Extract from ABC News
The hacker used David Taylor's hijacked X account to spruik supposed cryptocurrency investment returns. (Supplied)
I do not own any cryptocurrency, nor do I drive a Range Rover.
I do though, according to my X account, which was hacked at some point late last month.
The story is straightforward.
A long-term trusted contact of mine, Sean Callow, sent me a direct message on X. At least I thought he had.
Sean Callow says the hack was a "wake-up" call. (ABC News: John Gunn)
It was in Sean's "voice".
He asked me to vote for him to host a podcast.
I thought the request was a little odd, but it was entirely plausible that Mr Callow could be in the running to host a finance or currency podcast given his role as a currency strategist at ITC Capital Markets.
I clicked the link, but it asked for too much authentication, so I bailed out. It was too hard.
A few days later "Sean" sent me another direct message, pulling on the heartstrings, saying he had noticed I hadn't voted for him, and he was disappointed.
So, naturally, I tried voting again, going through several links.
It felt odd again, so I bailed out. But I was too late. I had been hacked.
It has been a humbling experience because I had thought of myself as proficient in spotting a phishing exercise or hack a mile off.
Mr Callow, too, regrets getting trapped in the hacker's web.
"This episode has been a wakeup call for me in how sophisticated hackers have become,"he said.
"This was not an email with spelling mistakes or a 'too good to be true' financial offer.
"It was presented as a favour to a friend of mine in the US who would very plausibly be preparing for a podcast."
Hack spreads through web of contacts
But the distinctive aspect of this hack is that neither Mr Callow nor I were aware an X account direct message could be infiltrated.
"My guard was also lowered by the message arriving in my X direct messages, which require a PIN for me just to read them," he said.
A trusted contact of Mr Callow's in the US appears to be the origin of the spread of this hack.
It then moved to myself, property investment adviser Pete Wargent, and then onto the X account of the Centre for Independent Studies' chief economist Peter Tulip.
Peter Tulip was eventually given the contact details of someone at X to complain about the hack. (Supplied)
From these contacts, hundreds and potentially thousands of Australians have received cyber security threats within their X direct messages.
Mr Tulip said the direct message he engaged with came directly from Mr Wargent.
The ABC has contacted Mr Wargent for comment.
Mr Wargent, however, is indeed a podcast host, making the direct message from him about asking for votes to host a podcast, on the surface, seem credible.
Peter Tulip says he received a direct message from another finance expert, Peter Wargent. (ABC: Dan Irvine)
Mr Tulip said he thought at the time it was "plausible" the direct message was authentic given Mr Wargent's occupation.
Mr Tulip has since been able to regain control of his X account, but he says the day his account was hacked was "extremely difficult".
"I've spent seven years accumulating 8,000 X followers and the prospect of losing communication with them and starting again would have been a huge loss,"he said.
'Infuriating' lack of response from X
Mr Tulip said the most challenging aspect of the hack was that there was "no-one to talk to at Twitter [X]".
"It's just infuriating.
"It was a simple and common problem that couldn't be rectified."
Mr Tulip was given the contact details of a representative at X by a member of the media.
He said it provided him with a "ray of sunshine" on an otherwise difficult day.
I can corroborate how hard it is to get action from X, formerly known as Twitter, having completed two incident reports with only an automated reply in response.
Unlike your average person, I was able to engage the help of the ABC's cyber team and I was given access to Mr Tulip's new-found contact at X to try to regain control of my account.
Thankfully, that correspondence was helpful and I regained control of my account on Friday evening.
How to avoid being hacked
Our world is dominated by digital applications, passwords, and the ever-present threat of a cyber attack.
An online attack could leave anyone in a constant state of digital fight or flight.
Cyber security expert Troy Hunt agreed it was an ongoing worry for anyone with a digital footprint.
And, he said, dodgy links from trusted direct messages were becoming increasingly common.
However, he also said cyber security "should be a shared responsibility".
He said if one of your online accounts was hacked you need to immediately "go through the account recovery process [provided by the platform host] as painful as that is.
"It's not going to be fun."
A reasonable approach is to remain cautious, but there are proven ways to protect your online presence.
The most obvious are changing passwords, and having two-factor authentication, among others.
A simple text message to Mr Callow after receiving his direct message on X would have also prevented the hack.
Many of my contacts have done precisely that with me.
But if you haven't, please don't click on the link. I'm already on a podcast, for the ABC, and you can listen to it here.
No comments:
Post a Comment