This account has been hijacked (temporarily)!

Dec 27, 2018 · 3 min read

Not this Medium account… Celebrity & Verified Twitter accounts, like the ones you read the tweet from!

If you’re reading this then you’ve probably seen some of our research on Twitter, where INSINIA SECURITY successfully hijacked the accounts of a number of celebrities, including Eamonn Holmes & Louis Theroux.

Image for post
Image for post
Louis Theroux’s Twitter account being controlled by Security Researchers @ INSINIA Security.

Some of you may know that INSINIA have been highlighting the security issues around text messages and the use of the cell network for authentication, interaction and even communication in everyday life for over 7 years, when INSINIA wrote one of the first tools for spoofing the MSISDN within text messages.

Image for post
Image for post
Eamonn Holmes, popular UK TV and Radio Host was also susceptible to the attack.

Back in March, we warned about the issues of using text messages for security. In fact, we warned about using them for pretty much anything!
See here:

Then in November, we highlighted the same issue again:

So what did Twitter do? Well they allowed anyone with your phone number to Tweet from your account.

Here’s how:

  1. We understood the way that Twitter handles incoming texts from your number. If we can text from what appears to be your number then we can interact with, and fully control, your Twitter account.
  2. We needed numbers! This was surprisingly easy, but we won’t disclose exactly how we did it here.
  3. We spoofed commands from those numbers to Twitter, following this handy guide:
  4. We used this method to successfully control the targets Twitter account, allowing us to send Tweets, retweet and like tweets, follow and unfollow people and much more!

How it could be abused by nation states, hackers and organised crime groups:

  • Ruin the reputations of people & organisations by retweeting offensive/extremist material
  • Spread fake news and disinformation via influential celebrities and journalists
  • Covertly like tweets so that the likes show up on feeds - again this could be used to like offensive/extremist material to ruin reputations and like fake news and/or products/services from companies to influence the general public
  • Send direct messages to trusted contacts in the victims network to socially engineer people into clicking links that will install advanced malware to remotely control devices and monitor the users
  • Tweet a link to an attacker controlled site that will silently install malware on users PC, phones or tablet with no user interaction
  • Direct message an attacker controlled account with content that could be used to blackmail, harass or harm the victim

Taking this to the next level:

  • Enumerate data dumps and harvest valid Twitter accounts
  • Socially engineer people to get their account numbers
  • Use as a propagation method for malware, virus will look for numbers on the phone, tablet or PC and see if any belong to accounts, if so send a message to all users contacts to infect their network


  • Remove your number from your Twitter account
  • Twitter should completely remove this functionality as users rely on their phone added to account for two-factor authentication
  • Twitter should also decouple your phone number — using your number for TFA should not automatically allow you to Tweet from that number, especially with SIM Swap attacks becoming more prevalent.



Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store