Twitter CEO SIM Swap Attack (2019)

Background

On August 30, 2019, Twitter CEO Jack Dorsey's account was compromised through a SIM swapping attack. The attack became public when unauthorized tweets appeared on his verified Twitter account, exposing vulnerabilities in SMS-based two-factor authentication and carrier security procedures.

Discovery

The attack was discovered when offensive tweets appeared on @jack's account. Twitter's security team quickly identified the compromise and began incident response procedures. The attack was part of a broader trend of SIM swapping attacks targeting high-profile individuals.

Scope

While only one account was directly compromised, the incident had far-reaching implications for SMS-based authentication security, carrier verification procedures, and the security of high-profile accounts across all platforms.

Attack Method

Social engineering followed by SIM card transfer

• Attackers gathered personal information about Jack Dorsey through OSINT
• Used social engineering to convince carrier representatives
• Transferred phone number to attacker-controlled SIM card
• Bypassed SMS-based 2FA to access Twitter account

Carrier Compromise

The attackers successfully convinced mobile carrier customer service representatives to transfer Jack Dorsey's phone number to a SIM card controlled by the attackers. This was achieved through social engineering techniques and potentially insider assistance.

Account Takeover Process

1. Phone number transferred to attacker's SIM card
2. SMS-based password reset initiated for Twitter account
3. Reset code received on attacker-controlled phone
4. Account access gained through Cloudhopper service
5. Unauthorized tweets posted to @jack account

Posting Mechanism

The unauthorized tweets were posted through Cloudhopper, a service that allows posting to Twitter via SMS. This added an additional layer of complexity to the attack and demonstrated the attackers' knowledge of Twitter's infrastructure.

Key Lessons

• SMS-based 2FA is vulnerable to SIM swapping attacks
• High-profile individuals require enhanced security measures
• Social engineering remains a significant threat vector
• Need for multi-layered authentication approaches
• Importance of rapid incident detection and response

Preventive Measures