New hacking details are a bad look for the SEC—and also for Elon Musk’s X | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

The Securities and Exchange Commission released new information about its colossal screw-up earlier this month that saw a hacker take over its social media account and briefly scramble the crypto markets by preempting news of an Bitcoin ETF decision. The details confirmed suspicions that the SEC, which has been going around fining firms with sloppy cybersecurity, failed to practice what it preaches. But the news also served as a reminder of how Elon Musk, since he bought Twitter and rebranded it as X, has undermined the security of the platform.

As for the hack itself, the SEC told Fortune and others on Monday that the debacle came about because someone at the agency got SIM swapped—meaning the hacker bribed or tricked someone at T-Mobile or another big carrier to transfer the cellular service, and the phone number associated with it, to their phone. SIM swaps are not always nefarious. You might, for instance, be leaving the U.S. and ask your carrier to transfer your number and account to your sister. But they usually involve something crooked.

SIM swaps are used for a variety of crimes but are especially common in the crypto world (shocking, I know) because they can help a hacker break into someone’s financial or social media accounts. This happens because taking control of someone’s cellular account lets the hacker intercept verification codes sent by text message. You’ve no doubt received such texts from your bank or Facebook or some other platform when trying to log in.

There was a time when SIM swapping was on the cutting edge of cybercrime, but that’s no longer the case. Today, it’s common knowledge among security professionals—and even among the general public—that text messages are a weaker form of multifactor authentication (a.k.a. MFA or 2FA), and that it’s better to use an app like Google Authenticator or Authy to verify an account. Even if a hacker gets hold of your cellular service, they won’t—unless they have your phone, too—be able to see the codes displayed in those apps.

Chair Gary Gensler and other senior people at the SEC no doubt knew that relying on text message-based verification is considered poor security, and that it would increase the chances of their X account getting hacked. Yet they didn’t bother to demand their staff use an authenticator app. Worse, the SEC admitted in their comments on Monday that, at the time of the attack, they had multifactor authentication disabled entirely.

This is a horrible look for Gensler, but let’s also save some of the blame for Elon Musk. Recall that, shortly after the billionaire took over Twitter, the platform disabled text message-based verification for all users unless they paid for its new paid subscription service. For cybersecurity professionals, this is deeply unethical and akin to a car dealer saying they will remove a customers’ seat belts unless they pay more for their monthly lease. Worse, Musk and X did nothing to remind customers—including the SEC—that their accounts were unprotected and push them to add MFA via an authenticator app.

In that spirit, I’ll confess the SEC is hardly alone in failing to properly lock down its X account. Following Monday’s news, I checked the settings on my account and found I, too, had failed to add an additional form of MFA since X removed text message validation early last year. I’ve since spent two minutes adding app-based MFA to my account. I suggest you do the same.

Jeff John Roberts

This story was originally featured on


Click Here For The Original Story From This Source.

National Cyber Security