- Three people were charged on Friday in connection to a massive Twitter bitcoin hack in July that compromised dozens of high profile accounts, including those of Kim Kardashian-West, Kanye West, and former President Barack Obama.
- Among those charged was 17-year-old Graham Ivan Clark who reportedly stole nearly $180,000 and is being described as the mastermind behind the attack.
- On Sunday, the Tampa Bay Times reported that Clark has over $3 million in bitcoin, and prosecutors believe that money was also obtained illegally.
- This is not Clark’s first run in with authorities. Last year, they seized cash and $700,000 bitcoin in a criminal investigation, though he was never charged.
17-Year-Old “Mastermind” Arrested
In news that would otherwise appear to come straight from a best-selling young adult heist novel, a 17-year-old Florida teen has been charged as the “mastermind” behind Twitter’s largest hack ever. Reportedly, he’s also worth $3 million in bitcoin.
That hack, which happened on July 15, successfully infiltrated dozens of high-profile accounts including: Kim Kardashian-West, Kanye, Elon Musk, Jeff Bezos, former President Barack Obama, and presumptive Democratic presidential nominee Joe Biden. It also attacked Twitter accounts for companies like Apple and Uber.
All of those accounts then tweeted out some variation of the same message: “I am giving back to my community due to Covid-19! All Bitcoin sent to my address below will be sent back doubled. If you send $1,000, I will send back $2,000! Only doing this for the next 30 minutes! Enjoy.”
On Friday, state authorities arrested 17-year-old Graham Ivan Clark in Tampa, Fl. Though he reportedly lives alone and is a recent high school graduate, Clark is still a minor, which is why he was not arrested by federal officials. He will be tried as an adult.
Clark faces 30 different felonies, including 17 counts of communications fraud and one count of fraudulent use of personal information (over $100,000 or 30 or more victims).
On July 16, the Federal Bureau of Investigation announced it was opening an investigation into the hack. The same day that Clark was arrested and charged, two others were charged by federal agents.
One of those men, 22-year-old Nima Fazeli of Orlando, Fl., has been arrested by federal agents. The other, 19-year-old Mason John Sheppard of the United Kingdom, still hasn’t been arrested but the FBI is expecting him to be taken into custody soon.
How Clark Hacked Twitter
Despite many details around Clark being restricted because he is a minor, a criminal affidavit from Florida has still revealed some of the specifics behind how that attack happened.
According to that affidavit, Clark gained access to a portion of Twitter’s network on May 3. Reportedly, this happened after Clark convinced a Twitter employee that he was also an employee in the technology department. He then told the real employee that he needed their credentials to access the customer service portal.
From there, the affidavit jumps to July 15 and it’s not clear what happened between then, but according to Zdnet, “it appears Clark wasn’t immediately able to pivot from his initial entry point to the Twitter admin tool that he later used to take over accounts.”
In fact, according to The New York Times, he only got access to those credentials after he found a way into Twitter’s internal Slack workspaces and saw them posted there.
Still, that alone was not enough for him to make his way past Twitter’s two-factor authentication. Likely, he maneuvered around that through what Twitter called a “phone spear phishing attack.”
“The attack on July 15, 2020, targeted a small number of employees through a phone spear phishing attack,” Twitter Support said on Thursday. “This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems.”
The affidavit accuses Discord user Kirk#5270, believed to be Clark, of initiating the attacks.
“I work for Twitter,” Kirk said in a chatroom on July 15. “I can claim any @. Let me know. Don’t tell anyone.”
Soon after, Sheppard and Fazeli joined under separate usernames of their own, and the three reportedly began selling access to Twitter accounts.
However, this attack is different from the one that targeted personalities like Kim K. Instead, this attack focused on stealing short handles like @drug, @xx, @vampire.
By the end of it, Kirk was accused of netting around $33,000 in bitcoin. Sheppard is accused of acquiring around $7,000 in bitcoin. Fazeli is accused of having worked in cooperation with the two in exchange for a Twitter handle he wanted.
From here, the criminal complaints against Sheppard and Fazeli end. Of course, that wasn’t the end of the attack. Later that same day, the main hack against numerous high profiles figures began.
By the end of that, Clark had reportedly stolen around $177,000 from both attacks.
How the 17-Year-Old “Mastermind” Got Caught
If the first part of their plan went off without a hitch, the latter half did not. The alleged criminals reportedly failed to hide their real identities and scrambled to hide their stolen money once the hack went public. Such mistakes led to a quick discovery of their identities by law enforcement.
Clark himself has faced legal trouble before, as well.
According to the Tampa Bay Times on Sunday, he has 300 Bitcoin — making him worth more than $3 million. Prosecutors have argued that most — if not all of that money — was likely illegally obtained, though Clark’s attorney has denied that claim.
Last year, Clark was the subject of a criminal investigation where authorities seized $15,000 in cash and 400 bitcoin. Ultimately, Clark was never charged, prosecutors returned 300 bitcoin to him.
While July’s Twitter hack stirred up significant (and justified) fear over just how easy it was for hackers to target users, as of now, it is unknown if this hack had any more sinister intentions outside of stealing money.
See what others are saying: (Tampa Bay Times) (Zdnet) (WIRED)
Hackers Hit Twitch Again, This Time Replacing Backgrounds With Image of Jeff Bezos
The hack appears to be a form of trolling, though it’s possible that the infiltrators were able to uncover a security flaw while reviewing Twitch’s newly-leaked source code.
Hackers targeted Twitch for a second time this week, but rather than leaking sensitive information, the infiltrators chose to deface the platform on Friday by swapping multiple background images with a photo of former Amazon CEO Jeff Bezos.
According to those who saw the replaced images firsthand, the hack appears to have mostly — and possibly only — affected game directory headers. Though the incident appears to be nothing more than a surface-level prank, as Amazon owns Twitch, it could potentially signal greater security flaws.
For example, it’s possible the hackers could have used leaked internal security data from earlier this week to discover a network vulnerability and sneak into the platform.
The latest jab at the platforms came after Twitch assured its users it has seen “no indication” that their login credentials were stolen during the first hack. Still, concerns have remained regarding the potential for others to now spot cracks in Twitch’s security systems.
It’s also possible the Bezos hack resulted from what’s known as “cache poisoning,” which, in this case, would refer to a more limited form of hacking that allowed the infiltrators to manipulate similar images all at once. If true, the hackers likely would not have been able to access Twitch’s back end.
The photo changes only lasted several hours before being returned to their previous conditions.
First Twitch Hack
Despite suspicions and concerns, it’s unclear whether the Bezos hack is related to the major leak of Twitch’s internal data that was posted to 4chan on Wednesday.
That leak exposed Twitch’s full source code — including its security tools — as well as data on how much Twitch has individually paid every single streamer on the platform since August 2019.
It also revealed Amazon’s at least partially developed plans for a cloud-based gaming library, codenamed Vapor, which would directly compete with the massively popular library known as Steam.
Even though Twitch has said its login credentials appear to be secure, it announced Thursday that it has reset all stream keys “out of an abundance of caution.” Users are still being urged to change their passwords and update or implement two-factor authentication if they haven’t already.
Twitch Blames Server Configuration Error for Hack, Says There’s No Indication That Login Info Leaked
The platform also said full credit card numbers were not reaped by hackers, as that data is stored externally.
Login and Credit Card Info Secure
Twitch released a security update late Wednesday claiming it had seen “no indication” that users’ login credentials were stolen by hackers who leaked the entire platform’s source code earlier in the day.
“Full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed,” the company added in its announcement.
The leaked data, uploaded to 4chan, includes code related to the platform’s security tools, as well as exact totals of how much it has individually paid every single streamer on the platform since August 2019.
Early Thursday, Twitch also announced that it has now reset all stream keys “out of an abundance of caution.” Streamers looking for their new keys can visit a dashboard set up by the platform, though users may need to manually update their software with the new key before being able to stream again depending on what kind of software they use.
As far as what led to the hackers being able to steal the data, Twitch blamed an error in a “server configuration change that was subsequently accessed by a malicious third party,” confirming that the leak was not the work of a current employee who used internal tools.
Will Users Go to Other Streaming Platforms?
While no major creators have said they are leaving Twitch for a different streaming platform because of the hack, many small users have either announced their intention to leave Twitch or have said they are considering such a move.
It’s unclear if the leak, coupled with other ongoing Twitch controversies, will ultimately lead to a significant user exodus, but there’s little doubt that other platforms are ready and willing to leverage this hack in the hopes of attracting new users.
At least one big-name streamer has already done as much, even if largely only presenting the idea as a playful jab rather than with serious intention.
“Pretty crazy day today,” YouTube’s Valkyrae said on a stream Wednesday while referencing a tweet she wrote earlier the day.
“YouTube is looking to sign more streamers,” that tweet reads.
“I mean, they are! … No shade to Twitch… Ah! Well…” Valkyrae said on stream before interrupting herself to note that she was not being paid by YouTube to make her comments.
The Entirety of Twitch Has Been Leaked Online, Including How Much Top Creators Earn
The data dump, which could be useful for some of Twitch’s biggest competitors, could signify one of the most encompassing platform leaks ever.
Massive Collection of Data Leaked
Twitch’s full source code was uploaded to 4chan Wednesday morning after it was obtained by hackers.
Among the 125 GB of stolen data is information revealing that Amazon, which owns Twitch, has at least partially developed plans for a cloud-based gaming library. That library, codenamed Vapor, would directly compete with the massively popular library known as Steam.
With Amazon being the all-encompassing giant that it is, it’s not too surprising that it would try to develop a Steam rival, but it’s eyecatching news nonetheless considering how much the release of Vapor could shake up the market.
The leaked data also showcased exactly how much Twitch has paid its creators, including the platform’s top accounts, such as the group CriticalRole, as well as steamers xQcOW, Tfue, Ludwig, Moistcr1tikal, Shroud, HasanAbi, Sykkuno, Pokimane, Ninja, and Amouranth.
These figures only represent payouts directly from Twitch. Each creator mentioned has made additional money through donations, sponsorships, and other off-platform ventures. Sill, the information could be massively useful for competitors like YouTube Gaming, which is shelling out big bucks to ink deals with creators.
Data related to Twitch’s internal security tools, as well as code related to software development kits and its use of Amazon Web Services, was also released with the hack. In fact, so much data was made public that it could constitute one of the most encompassing platform dumps ever.
Streamer CDawgVA, who has just under 500,000 subscribers on Twitch, tweeted about the severity of the data breach on Wednesday.
“I feel like calling what Twitch just experienced as “leak” is similar to me shitting myself in public and trying to call it a minor inconvenience,” he wrote. “It really doesn’t do the situation justice.”
Despite that, many of the platform’s top streamers have been quite casual about the situation.
“Hey, @twitch EXPLAIN?”xQc tweeted. Amouranth replied with a laughing emoji and the text, “This is our version of the Pandora papers.”
Meanwhile, Pokimane tweeted, “at least people can’t over-exaggerate me ‘making millions a month off my viewers’ anymore.”
Others, such as Moistcr1tikal and HasanAbi argued that their Twitch earning are already public information given that they can be easily determined with simple calculations.
Could More Data Come Out?
This may not be the end of the leak, which was labeled as “part one.” If true, there’s no reason to think that the leakers wouldn’t publish a part two.
For example, they don’t seem to be too fond of Twitch and said they hope this data dump “foster[s] more disruption and competition in the online video streaming space.”
They added that the platform is a “disgusting toxic cesspool” and included the hashtag #DoBetterTwitch, which has been used in recent weeks to drive boycotts against the platform as smaller creators protest the ease at which trolls can use bots to spam their chats with racist, sexist, and homophobic messages.
Still, this leak does appear to lack one notable set of data: password and address information of Twitch users.
That doesn’t necessarily mean the leakers don’t have it. It could just mean they are only currently interested in sharing Twitch’s big secrets.
Regardless, Twitch users and creators are being strongly urged to change their passwords as soon as possible and enable two-factor authentication.