Alpha Team Research: ChucklingSquad, Jack Dorsey and SIM Swaps

On 30 August 2019, Jack Dorsey, the CEO of Twitter, had his Twitter account hacked. The actors who compromised the account controlled it for only a few minutes, but managed to send dozens of tweets containing racist language, a bomb threat and shoutouts to the "hacker" group. The account, @jack, has over 4 million followers, and according to a tweet (https://twitter.com/TwitterComms/status/1167591003143847936) by a Twitter spokesperson, "The phone number associated with the account was compromised due to a security oversight by the mobile provider. This allowed an unauthorized person to compose and send tweets via text message from the phone number. That issue is now resolved". The tweets by @jack were being posted via the Cloudhopper app, which means it came from someone texting the 40404 number to tweet on Dorsey's behalf.

Recommendations

Authenticate your organization's Twitter accounts with ZeroFOX and enable Hacked Account Post, which now contains the actor groups signatures
Review the whitelist of Twitter applications on ZeroFOX and uncheck "Cloudhopper" as a trusted app. Enable the Unauthorized Application rule which will alert if someone SIM swaps your protected accounts and tweets via the Cloudhopper app
Enable the Cyber Attack Chatter rule and add monitoring for the actor group, with the indicators listed under Details
Work with your ZeroFOX Account Manager and Platform Specialists to ensure protection of all of your social accounts

Details

The group, ChucklingSquad, has been on an account takeover tear for the last 2 weeks. On August 23rd, 2019, influencers Amanda Cerny, Etika and Shane Dawson's Twitter and Instagram accounts had been hacked. The actors tweeeted at Youtube influence Keemstar via Shane Dawson's hacked account and bragged about "intel on jake Paul" [sic] and other influencers. It seems that their modus operandi is to perform a SIM swap attack against their victims. A SIM swap attack is where an attacker socially engineers a mobile phone company employee to transfer the "SIM" card from the account owner to an attacker controlled phone. Using the phone number that they just took over, SIM Swappers can easily reset passwords, take over accounts and in this case, post on behalf of the victim.

Each Twitter and Instagram profile contained offensive tweets or posts that clearly broke Terms of Service on the networks. The goal up to that point looked to be to gain notoriety and to troll the community with their account takeovers. KingBach, an influencer and a verified account on Twitter, made a video(https://twitter.com/KingBach/status/1165108429641224192) shortly after his hack that blamed AT&T for allowing hackers to easily takeover his phone number. James Charles made a similar tweet blaming his mobile company.

James Charles

On or around 1600 on August 30, Dorsey's account was hacked.

Dorsey1

The account contained a bomb threat, racist words, retweets of alleged members of ChucklingSquad, and a link to their Discord server. User's began tweeting out invites to the discord which were quickly banned by Twitter. The Discord server appears to be disabled now as well.

One of Dorsey's tweets called out specific members of ChucklingSquad, asking for them to be unbanned:

Unbanned

Alpha Team has HIGH confidence that this was the result of a SIM swap attack. The app, Cloudhopper, is used to activate SMS based tweets and account management for Twitter users. Dorsey's tweets did indeed come from the Cloudhopper app, and due to the previous ChucklingSquad hacks, it would be the easiest way to tweet on Dorsey's behalf without compromising his password or email address. If a user sets up 2-factor authentication with their phone number in Twitter, they are automatically enrolled into this SMS service. This auto enrollment is common amongst social networks, and Facebook faced (https://www.facebook.com/notes/facebook-security/fixing-sms-notifications-for-those-using-two-factor-authentication/10155124741945766/) backlash of this auto enrollment feature and turned it off for users.

The specific accounts listed in the previous tweet are now banned, but ZeroFOX Alpha Team performed an investigation on the aliases. Plugwalkjoe is a name that has been attributed to an OGUser account, j0e, and has made a number of enemies that try to dox him.

Post from pastebin, PII removed:

*FOR THE IMMEDIATE ATTENTION OF REACT TASK FORCE - SANTA CLARA*

Hello,

I am writing in regarding Sim Swap attacks. I have gathered intelligence of how the 
 scheme works, and have discovered who is behind "Chuckling Squad".

Debug from the United Kingdom
He is also responsible for the rumored theft of $60K+ in cryptocurrency.
https://twitter.com/bug
https://ogusers.com/dewdnuioed

Gurv from the United Kingdom
Responsible for the theft of over $1M in cryptocurrency.
Full name - redacted 
Address -  redacted
Date Of Birth: redacted 
https://ogusers.com/gurv [banned]
https://instagram.com/L

Plugwalkjoe from the United States or United Kingdom. I am not sure.
https://ogusers.com/j0e
https://instagram.com/L
Face - redacted 

Plugwalkjoe is responsible for hundreds of illegal sim-swaps, and plays the role of 
 the "plug". Plugwalkjoe activates sim cards for the thieves or trolls. 
He can do this for any major carrier, from Verizon to AT&T and T-Mobile.

From what I know, members Debug and Gurv provide the P.I.I (Personal Identifying Information) to member Plugwalkjoe, 
who then performs the alleged "sim swap", 
activating another unknown member's sim-card, who provides the SMS verification codes to 
reset passwords to members Debug, Gurv or Alpha.
I have not scooped up any information yet on Alpha, but I am on it! I will be keeping in touch, 
and awaiting an article stating that these bad guys were locked up.

Even Brian Krebs, a well-established cybersecurity reporter, is aware of Plugwalkjoe's antics (https://krebsonsecurity.com/2018/11/bug-bounty-hunter-ran-isp-doxing-service) dated in November of 2018.

A post by Krebs in response to someone commenting on "plugs":

Right. That’s why Phobia has friends like @Plugwalkjoe who chides Phobia and 
his Team Hype friends for dropping valuable methods for hacking accounts.

https://twitter.com/CoolItsConvict/status/1045849836124278785

Account takeover is alive and well. SIM Swap attacks are extremely effective, especially in the account takeover community, because once an attacker controls a phone number, they can reset passwords via text messages and through phone calls. The reliance on phones as an authentication mechanism is an antiquated idea, solely because mobile companies have been notorious for not adhering to anti-social engineering protocols.

Many account takeover forums, especially OGUsers, specialize in recruiting mobile employees to perform SIM swaps as well as providing training for wanna-be swappers to perform these attacks. The recent hack of OGUsers hasn't deterred people from still using the site, and with the current attribution of some of the ChucklingSquad users back to OGUsers, it seems to be still going strong.

Indicators of Compromise:

Hashtags

#chuckling
#chucklinghella
#chucklingsquad

Twitter Accounts

@plugwalkjoe
@percocet
@99