Month: July 2020

The hackers behind this month’s epic Twitter breach targeted a small number of employees through a “phone spear phishing attack,” the social media site said on Thursday night. When the pilfered employee credentials failed to give access to account support tools, the hackers targeted additional workers who had the permissions needed to access the tools.

“This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems,” Twitter officials wrote in a post. “This was a striking reminder of how important each person on our team is in protecting our service. We take that responsibility seriously and everyone at Twitter is committed to keeping your information safe.”

Thursday’s update also disclosed that the hackers downloaded personal data from seven of the accounts, but didn’t say which ones.

The post was the latest update in the investigation into the July 15 hack that hijacked accounts belonging to some of the world’s best-known celebrities, politicians, and executives and caused them to tweet links to Bitcoin scams. A small sampling of the account holders included former Vice President Joe Biden, philanthropist and Microsoft founder and former CEO, and Chairman Bill Gates, Tesla founder Elon Musk, and pop star Kanye West.

It took hours for Twitter to return control of the accounts to their rightful owners. In some cases, the hackers regained control of accounts even after they had been recovered, resulting in a tug of war between the intruders and company employees.

Hours after containing the breach, Twitter said the incident was the result of it losing control of its internal administrative systems to hackers who either paid, tricked, or coerced one or more company employees. Company officials have provided regular updates since then. The most recent one came last week, when Twitter said the hackers used their access to read private messages from 36 hijacked accounts and that phone numbers and other private messages from 130 affected users were viewable.

Free employee rein

Critics said the incident showed that Twitter hasn’t implemented proper controls to prevent sensitive user information from falling into the hands of company insiders or people who target them. Twitter has vowed to investigate how the outsiders gained access to sensitive internal systems and take steps to prevent similar attacks in the future.

Thursday’s update provided more color about how internal systems and account tools work. It said:

A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all of the employees that were initially targeted had permissions to use account management tools, but the attackers used their credentials to access our internal systems and gain information about our processes. This knowledge then enabled them to target additional employees who did have access to our account support tools. Using the credentials of employees with access to these tools, the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7.

The update said that since the attack, the company has “significantly” limited employees’ access to internal tools and systems while the investigation continues. The restrictions are primarily affecting a feature that lets users download their Twitter data, but other services will also be temporarily limited.

“We will be slower to respond to account support needs, reported Tweets, and applications to our developer platform,” the update said. “We’re sorry for any delays this causes, but we believe it’s a necessary precaution as we make durable changes to our processes and tooling as a result of this incident. We will gradually resume our normal response times when we’re confident it’s safe to do so. Thank you for your patience as we work through this.”

Thursday night’s post also said that the company is accelerating unspecified and “pre-existing security workstreams and improvements to our tools” and prioritizing security work across various teams. Twitter is also improving ways to detect and prevent “inappropriate” access to internal systems.

Nonprofits and local politicians are lining up to support a Charter Communications petition that would let the ISP impose data caps on broadband users and seek interconnection payments from large online-video providers.

Charter filed the petition with the Federal Communications Commission last month, asking the FCC to eliminate merger conditions applied to its 2016 purchase of Time Warner Cable two years early. If Charter’s petition is granted, the company would be able to impose data caps on its Spectrum broadband service and charge network-interconnection fees to video providers after May 18, 2021, instead of in May 2023 as scheduled.

With the FCC seeking public comment, the docket is overwhelmingly filled with consumers urging the commission to oppose Charter’s request for permission to limit consumers’ data usage and charge data-overage fees. “In this age of Internet communication, data caps are an unscrupulous way to gouge money from clients, many of whom do not have alternative Internet sources. This is unacceptable,” one person wrote in a sentiment echoed by hundreds of other Internet users who wrote to the FCC in the past few weeks.

But alongside the angry users of Spectrum Internet service are a number of politicians and charities urging the FCC to grant the petition. Charter has donated to these nonprofits and politicians, and it has apparently made a big outreach effort to get their public support for the petition. Many of the letters to the FCC echo Charter’s argument that it shouldn’t be treated differently from other Internet providers that don’t face such conditions—even though Charter willingly agreed to them in order to secure approval for a merger that made it the second-largest ISP in the United States after Comcast. The letters from nonprofits and politicians ignore the negative impact data caps would have on broadband customers.

The letters continue a years-long trend in which ISPs have been donating to charities and receiving their support in lobbying campaigns to complete mergers and eliminate consumer-protection regulations.

Charter told Ars last month that it doesn’t “currently” plan to impose data caps or change its interconnection policy. Instead, it merely seeks “a level playing field so that we can continue to grow and provide superior service to our customers across the country.” But if Charter had zero intention of imposing data caps or changing its interconnection policies, there would be no reason to spearhead a big lobbying effort involving charities and politicians.

Charter’s petition likely has a good chance at the Republican-majority FCC. FCC Chairman Ajit Pai voted against the conditions when they were imposed in 2016 under then-FCC Chairman Tom Wheeler, an Obama nominee. The FCC conditions were designed to prevent Charter from hindering online video providers that compete against the company’s cable TV service. Any FCC order that lifts the merger conditions two years early would likely cite arguments from the various filings supporting Charter’s case. May 18, 2021 is the earliest date on which the conditions can be eliminated under the original terms of the merger approval.

Nonprofits are ready for data caps

FCC filings submitted by charities and community groups discuss the donations Charter gave them. The Boys & Girls Club of Harlem told the FCC it received a $35,000 grant from Charter this year for a learning lab and that “we are happy to support Charter as they seek to sunset two merger conditions—one on data caps and usage-based pricing and the other on interconnection.”

The Boys & Girls Club of the West Valley in Canoga Park, California, told the FCC that Charter gave 10 Samsung Galaxy tablets to the club and that “it only seems fair to level the playing field for Charter so they can have the same opportunities to grow as companies similar to them.” Other Boys & Girls Club chapters supporting Charter after getting donations include ones in Fremont County, Colorado; Schenectady, New York (which received a $75,000 donation); and Niagara Falls in New York.

A US Veterans Corps filing in support of Charter’s petition notes that the ISP “is a major supporter of our Operation Coming Home initiative, which provides new homes to troops who have been injured or families of fallen in combat operations.” The veterans group said it is “happy to endorse their effort at the Federal Communications Commission (FCC) to remove two conditions from the merger.”

The Marshfield Clinic Health System in Wisconsin told the FCC of Charter’s involvement in fundraising efforts and its provision of Internet service to clinics.

“Most of our facilities rely on a single provider for Internet and telecommunications needs: Charter Communications. That is why I am writing today to support Charter’s recent petition to have its merger conditions sunset,” the health system’s Chief External Affairs Officer Ryan Natzke wrote. “I believe Charter should receive the same treatment as other providers, and I support a fair foundation for them in the marketplace,” Natzke wrote later in the same letter.

From New York to California

The YWCA of Syracuse and Onondaga County in New York told the FCC that it got $20,000 from Charter “to help with our computer lab and summer program” and that “we support their request to the FCC to sunset their merger conditions.”

Charter’s petition got support from the Albany, New York, branch of the NAACP, which told the FCC that it received a $10,000 grant from Charter to support a youth mentoring program. The group noted that the COVID-19 pandemic has been especially difficult on children who lack home-Internet access, adding that eliminating the merger conditions “will allow [Charter] to continue and enhance their efforts to bridge the digital divide in minority and low-income communities.”

Other community groups that supported Charter’s petition after receiving donations from the ISP include the Child Development Center of Natrona County in Wyoming; the California Latino Leadership Institute; Literacy Rochester in New York; and St. Louis Arc.

About 30 chambers of commerce are also supporting Charter’s request at the FCC.

Regarding its connection to local charities, Charter told Ars in a statement, “Our business is inherently local and we are committed to improving the communities we serve and impacting lives where our customers and employees live and work. These efforts include long-term relationships with local leaders and philanthropies, programs focused on engagement, philanthropic and in-kind support, and employee volunteerism. We are proud to support these important efforts and all they do to enhance the lives of millions each year.”

Politicians make Charter’s case

Now let’s take a look at state lawmakers who support Charter. Bryan Hughes, a Republican state senator in Texas, told the FCC that “Charter is a good corporate citizen” and “need[s] to be on a level playing field with their fellow providers” in order to continue “invest[ing] in our communities.” Charter is one of Hughes’ top donors, having given $12,500 in the current election cycle, according to campaign-finance tracker Vote Smart.

State Sen. Richard Funke, a Republican in New York who received $11,000 from Charter, told the FCC that there has been “no effort by Charter to stifle online video distributors” and that “I am confident that the previous conditions laid out by the FCC can officially be rolled back in May of 2021.”

State Sen. Dan Quick, a Nebraska Democrat who got $3,500 from Charter, told the FCC that he “fully support[s] a level playing field for Charter so it can operate the same as all other providers and continue to deliver critical services to American businesses and families.”

State Rep. Dan Zwonitzer, a Republican in Wyoming, urged the FCC to eliminate the merger conditions “so good corporate citizens like Charter can continue investing in communities like mine.” Zwonitzer received $300 from Charter.

The National Black Caucus of State Legislators, which represents more than 700 legislators, said it “is pleased to support the sunset of the two remaining merger conditions.” Charter has supported Black communities with diverse hiring and programming as well as “a $10 million investment to support Black and other minority-owned small businesses in underserved communities,” the letter to the FCC said. The letter was written by Caucus President Gilda Cobb-Hunter, a Democratic state representative in South Carolina. All eight members of the group’s executive committee are Democrats.

Other state lawmakers who received donations from Charter and supported the petition include State Sen. Affie Ellis, a Wyoming Republican who received $200 from Charter; State Rep. William Sutton, a Kansas Republican who received $500 from Charter; and State Sen. Dee Brown, a Republican in Montana who received $170 from Charter. Brown told the FCC that the merger conditions “are no longer necessary” because “there is sufficient competition” between cable TV and online video providers.

Charter has opponents, including Mass. AG

Charter customers are not the only ones opposing the petition to eliminate merger conditions. The petition received opposition from the Writers Guild of America, West, which said that “Charter has a history of bad-faith behavior regarding merger conditions” and pointed to Charter’s failure to comply with broadband-deployment requirements imposed by New York State. In that case, Charter agreed to pay $12 million toward new broadband deployments in a deal that gave the ISP an extra year to comply with the original requirements.

Newsmax and Entertainment Studio Networks also opposed the Charter petition.

Massachusetts Attorney General Maura Healey told the FCC that granting Charter’s request would go against the public interest because of the pandemic, increasing use of broadband, and “Charter’s position as the sole fixed-broadband provider in almost all of its Massachusetts territories.”

“It would be somewhat perverse if less than a year from now—when Massachusetts residents may very well still be relying on broadband to maintain all aspects of their lives—Charter imposes data caps or pricing models on captive customers that dramatically increase the price of broadband for the average household,” Healey wrote.

Advocacy groups Public Knowledge and the Sports Fans Coalition opposed Charter’s petition as well. The FCC found during the 2016 merger review that Charter had “incentive and ability to restrict its customers’ ability to access competing video services,” and Charter has provided no evidence that this has changed, the groups said. “Charter has the incentive and ability to restrict its customers from accessing the online video services of their choice, charging them more if they do so through the discriminatory application of data caps, and through causing OVDs [online video distributors] to raise their rates to consumers by charging them access fees,” the groups said.

The first round of public comments on Charter’s petition expired on July 22, and reply comments are due by August 6. Comments can be filed on the docket by clicking “New Filing” or “Express.”

Disclosure: The Advance/Newhouse Partnership, which owns 13 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica.