23-year-old Brit linked to 2020 Twitter attack and SIM-swap scheme pleads guilty

A 23-year-old British citizen has confessed to "multiple schemes" involving computer crimes, including playing a part in the July 2020 Twitter attack that saw the accounts of Amazon CEO Jeff Bezos, Kanye West, and former President Barack Obama hijacked by an unidentified crew. Joseph James O'Connor, known by the online alias …

[ChoHag]

The phone network is sitting there asking to be, not broken into, but waltzed into. The only thing stopping it from happening more is that those who can't keep their itchy fingers away are too unsophisticated to get away with it, and those who are don't need to. Mostly.

[Clausewitz4.0]

Agree. Have been a telecom engineer myself, working for a few over the years. Probably my code is still running in some of those.

[Martin-73]

Same is true for physical security, Unlocked cabinets, including FTTC ones ... one snip of a fibre could remove internet service (including landline phone now in some areas, and everywhere shortly), from hundreds or thousands of customers at a time

[Anonymous Coward]

"You send $1,000, I send you back $2,000."

How thick do you have to be to fall for that one?

[Aitor 1]

Re: "You send $1,000, I send you back $2,000."

If only 1 in 5000 fall, you are golden... And someone is going to be stupid, drunk, mentally ill or desperate enough.

[Martin-73]

Re: "You send $1,000, I send you back $2,000."

This is exactly the problem. My 91 year old mother used to repeatedly fall for arsehole cold callers who'd swear blind they could block cold calls with their magnificent gadget, for only 400 pounds... which was usually a cheap called ID based blocker worth at most 30 pounds, and not compliant with ANYTHING (including having 2 wire RJ11 style sockets, in the UK)

[DS999]

Re: "You send $1,000, I send you back $2,000."

How thick do you have to be to fall for that one?

The people who fall for it are the Dunning-Kruger types like Trump, who believe they are smarter than everyone else because they don't know enough to know how dumb they are. These people will think to themselves "aha, since I'm so clever I see a way to really take advantage of this - I'll send $1000 then when I get back the $2000 I'll send that to get $4000 and so on. I'll turn my $1000 into millions!"

When you combine it with the need to send it bitcoin, which already self selects for the stupid who believe in bitcoin, it is probably a reasonably effective scam. $110,000 worth of effective, at least.

[phuzz]

The company has since tightened its protocols, which among other things now includes having way fewer people that an attacker can socially engineer.

Glad to see that elReg's trademark snark is still around :)

[Ace2]

“It's better to use a security key or an authenticator app.”

The app reviews for Duo Mobile are positively packed with people complaining that they linked their Instagram or whatever to Duo and then broke or lost their phone. That’s it, you’re done. Locked out forever, and the company won’t help you.

There is some sort of backup / archive you can do (in advance!!!) but I don’t know how technically involved it is, or where you would be expected to store recovery keys.

Is this really what we want to push everyone towards? Most people can’t figure out how to connect their TV.

[Clausewitz4.0]

Some apps allow you to save the cryptographic seed. Just please, DO NOT save it in the cloud.

[Martin-73]

dear god that is so catastropically true, but in defence of those people, back in 'the day' tv's had 2 connections. One had 2 wires, to which you attached a plug, the other was a co-axial socket you plugged the aerial into. Some people aren't technical and just get culture shock every time the connectors multiply. I get both sides tbh

[Insert sadsack pun here]

I remember this incident. People couldn't believe that Kanye and Elon were tweeting deceptive nonsense to their millions of followers. And then, to make it worse, they got hacked.