Often, it’s as simple as plugging in a leaked password. It’s not a new technique, although it’s more often used to steal Bitcoin or high-value Instagram handles. In general terms, this kind of attack is called SIM hacking - essentially convincing a carrier to assigning Dorsey’s number to a new phone that they controlled. According to a Twitter statement, a “security oversight” by the provider let the hackers gain control. As a result, control of your phone number is usually enough to post tweets to your account, and most users have no idea.Ī “security oversight” by the provider let the hackers gain controlĪs it turns out, getting control of Dorsey’s phone number wasn’t as hard as you might think.

The system only requires linking your phone number to your Twitter account, which most users already do for separate security reasons. It’s a useful trick for SimplePhones or if you just don’t have access to the Twitter app. Using Cloudhopper, Twitter users can post tweets by texting messages to a shortcode number, usually 40404. The hackers got in through Twitter’s text-to-tweet service, operated by the acquired service Cloudhopper. Within 15 minutes, the account was back under control and the group was banned from Discord, but the incident was a reminder of the serious vulnerabilities in even the highest-profile accounts, and just how insecure phone-based authentication has become. A group of vandals had gained access to the account, and used that access to blast out a stream of offensive messages and plugs for their group’s discord channel.

Friday afternoon, Jack Dorsey’s 4.2 million Twitter followers got an unpleasant surprise.

Update sim card hack