusion: ………………………………………………………………………………………………………….. 12
6. References: ………………………………………………………………………………………………………….. 13
2 TWITTER BITCOIN SCAM
1. Introduction:
A teenager residing in the United States had carried out a scam that included the
hijacking of all the different Twitter accounts belonging to the famous personalities. This
particular scam had been known as the Bitcoins scam due to the existence of the fact that the
victims of this particular scam had been asked to provide donations in the form of bitcoins
that was supposed to go to aproject related to Covid-19 (Witman and Mackelprang 2022 ).
With respect to this, multiple media sources such as the likes of twitter moved forward to
make confirmations that the hacker had specifically gained the access for the required
administrative tools belonging to twitter for carrying out the necessary alteration within the
accounts that belonged to the celebrities. Billionaires Elon Musk, Jeff Bezos and Bill Gates
are among many prominent US figures targeted by hackers on Twitter in an apparent Bitcoin
scam.
In reference to this, the following document has been prepared with respect to the
aspects to cyberpsychology where the chosen attack will be appropriately analysed and at the
same time the attack has been discussed with respect to the chosen methods of social
engineering that has been effectively used by the hacker to perform the attack. Twitter said it
was a “co-ordinated” attack targeting its employees “with access to internal systems and
tools”.
In addition to this, the following document will also put forward abrief overview and
anatomy associated with the attack utilizing aframework that belongs to social engineering.
Along with this, the discussion is aimed at identifying the technical aspects of the attack and
at the same time will ensure abetter understanding of the risks that led to the cause of this
particular attack (Conger 2021 ). This has been followed by appropriate recommendations
made for enhancing the security in respect to the attack an at the same time to ensure such
attacks do not take place in near future.
3 TWITTER BITCOIN SCAM
2. Anatomy of the Attack:
A specific cyber attack had been identified on 15 thof July, in the year 2020 where the
hack was carried out by ateenager at that time, Graham Ivan Clark. He was a17 years old
teenage who moved forward to carry out the attack where the associated targets were the
celebrities present on the social networking platform (Zhongming et al.2020 ). The targeted
victims had been sent aspecific twitter message that contained the likely information of a
project that was supposed to be carried out in relation to covid-19 and requested them to
make necessary donations in the form of bitcoins or any other suitable form of
cryptocurrency.
Following this, all the celebrities provided their donation for the social cause, which
gathered atotal of $117,000 in the form of cryptocurrency that again led to the hacking of
accounts for famous celebrities such as the likes of Kim Kardashian West, Kayne West, Elon
Musk as well as Barack Obama. According to the reports as shared by twitter following this
attack, nearly the twitter accounts of 130 people had been hacked and 45 among the lot had
been used specifically for the scam message and its spread. Meanwhile, Twitter chief
executive Jack Dorsey tweeted: “Tough day for us at Twitter. We all feel terrible this
happened.”
The primary method that had been technically used for carrying out the hacker was a
Social Engineering method. Social engineering is the term used for a broad range of
malicious activities accomplished through human interactions. This method utilizes
psychological manipulation to trick users into making security mistakes or giving away
sensitive information. Internally existing authenticated access had also been gained within the
existing systems at twitter to integrate the necessary changes within the settings of the
account through administration access (Yurtseven ,Bagriyanik and Ayvaz 2021 ). According
to the chosen framework for social engineering attack, the primarily existing phase of social
4 TWITTER BITCOIN SCAM
engineer attack specifically referred to the procedure of a specific attack formulation in
particular terms.
Specific observations had been followed with the help of a digital forensic
investigation, which was anecessary consideration to be carried out to evaluate the technical
as well as the psychological focus upon the attack that had been carried out. The twitter
bitcoin scam was aresult of relying upon human error, rather than vulnerabilities in software
and operating systems. Mistakes made by legitimate users are much less predictable, making
them harder to identify and thwart than amalware-based intrusion. Primarily, the associated
attacker to the bitcoin scam had the intention of carrying out charity events through multiple
users with the help of social media for the ongoing investigations of Covid-19 (Sadi ,Pk and
Zeki 2021 ). Following this, the associated fame of cryptocurrencies in the form of a
transaction method as well as the popularity of multiple high-profile industrialists had been
made apart of the hack during the initial phases of the attack.
Figure-1: Social Engineering Attack Lifecycle
(Source- Created by Author)
5 TWITTER BITCOIN SCAM
Following this, the next phase was carried out to obtain all kinds of information
required from the employees existing at Twitter. This is due to the fact that nearly 1500
employees working at twitter have the provisioned access to the internally existing system at
twitter. These administrative users also have the provisioned capability of making necessary
changes to the accounts of every individual user present on the twitter online platform
(Huang 2021 ). With respect to the associated controversy, there is a shared existence of
various kinds of scopes that is mainly used by the users to carry out specific manipulation for
gaining unauthorized access to the security credentials of the users. This is a considered
possibility that could have been carried out to begin with the attack.
The next phase of the social engineering framework that has been chosen is where the
preparation for the attack had been caried out. All of the important information related to the
administrative access and the tool that is utilized for orchestrating the entire plan of the
specific attack. This particular method relevant to the attack had been utilized within the
procedure of social engineer that was a spear-phishing attack. The most important
administrative accounts had been initially targeted as well as the vector for the attack that
also was a prime part of the focus. Twitter earlier had to take the extraordinary step of
stopping many verified accounts marked with blue ticks from tweeting altogether.
The most important part of this phase was that sufficient data had been obtained and
aligned to the cryptocurrency platforms such as the likes of Binance, Coinbase as well as
CoinDesk. Eventually, this was followed by posting messages to high-profile twitter accounts
requesting for donation to asocial cause (Oxford Analytica 2020 ). This message specifically
lasted for nearly 30 minutes, which was enough in the form of atime span to extract any kind
of information that is required and necessary. The primary aim to this was to extract as much
data required as possible within the determined time frame.
6 TWITTER BITCOIN SCAM
Following this, there was aphase termed as the relationship-building phase that was
used to communicate with the different followers of the celebrities whose accounts had been
hacked and the same was used to reach out to the mass to prepare the fake social cause and
the event to take place for which appropriate donation in the form of cryptocurrency had been
requested (Salahdine and Kaabouch 2019 ). A total of 130 twitter accounts had been hacked
by gaining appropriate access to them with the help of resetting the existing settings through
the utilization of administration tools. The victims whose accounts had been hacked was done
based on the number of followers and their reach on twitter.
With respect to the analysis of the anatomy for the attack has presented above through
the appropriate utilization of the Social engineering attack had provided with amajor helping
hand for all the existing threat actors within the currently existing popularity for the entire
infrastructure of the social media platform. This particularly included all kinds of high-profile
accounts having the most number of followers on the social media network and at the same
time ensure they are able to target as much accounts as possible through the attack that has
been conducted in specific.
All of such existing factors specifically led to the orchestration of such a social
engineering attack having the likely existence of minimum amount of resources (Albladi and
Weir 2018 ). There was no shared existence of any specific limitation placed upon the
required access, with having higher levels of personalized forms of security along with the
likely measures to be carried out. Following this, observations have been made that Donald
Trump, who was the president of the US had also been targeted during the attack. However,
this was also supported with effective protection against any primary form of attack because
of additional security measures that had also been made a part of such an attack that had
occurred in the year 2017.
7 TWITTER BITCOIN SCAM
3. Impact analysis:
In this particular section of the document, an appropriate utilization of a risk
assessment has been carried out specifically to identify the associated impact of all the risks
that have a direct association with the chosen Twitter Bitcoin scam as discussed in the
previous sections. With respect to this, the following table has been created to determine the
primary impact of the identified risks associated to the social engineering attack in specific
terms.
Risk Description Threats Vulnerabilities
Phishing Phishing refers to an
attack that is intended
to steal your money, or
your identity, by
getting you to reveal
personal information —
such as credit card
numbers, bank
information, websites
that pretend to be
legitimate. (Airehrour,
Vasudevan Nair and
Madanian 2018). This
is a specific threat,
where an associated
hacker is likely to
develop a lookalike
website and send the
link to the website
through the email to the
users present online.
Such emails contain
information relevant to
the interest of the
respective user where
the user tends to click
on such a link and
eventually get directed
to aspoof website. This
is followed by the user
to fill forms with
personal information
and eventually become
a victim of such an
There is a shared
existence of multiple
kinds of threats
having a direct
association to this
particular risk that
has been identified.
One of the most
effective threats is
information stealing,
which mainly tends
to steal all kinds of
personal information
in an unauthorized
manner without
getting detected that
itis athreat.
The primary vulnerability,
which specifically leads to
this kind of an attack is the
limited knowledge of the
users regarding online
threats and the attack
method that is used by them
in common terms
(Subbalakshmi, Pareek and
Sayal 2022). This
vulnerability mainly allows
such online attackers
directly impact the privacy
as well as confidentiality of
personal information
belonging to such users.
8 TWITTER BITCOIN SCAM
attack in significant
terms.
Scareware Scareware is mainly
defined as a cyber-
threat tactic that scares
people into visiting
spoofed or infected
websites or
downloading malicious
software (Kaushalya,
Randeniya and
Liyanage 2018).
Additionally, such
users are also
misdirected towards
downloading malicious
software applications
through the help of
which information
belonging to such users
are stolen in an
unauthorized manner,
and specifically fulfils
the primary objective
of such users.
The differently
existing threats
having a direct
associated with the
risks related to
scareware have the
primary involvement
of download fake
antivirus software
solutions from
untrusted websites
that are present on
the internet. Upon
installing such third-
party applications,
the hackers gain a
potential access to
the system upon
which the same has
been installed in
particular. This is
followed with
specific stealing of
readily available
information and in
particular, directly
impacting the
privacy as well as
integrity of the
relative individual.
This can also be
considered as a
reason behind the
hacking of the
twitter accounts in
the Twitter Bitcoin
Scam.
The associated
vulnerabilities having a
direct relation to the risks
of scareware is that the
associated users might be
allowed to download as
well as install the same on
their own devices
(Khlobystova, Abramov
and Tulupyev 2019). This
mainly leads the users to
appropriately carry out an
attack such as the scareware
through situations such as
notifications, as well as
demanding for a ransom.
These are considered as the
primary vulnerabilities,
which specifically allow
with the likely occurrence
of such attacks in specific
terms.
Spear
phishing
This is a specific risk
that has also been
identified likely to be
connected to the
Twitter Bitcoin scam
that has been chosen as
the specific incident for
carrying out the attack
in particular terms
(Syafitri et al. 2022).
This risk has the
There is a shared
existence of different
kinds of threats
directly associated to
this identified risk.
This had been used
to send the phishing
link on the
individual inboxes of
the celebrity twitter
accounts to steal all
With respect to the
psychological aspect, an
identified reason being the
primary one having adirect
involvement into the attack
due to the attack who had
provisioned with the
psychological initiative and
has been asking for the
bitcoin for acting towards a
social cause related to the
9 TWITTER BITCOIN SCAM
primary capability of
affecting the ongoing
business operations at a
respective business
organization and at the
same time is focused
upon perpetrating the
existing attacks in
particular.
the readily available
personal information
of the individuals in
the twitter bitcoin
scam.
recently occurred global
pandemic, Covid-19
(Suleimanov, Abramov and
Tulupyev 2018). Hence, the
associated celebrities
present on Twitter, which is
a social networking
platform and is used by
such individuals to
communicate with their
fans and stay in touch had
been used to create the trap
through the methods of
spear phishing. This
directly impacted the
existing psychological
perspective of the existing
followers belonging to the
celebrities for generating in
the form of bitcoin as the
number one cryptocurrency
across the global business
scenario.
Multiple impacts have already been identified from the risks that have been outlined
in the above table relevant to the Twitter Bitcoin Scam, along with the specific threats as well
as vulnerabilities associated to the identified risks in this case. In the form of an impact that
has been caused by Twitter, the social network platform had specific limited access to all the
internally existing systems along with the tools ensuring that the relevant security have been
breached in asuccessful manner (Wang ,Sun and Zhu 2020 ). Every individual phase for a
social engineering attack has been used in particular by the teenager who had the capability
of getting past the existing security architecture at Twitter and successfully breach the
personal information of the celebrity accounts present on the platform.
Not just this, the hacker was also able to send spoof links on their personal chats and
manipulate them to provide donations for the social cause in the form of bitcoins and
eventually lead to a specific threat that stole all kinds of readily available information
10 TWITTER BITCOIN SCAM
belonging to the individual celebrity accounts that have been hacked by the hacker (Bullee et
al.2018 ). As aresult, Twitter was compelled to announce the breach that has specifically
occurred and how the teenager was able to successfully carry out the attack, manipulate the
celebrities through their accounts, generated revenue in the form of bitcoin and also steal
sensitive information that belonged to the individual celebrity accounts in specific terms. On
alarge scenario, this specifically impacted the reputation of Twitter and lost the trust of all of
its users, since celebrity accounts had been hacked that also led their fans to create anegative
image about the platform in terms of security as well.
4. Recommended approach:
This section of the document has clearly put forward appropriate recommendations
based on the inexistent security measures, which led to the occurrence of the Twitter Bitcoin
Scam in particular( Abass 2018 ). As a reason to this, MINDSPACE framework has been
chosen and taken into consideration for this part of the document. The chosen framework has
a direct focus upon the nine forces, which are effectively important for controlling the
behaviour of the audience that has been targeted during the attack that has already occurred
for formulating the required solution to prevent the attack in future. The mentioned nine
forces belonging the Mindspace framework has been outlined in the following points and has
been described to put forward a better understanding of the same (Chetioui et al.2022 ).
Hence, the nine forces associated to the Mindspace framework are,
a. Messenger :this is aforce that is entrusted with the specific responsibility of having a
direct influence upon the targeted audience to act as aresponse to all of the identified
risks in specific terms. The celebrities who had been targeted during the attack had
been used as the specific messenger for communicating the attack and moving
forward with the same (Saleem and Hammoudeh 2018 ). The appropriate
11 TWITTER BITCOIN SCAM
recommendations to this is to enhance the authentication upon the individual twitter
accounts with the help of measures such as Multi-Factor Authentication, which will
prevent any hacker from gaining the access unless the same has been approved by the
original owner of such an account.
b. Incentive :Twitter must schedule initiative programs for the celebrities to become a
part of to spread the awareness and ask the individual users belonging to the social
networking platform to stay aware against such attacks or messages from unknown
senders in particular (AL-Otaibi and Alsuwat 2020 ). This should also be aligned with
incentives that will keep the individual celebrities interested in this segment.
c. Norms :this is asignificant factor having the primary capability of bringing necessary
changes within the associated behaviour of the audience that has been targeted by
putting forward appropriate measures of mitigation against identified risks such as
spear-phishing, phishing as well as scareware.
d. Defaults : formulated mitigation measures of risks should be adopted by every
individual belonging to Twitter by default to maintain the primary level of protection
against such threats. This is arecommendation, which is common but at the same time
is important in multiple aspects (Abramov and Tulupyev 2019 ).
e. Salience :the chosen Mindspace framework is directly associated at focusing upon the
primary cause of the problem and at the same time raise awareness among such users
to typically become apart of an aware group and fight against such likely threats in
particular.
f. Priming : with respect to this, specific recommendation is made to undertake
appropriate initiates for stimulating awareness among the crowd of users who belong
to Twitter and is responsible of their own personal information to asimilar level like
that of Twitter.
12 TWITTER BITCOIN SCAM
g. Affect :all the security initiatives as outlined should need to be laid out in aproper
manner to ensure abetter understanding and at the same time should be dealt with an
emotional as well as in a logical manner when it comes to the targeted audience
(Zolotarev et al.2021 ).
h. Commitments :Twitter should take the responsibility of individual protection upon the
personal information of the users having an account upon the social network. With
respect to this, Twitter should also make commitments to individual users to protect
their data at all times with enhanced security measures.
i. Ego :as stated by the Mindspace framework that all the associated stakeholders should
have the primary responsibility of carrying out an effective measurement of risk
mitigation and should also be confident regarding the various security measures that
have been implemented to increase the required security (Arabia-Obedoza et al.2020 ).
5. Conclusion:
Twitter Bitcoin Scam is one of the most considerable hacks that have spread all over
the internet and had affected the celebrity accounts of famous personalities having ahuge fan
following. With respect to this, the above document has been prepared to put forward the
information regarding the social engineering attack method that had been carried out. In
addition to this, the document has identified all the risks, vulnerabilities as well as threats
associated to the scam along with security approaches that have been recommended utilizing
the Mindspace framework of Social engineering.
13 TWITTER BITCOIN SCAM
6. References:
Abass, I.A.M., 2018. Social engineering threat and defense: aliterature survey. Journal of
Information Security ,9(04), p.257.
Abramov, M.V. and Tulupyev, A.L., 2019, November. Soft Estimates of User Protection
from Social Engineering Attacks. In Conference on Artificial Intelligence and Natural
Language (pp. 47-58). Springer, Cham.
Airehrour, D., Vasudevan Nair, N. and Madanian, S., 2018. Social engineering attacks and
countermeasures in the new zealand banking system: Advancing auser-reflective mitigation
model. Information ,9(5), p.110.
Albladi, S.M. and Weir, G.R., 2018. User characteristics that influence judgment of social
engineering attacks in social networks. Human-centric Computing and Information Sciences ,
8(1), pp.1-24.
AL-Otaibi, A.F. and Alsuwat, E.S., 2020. A study on social engineering attacks: phishing
attack. International Journal of Recent Advances in Multidisciplinary Research ,7(11),
pp.6374-6380.
Arabia-Obedoza, M.R., Rodriguez, G., Johnston, A., Salahdine, F. and Kaabouch, N., 2020,
October. Social Engineering Attacks A Reconnaissance Synthesis Analysis. In 2020 11th
IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference
(UEMCON) (pp. 0843-0848). IEEE.
Bullee, J.W.H., Montoya, L., Pieters, W., Junger, M. and Hartel, P., 2018. On the anatomy of
social engineering attacks — A literature ‐based dissection of successful attacks. Journal of
investigative psychology and offender profiling ,15 (1), pp.20-45.
14 TWITTER BITCOIN SCAM
Chetioui, K., Bah, B., Alami, A.O. and Bahnasse, A., 2022. Overview of Social Engineering
Attacks on Social Networks. Procedia Computer Science ,198 ,pp.656-661.
Conger, K., 2021. 4th Arrest in Hack of Twitter That Led to Short Shutdown. The New York
Times ,pp.B4-L.
Huang, S., 2021. Cryptocurrency and crime. In FinTech, Artificial Intelligence and the Law:
Regulation and Crime Prevention (pp. 125-143). Routledge.
Kaushalya, S.A.D.T.P., Randeniya, R.M.R.S.B. and Liyanage, A.D.S., 2018, November. An
overview of social engineering in the context of information security. In 2018 IEEE 5th
International Conference on Engineering Technologies and Applied Sciences (ICETAS) (pp.
1-6). IEEE.
Khlobystova, A., Abramov, M. and Tulupyev, A., 2019, February. An approach to estimating
of criticality of social engineering attacks traces. In International Conference on Information
Technologies (pp. 446-456). Springer, Cham.
Oxford Analytica, 2020. Twitter hack exposes risks of social media influence. Emerald
Expert Briefings ,(oxan-db).
Sadi, S.H., Pk, M.R.H. and Zeki, A.M., 2021. Threat Detector for Social Media Using Text
Analysis. International Journal on Perceptive and Cognitive Computing ,7(1), pp.113-117.
Salahdine, F. and Kaabouch, N., 2019. Social engineering attacks: A survey. Future Internet ,
11 (4), p.89.
Saleem, J. and Hammoudeh, M., 2018. Defense methods against social engineering attacks.
In Computer and network security essentials (pp. 603-618). Springer, Cham.
15 TWITTER BITCOIN SCAM
Subbalakshmi, C., Pareek, P.K. and Sayal, R., 2022. A Study on Social Engineering Attacks
in Cybersecurity. In Innovations in Computer Science and Engineering (pp. 59-71). Springer,
Singapore.
Suleimanov, A., Abramov, M. and Tulupyev, A., 2018, May. Modelling of the social
engineering attacks based on social graph of employees communications analysis. In 2018
IEEE Industrial Cyber-Physical Systems (ICPS) (pp. 801-805). IEEE.
Syafitri, W., Shukur, Z., Mokhtar, U.A., Sulaiman, R. and Ibrahim, M.A., 2022. Social
Engineering Attacks Prevention: A Systematic Literature Review. IEEE Access .
Wang, Z., Sun, L. and Zhu, H., 2020. Defining social engineering in cybersecurity. IEEE
Access ,8,pp.85094-85115.
Witman, P.D. and Mackelprang, S., 2022. The 2020 Twitter Hack –So Many Lessons to Be
Learned. Journal of Cybersecurity Education, Research and Practice ,2021 (2), p.2.
Yurtseven, Ä°.,Bagriyanik, S. and Ayvaz, S., 2021, September. A Review of Spam Detection
in Social Media. In 2021 6th International Conference on Computer Science and Engineering
(UBMK) (pp. 383-388). IEEE.
Zhongming, Z., Linong, L., Xiaona, Y., Wangqiang, Z. and Wei, L., 2020. Insider Threat at
Twitter Is aRisk to Everyone.
Zolotarev, V.V., Arkhipova, A.B., Parotkin, N.Y. and Lvova, A.P., 2021. Strategies of social
engineering attacks on information resources of gamified online education projects. In CEUR
Workshop Proceedings (Vol. 2861, pp. 386-391).