Twitter accounts belonging to celebrities including Louis Theroux, Eamonn Holmes and Saira Khan were hacked on Thursday to expose a security flaw on the social network.
A message reading “This account has been temporarily hijacked by INSINIA SECURITY” appeared on several pages, in an effort to highlight an apparent vulnerability in the way Twitter uses text messages to secure accounts.
The security firm said the user had not lost access to their account and that none of their data was compromised during the exercise.
“We understood the way that Twitter handles incoming texts from your number,” researchers said in a blog post.
“If we can text from what appears to be your number then we can interact with, and fully control, your Twitter account.”
This account is now under the control of @InsiniaSRT. Luckily, this has been H4CK3D to highlight an important vulnerability. The user of this account has NOT lost access to it, no data compromised and is NOT under attack. See how it was done… https://t.co/RL7RscRxjH
— INSINIA SECURITY (@insiniasec) December 27, 2018
In tricking Twitter’s verification system, they were able to fully use the target’s account, the company claimed, meaning they could send tweets, direct messages, retweet and like tweets, as well as follow and unfollow people.
It warned that the easy hack could be used to ruin the reputations of people by covertly liking offensive or extremist material, and could risk the spread of fake news and disinformation.
“Twitter should completely remove this functionality as users rely on their phone added to account for two-factor authentication,” the company added.