Is it safe to use Twitter? Security fears rise after Elon Musk drives off staff

“They’re just wounded right now,” said Austin Berglas, a former FBI cybersecurity official in New York who’s now a consultant at security firm BlueVoyant.

“They’ve lost a lot of important players on the field, so I think people are going to try to exploit them while they’re down,” he said.

Berglas said the threats were likely to come from scammers and organized crime, as well as from hostile governments looking to exploit a fluid situation.

San Francisco-based Twitter did not immediately respond to a request for comment on the security situation at the company.

Mountains of information

Twitter stores mountains of personal information, including not just email addresses and passwords but data that’s inside its direct-message inboxes — a feature that does not have the end-to-end encryption that helps protect other popular messaging services.

The service for years has relied on its blue-checkmark verification system to increase confidence in the reliability of information on the platform, but impersonations and hoaxes proliferated this week after Musk attempted an overhaul of the system.

At the same time, Twitter is facing increased scrutiny from lawmakers and the Federal Trade Commission, which has a longstanding agreement with Twitter to ensure privacy protections.

Ian Brown, a former senior engineering manager at Twitter, said in an online public discussion Friday that the lack of a fully staffed security team could lead to the site not functioning properly or users losing control of their accounts.

“There are security vulnerabilities happening all the time,” Brown said in a Twitter Spaces event. 

He echoed a pessimistic view among some Twitter users this week: The service might go down entirely under Musk’s ownership. But he said the scams were a more immediate problem.

“Maybe Twitter doesn’t go down before every account has been pwned by a crypto scam,” he said, using a euphemism for being hacked. Brown didn’t respond to a request for comment.

Proofpoint, a company that tracks online fraud, said it had detected a “notable” increase in scammers operating on Twitter including a ruse designed to drain people of their savings.

Sherrod DeGrippo, the vice president of threat research and detection at Proofpoint, said one scam the company has tracked involves fraudsters sending Twitter users bulk direct messages, purportedly offering them work and encouraging them to speak with a young woman on the largely unregulated social media platform Telegram.

But those messages are actually introductions for an elaborate scam that tries to convince people to drain their savings by telling them they’re investing in cryptocurrency, DeGrippo said.

Scams were already an issue on Twitter, as they are on many major social media websites. But some changes Musk made opened the door to making them worse.

Verification service

On Friday, Twitter paused the rollout of its Twitter Blue verification service, intended to let users pay $8 a month for a verification badge. Many users who signed up promptly changed their usernames and profile pictures to impersonate famous people and brands, leading to confusion on the site and Twitter to suspend the service.

Marc Rogers, a cybersecurity industry veteran and chief security officer of Q-Net Security, questioned Twitter’s decision to roll out such a fundamental change so quickly and with little testing. Trust-and-safety teams exist to prevent that, he said.

“The debacle with the Twitter verification is a really strong indicator as to what can go wrong,” Roger said.

“You know, it’s comedy to see posts from George Washington, from Jesus, from ‘Elon’ himself allegedly, but at the same time it’s terrifying. Because how do you know what’s the truth?” he said.

Rogers said that by leaving users with less protection, the company is taking on greater risk.

“At the end of the day, security staff is not just there to protect the user, although that’s like a critical part of it. They’re there to protect the company from assault from all sorts of directions,” he said. “They’re the guardrails that prevent companies from going off those cliffs.”

Previous scams and hoaxes

There’s precedent for Twitter’s use for large-scale scams and hoaxes.

In 2020, in one of the most visible hacks of an American company in years, a handful of cryptocurrency scammers tricked Twitter employees into giving them access to key company controls. They proceeded to take over many of the highest profile accounts on the site, including Musk’s and now-President Joe Biden’s, forcing those accounts to post a request for bitcoin.

“When the verified Twitter users got hacked a few months ago, it was only a bitcoin scam, right?” Rogers said. “But think about the possibilities of if you can take control of the voices of some of the most influential people in the world. It is actually kind of terrifying just how bad it could be.”