Hello world, a hacker involved in the massive 2020 Twitter breach has just pled guilty to
his involvement and is facing 77 years in prison.
The breach almost feels like ancient history now, but at the time it caused absolute chaos.
On July 15th of 2020, 130 high profile Twitter accounts including that of Apple, Uber, Joe
Biden, and even Twitter’s future owner Elon Musk were compromised and repurposed for your
typical unimaginative crypto scam - whatever bitcoin sent to the given address would apparently
be doubled.
350 million people saw the tweets, but only 415 people fell for them, shelling out 11
bitcoin in total, worth roughly $100k at the time.
Which is absolutely nothing compared to the potential punishment if those behind this
were caught.
According to Twitter, this hack was made possible via a “Coordinated social engineering attack”,
“[Targeting] … employees with access to internal systems and tools”.
More specifically the miscreants searched LinkedIn for Twitter employees thought to
have access to these mysterious admin tools, and then obtained their phone numbers by posing
as recruiters.
Our miscreants then called the employees, impersonating Twitter admins, convincing them
to log into a phishing page mimicking an internal Twitter VPN.
After gaining their credentials, the hackers essentially had godmode over pretty much any
Twitter account, which included the ability to change an account’s email address, and
remove multi factor authentication.
Funnily enough, the screenshots of admin tools leaked to media inadvertently revealed the
apparent presence of shadow banning at Twitter, however our hackers weren’t activists, they
were after cold hard cash.
But before launching the operation that made Twitter history, the miscreants instead focused
their efforts on making money by selling access to any twitter account for $250 on OGUsers
- a forum dedicated to account hijacking.
And this is where our recently found guilty cyber criminal comes in… the role of Joseph
James O'Connor, aka 'PlugwalkJoe’’ was trafficking in stolen accounts.
One account he was accused of keeping for himself was @6, a handle owned by the hacker
“Adrian Lamo”, who’s best known for turning in Chelsea Manning.
As is often the case with cyber criminals, they have a bad time keeping their mouth shut…
and just days after the Twitter hack - in what seems to have been purely an ego-boosting
exercise, “Plugwalkjoe” along with his co-conspirators agreed to an interview with
the New York times, they quite literally handed over screenshots of their Discord conversations,
proving their involvement - and in response to “Plugwalkjoe” being asked if he was,
I dunno, worried about being held to account for his role in what was the biggest Twitter
hack of all time, he replied “They can come arrest me.
I would laugh at them.
I haven’t done anything.”, which of course turned out to be famous last words, because
they did arrest him, I can’t imagine he did much laughing, and it turns out he was
guilty of quite a bit.
The least of which was his involvement in the Twitter hack.
You see, Plugwalkjoe is, or well, should I say was - a prolific SIM swapper.
SIM swapping a unique form of cyber crime, because whilst most cyber crimes exist purely
online - SIM swapping has a physical component, SIM cards.
As such the irl nature of it seems to invite a certain element of typical organised crime,
violence.
There’s cases of SIM swappers being kidnapped, guns held to their head and so on - and it
would seem Plugwalkjoe isn’t a stranger to the dirtier side of SIM swapping.
It’s claimed in his arrest warrant that whilst he is a UK citizen, he actually moved
to Spain due to death threats.
In one of his SIM swapping escapades Plugwalkjoe targeted 3 executives of a crypto company,
before stealing almost 800 thousand dollars worth of crypto from their accounts.
He was also accused of targeted SIM swap attacks against the owners of high profile TikTok
and Snapchat accounts, on one occasion attempting to extort the owner with stolen newds.
But the thing that brought Plugwalkjoe’s world crashing down around him was just how
easy he made it for the FBI to track him down.
The overlap in IP addresses used to access his personal accounts, along with the accounts
he used for his cyber criminal activities is borderline comical… usually law enforcement
just points outs a couple of instances where someone messed up, but here there’s a whole
spreadsheet spanning two pages.
And if you perform lookups on these IPs you’ll find a lot of them point to the M247, an ISP
which many VPN services use.
So Plugwalkjoe was trying to cover his tracks with VPNs, but it seems like he was under
the false impression, which a lot of people are, that a VPN is some kind of magic machine
which hides your identity no matter what.
Which obviously isn’t the case, by failing to rotate his IP, he created a web of connections
between the accounts he used for illegal activities, and in turn linked them to accounts which
quite literally use his real name.
But even if his opsec was perfect in the technical sense, the guy often changed the names and
bios of the accounts he hacked to incorporate his own name.
And sometimes he even shouted out his own accounts in an attempt to leech a few followers.
In the last couple of days Plugwalkjoe, AKA Joseph James O'Connor has pleaded guilty to
an array of offences, and he’s now facing 77 years in prison, though this is more of
a technical limit, it’s more realistic he’ll get between 10 and 20.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
Sign up now using the link in the description to get a $5 coupon, which can be used site
wide.
As always thanks for watching and I’ll see you in the next video, have a good one!