how a social engineering attack DESTROYED Twitter (feat. Marcus Hutchins) // Twitter Hack 2020

About this video

Chuck, joined by Marcus Hutchins, known for stopping the WannaCry ransomware, breaks down how high-profile Twitter accounts including Bill Gates, Elon Musk, President Obama, Joe Biden, and Kanye West were taken over to post a cryptocurrency scam. Twitter said attackers used a social engineering scheme on a small number of employees, used their credentials to reach internal systems and admin tools, targeted 130 accounts, and were able to tweet from 45 of them, bypassing strong passwords and two-factor authentication. Chuck contrasts two media accounts: the New York Times story centered on a figure called Kirk, bragging on Discord, possibly reaching the admin panel via Twitter’s internal Slack channel, plus hackers named lol and ever so anxious; Vice’s sources instead claimed an insider rep was paid to do the work. Chuck stresses bribery was not confirmed by Twitter. He links the actors to the OG username community that buys and sells rare handles, noting PlugWalkJoe reportedly bought the @6 username, and explains their more usual method, SIM swapping. He walks through why social engineering works, its staged process, and argues employee training and least privilege matter because people, not firewalls, are the weak point, and that similar admin panels exist at other large platforms.

Key takeaways

• Per Twitter’s account, attackers social-engineered employees to reach internal admin tools, targeting 130 accounts and tweeting from 45
• Admin-panel access bypassed strong passwords and two-factor authentication, letting attackers post a cryptocurrency scam from celebrity accounts
• Reporting conflicted: one story centered on ‘Kirk’ and possible Slack access, another claimed a Twitter insider was paid; Twitter did not confirm a bribe
• Chuck lists five reasons social engineering works: default trust, ignorance, fear, greed, and moral obligation
• Defenses he and Hutchins emphasize are employee training and least-privilege role separation, since most attacks rely on user interaction

Episode details: published July 22, 2020 · 21:07 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: HUGE announcement!! · Next: What is a ROUTER? // FREE CCNA // EP 2 →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube