It seems like some Twitter API posting service has been compromised and being used to send out fake "giveaway" tweets from popular crypto/blockchain accounts. "CryptoForHealth" is a scam.
No way are all these accounts unprotected by strong passwords and TOTP 2FA
No way are all these accounts unprotected by strong passwords and TOTP 2FA
I don't think this is a compromise of Twitter. I think it's another intermediary "social media posting" service that is popular and used by multiple companies. They often have weaker security and limited 2FA options, but full access to the Twitter API granted by the user.
To be clear, no one should be gloating about this and neither am I. No one is immune to attacks and even while I feel I have taken strong precautions to protect my account, I'm watching this with horrified interest, hoping it doesn't happen to me.
Also, fuck "CryptoForHealth"
Also, fuck "CryptoForHealth"
I've temporarily disabled all API access and locked out all open sessions for my account. You should probably do the same (Settings/Apps and Sessions), if you have a high profile account, until we know how this is happening. I've also disabled all relevant browser extensions
Password changed. It was >25 character random full-character-set, but there's no harm in changing it. Also, don't use SMS 2FA (I don't, ever, anywhere). Use TOTP 2FA, at minimum, or a hardware security key, at best.
Whoever has this "access", please have Trump tweet this:
So far almost a dozen accounts have been compromised from a broad range of countries. Make me think it is not SMS hijack. Curiouser and curiouser.
If you hear me tweet that COVID is a hoax or that I'm giving away crypto, I've been taken too
If you hear me tweet that COVID is a hoax or that I'm giving away crypto, I've been taken too
