You probably weren’t one of the few Twitter users, such as Bill Gates, Barack Obama and Elon Musk, who fell victim to a major hacking attack on Wednesday night.
And yet you may still be wondering if there’s anything you could have done to prevent your account from being hijacked.
In the latest of several high-profile Twitter hacks, scammers were able to tweet an invitation to make money as part of what was in fact a Bitcoin scam carried out with the hacked profiles of several people with millions of followers, among them US presidential candidate Joe Biden and Amazon boss Jeff Bezos.
Would you have been able to do anything to stop the hackers? Probably not.
We can assume these accounts were protected with complex passwords and two-factor login confirmation and that their levels of security weren’t to blame.
Instead, the attack is believed to have taken place through direct administrative access to Twitter’s systems.
Even if it may not have saved you in this instance, now is the time to check you have Twitter’s two-factor authentication (2FA) activated, a kind of second protective wall which almost all online services now offer for additional security.
Password can be weak, guessed or captured. That’s why users should use 2FA which lets you confirm any login to your account using an authentication app on the smartphone or a security USB stick on the computer.
After entering a password, the account can only be accessed when you enter a specific code generated by the authentication app or USB stick.
Attacks on this level are rare and 2FA should still offer adequate protection against most efforts to break into your Twitter account.
If you haven’t done so already, you can turn on 2FA in the settings of your Twitter account.
You should be wary of the third 2FA option available in Twitter, however: SMS codes. Until November 2019, this was the only 2FA method offered by Twitter. However, it had not been used by many users due to security concerns.
Attackers have already succeeded in ordering a replacement SIM card from the provider in the name of their victim, copying the victim’s SIM card or intercepting a card that was ordered.
They then sent an SMS to Twitter requesting a code to reset the password, which eventually took over the victim’s account.
