DoubleSwitch: Social networks are undoubtedly a quick and easy way to distribute information that is often untrue, as we have seen on Facebook and Twitter.
Disinformation or “Fake News” has emerged as a primary issue for social media platforms, reportedly affecting millions of users with propaganda news and irrelevant lies.
Although major social networks such as Facebook, Twitter, and Google have verified accounts with a blue tick for public figures, we have seen hackers target these accounts to spread fake news to their millions of followers.
Security researchers have discovered a new attack technique currently being used by hackers to take control of verified Twitter accounts to spread fake news.
The attack is called DoubleSwitch, and it starts by stealing a simple account. The hackers then change the username to someone with a lot of influence on social media.
According to a post by digital rights group Access Now, hackers are targeting Twitter accounts belonging to journalists, activists, and human rights defenders in Venezuela, Bahrain, and Myanmar. Some of them are verified accounts with large followings.
This attack was discovered when two journalist accounts (Milagros Socorro and Miguel Pizarro), members of the Venezuelan parliament, disappeared and were subsequently renamed.
The hacker then began posting under a new account name, which resembled his original profile, and the original usernames, but using email addresses controlled by the attacker.
This means that every time victims tried to recover their accounts using the password reset option, confirmation messages were sent to the hacker, making it almost impossible for victims to recover their account.
It is currently unclear how hackers manage to take over verified user accounts, but it is believed that the attack begins with malware or phishing attacks.
What do you do if your account is stolen?
Twitter offers an alternative way to recover your account with an online form. You can use it to report hacking incidents directly to the Twitter team. The social network's technicians review and investigate the issue to help victims recover their accounts.
Using this method, Access Now helped journalists regain access to their accounts.
Access Now reports that the DoubleSwitch attack can take place on Facebook and Instagram, but users can protect themselves by enabling the two-factor authentication feature offered by the services.
However, two-factor authentication is not a solution for journalists, activists, and human rights defenders in countries like Venezuela, as they do not want to link their personal information, such as their phone numbers, to their online accounts.
