Today at around 1pm EST, Associated Press (AP) sent out a tweet that the White House had two explosions and that the President was injured during the attack. It turned out to be false news. Their twitter account had been hacked. What makes AP significant is that they are the first to get a round of questions during White House press conference meetings. Therefore anything reported by AP generally holds far greater credibility than most news outlets.
Fig 1: Tweet sent on AP twitter feed.
Now, make no mistake about this event; it is very serious and remains the very first of its kind whereby a false news event triggered by a cyber attack through social engineering has resulted in such outcome. Yes, we have had numerous stories of late about corporations’ twitter accounts getting hacked – Burger King, Jeep, just to name a few, but this one stands out by a long shot. What may appear to be a trivial event incident on AP twitter account led to flash crash in the market. One single tweet led to S&P losing 136billion in value within 3 minutes before it recovered after news was verified as false.
Fig 2: Flash crash triggered in S&P 500 after the fake news broke at 1:07pm. It lasted 4 minutes.
As highlighted in my last post on measures now being taken by the government to contain cyber threats in the interest of national security, the paradigm of security and al it encompasses is clearly shifting. Perimeter controls such as conventional firewalls are no longer enough to protect and guard flow of sensitive information and passwords as form of authentication is fast becoming obsolute. Advance Persistence Threat (APT) is undermining old way of protecting information and who has access to what. In this particular case, how was the hacker been able to obtain Twitter account of Associated Press journalist to make that post? There is obviously a huge gap in security strategy that does not currently include mediums outside of the perimeter.
Also, can we trust social networking sites such as Twitter, Facebook and LinkedIn to be responsible to ensure accounts which are tied to institutions do not end up in the wrong hands? One thing is for sure; Security strategies can no longer be confined to simply provide controls around the physical perimeter. The Internet is now making the world truly flat, whereby everything is connected. Threats posed by social networks to national security can no longer be ignored.