(Photo Illustration by Jonathan Raa/NurPhoto via Getty Images)
How did the Securities and Exchange Commission lose access to its Twitter account yesterday? According to Twitter/X, the hacker did so by resorting to a SIM-swap attack to take over the phone number tied to the @SECGov account.
“Based on our investigation, the compromise was not due to any breach of X’s systems, but rather due to an unidentified individual obtaining control over a phone number associated with the @SECGov account through a third party,” Twitter’s Safety team said on Tuesday.
“We can also confirm that the account did not have two-factor authentication enabled at the time the account was compromised,” Twitter added.
The company didn’t identify the third party. But it looks like the hacker learned which phone number was registered to @SECGov. They then probably manipulated a cellular provider into giving up access to the phone number via a SIM swap. In these scenarios, the carrier clones the mobile phone number to a new SIM card, which is then placed in the hacker’s phone.
SIM-swapping attacks can be devastating since many online accounts will send password-reset codes to the owner’s mobile phone number. This has allowed cybercriminals to take over cryptocurrency accounts, as well as Twitter accounts. In 2019, former Twitter CEO Jack Dorsey suffered a SIM swap that resulted in hackers posting racist comments on his account.
Tuesday’s hijacking of the SEC’s account shows that SIM-swapping attacks are more than just PR headaches. The hacker used @SECGov to fraudulently claim that the federal regulator had cleared Bitcoin ETFs (Exchange-Traded funds) for all national securities exchanges. This sent the price of Bitcoin soaring on Tuesday. But the value abruptly plummeted after SEC Chair Gary Gensler warned the public that the @SECGov account had been compromised.
The hijacking has since caused embarrassment for the SEC, especially since Gensler himself published a tweet back in October urging users to implement multi-factor authentication. At the same time, US lawmakers are demanding answers for how the hack occurred.
So far, the SEC hasn’t responded to Twitter’s findings. But in a statement following the hijacking, the US regulator said it’s working with “law enforcement and our partners across government to investigate the matter and determine appropriate next steps relating to both the unauthorized access and any related misconduct.”
In the meantime, the growing number of SIM-swapping attacks has prompted the FCC to push carriers to enforce stronger rules when it comes to mobile phone number transfers.