Twitter cyberattack was likely 'facilitated by an insider threat': Cybersecurity expert

joins The First Trade with Alexis Christoforous and Brian Sozzi to discuss the recent cyberattack on Twitter that hit high profile accounts like Joe Biden, Warren Buffett, Elon Musk, Uber, and Apple. He also discusses the implications of this attack, what this means for the 2020 election and much more.

Video Transcript

ALEXIS CHRISTOFOROUS: Shares of Twitter on our radar this morning. They are down more than 4% here in the premarket after one of the most brazen online attacks in recent memory. The Twitter accounts of Joe Biden, Barack Obama, Elon Musk, Bill Gates, and other high-profile politicians and business leaders were hacked yesterday in what Twitter calls a "coordinated social engineering attack." So they all posted similar messages on Twitter, sending-- send bitcoin, they said, and that these famous people would then send back double your money. It was a scam, of course.

Joining us now is Karim Hijazi. He is CEO of the intelligence company Prevailion. Karim, good to have you with us. We also have with us our Yahoo Finance's Editor in Chief Andy Serwer. Good morning to you, Andy.

ANDY SERWER: Hi.

ALEXIS CHRISTOFOROUS: Karim, I want to start with you. What-- what does Twitter mean, exactly, when it says they believe this was a "coordinated social engineering attack?"

KARIM HIJAZI: Good morning, Alexis. Yeah, that's a interesting terminology. It suggests that they've confirmed that an employee or someone close to Twitter allegedly worked or was worked by the adversary to allow access to back-end systems, which is what corroborates with a lot of what we were surmising yesterday, where there was no way this could've been something that purely happened from the outside in with no sort of influence from the inside.

So the social engineering suggests that someone was convinced to do certain things or, in other alleged articles that I've seen, it looks like there was possibly some payoffs that were happening from the inside. So it's an insider threat that facilitated this attack. But in either case, there was some sort of influence impressed upon an individual that allowed them to escalate their access within Twitter.

ANDY SERWER: Karim, what do you make of the fact that it appears that the politicians who were targeted were only Democrats, number one? And number two, at what point does the government step in here? I mean, imagine if our telephone network were hacked and people started jumping in and were able to make calls and impersonate and say they were calling from Barack Obama or Jeff Bezos' line. The government would certainly step in there. When does the government step in here?

KARIM HIJAZI: It's a great question, Andy. I think the same thing that you're suggesting rattled all of us in the community, from the intelligence community and the cyber community, where the implications were dramatic here. The fact that they're able to get in and have such a dramatic effect for as long as they did, even though that was relatively short of time, the amount of damage they could have done could have been dramatic.

And I think one of the theories here is that, you know, this was a test. This was not the attack. This was a test to see if this is something that could actually be done at a later date. Testing the integrity of an organization like Twitter to see if they can get an insider to actually do their bidding is-- is quite menacing. The scenario here is pretty bad.

So the question regarding, you know, who was-- who was sort of impacted and who wasn't, very good question. Not quite sure what the motivations are. I think this does drive back to who might be behind this. Is there a grander puppet master, so to speak, behind maybe these actors? Or were these actors working on their own? A lot of questions there.

BRIAN SOZZI: Karim, what would a-- what would a far worse attack on Twitter look like?

KARIM HIJAZI: Well, I think it really has to do with the content that was being delivered out. You know, as Alexis put it, this was something where they were saying give us X amount of bitcoin, we're feeling generous-- a lot of these tweets were fairly similar. They look like they were canned tweets-- and then we'll send you back double the amount you give us.

You know, that's juvenile. It doesn't seem like anything that was-- they probably didn't even expect, in many cases, a huge amount of return on their investment there. Unfortunately, it seems like they did. One of the Bitcoin wallets that was investigated seems like it only came online on Wednesday of this week. So it does seem like there's quite the coordination at play prior to the actual execution of the attack.

I think the greater scenario is what else they could have conceivably done. They could have, you know, put out a huge disinformation campaign about organizations, companies, public sector organizations that could have taken a huge tumble. A lot of folks rely on Twitter as a means of understanding where things are at any given moment. And so people make choices on a moment by moment basis with what they see on Twitter. So even one tweet could do huge amounts of damage in that regard.

ALEXIS CHRISTOFOROUS: Karim, do you think that this maybe is a precursor to what we might be in for come the 2020 election, which is just four months away? You know, there's been a lot of talk about are we going to see a repeat of 2016, but on a greater scale? And will we see a big cyber attack with misinformation as we get closer to the election?

KARIM HIJAZI: Definitely, Alexis. This is one of the first times I've seen something that's a true merger between a true cyber attack coupling pretty much all the hallmarks of a classic sophisticated actor. You've got social engineering involved. You've got certain amounts of payoffs. And you have a disinformation campaign, which is the greater scenario here.

So you're literally watching something where a technical resource was-- was exploited. And then the information that was conveyed out to the patrons of this product were-- was disinformation. So it is definitely a concern of ours that now these are, as I said, an early test to see if something like this could be leveraged at a much later date with much worse consequences.

ANDY SERWER: Karim, is this the worst attack on social media that you've seen? And/or does it remind you of anything else?

KARIM HIJAZI: I think this probably tops it. This is pretty big, because the nature of what they were able to do, which is to get to these what they would consider authentic accounts, the little icon next to the name of the individuals, and the fact that it was sustained, that they couldn't actually get in and take any action on their own accounts.

They had to sort of stop and come back, and say, look, just-- you can't reset your password. You can't tweet. Just have to shut you down for a little bit. There was also a few folks that attempted to warn others about that this was fraudulent, and their tweets were actually deleted by what looks like the adversary and then taken offline. So yes, the fact that there seemed to be such an immense amount of control behind the scenes is the part that makes this most concerning.

ALEXIS CHRISTOFOROUS: All right, Karim Hijazi, CEO of Prevailion. Thanks for being with us this morning.

KARIM HIJAZI: My pleasure.