Three middle-aged Dutch hackers slipped into Donald Trump's Twitter account days before 2016 US election

The Orange One was using a password breached four years previously


Three “grumpy old hackers” in the Netherlands managed to access Donald Trump’s Twitter account in 2016 by extracting his password from the 2012 Linkedin hack.

The pseudonymous, middle-aged chaps, named only as Edwin, Mattijs and Victor, told reporters they had lifted Trump’s particulars from a database that was being passed about hackers, and tried it on his account.

To their considerable surprise, the password – but not the email address associated with @realdonaldtrump – worked the first time they tried it, with Twitter’s login process confirming the password was correct.

The explosive allegations were made by Vrij Nederland (VN), a Dutch magazine founded during WWII as part of the Dutch resistance to Nazi German occupation.

“A digital treasure chest with 120 million usernames and hashes of passwords. It was the spoil of a 2012 digital break-in,” wrote VN journalist Gerard Janssen, describing the LinkedIn database hack. After the networking website for suits was hacked in 2012 by a Russian miscreant, the database found its way onto the public internet in 2016 when researchers eagerly pored over the hashes. Critically, the leaked database included 6.5 million hashed but unsalted passwords.

Poring through the database, the trio found an entry for Trump as well as the hash for Trump’s password:

07b8938319c267dcdb501665220204bbde87bf1d

Using John the Ripper, a hash-reversing tool, they were able to uncover one of the Orange One’s login credentials; the password was yourefired. Some considerable searching revealed the correct email address (twitter@donaldjtrump.com – a different one from the one Trump used on LinkedIn and which was revealed in the aforementioned hack)… only for the “middle aged” hackers to be defeated by Twitter detecting that the man who would become the 45th president of the United States had logged in earlier from New York.

One open proxy server later, they were in.

VN published screenshots supplied by the three showing a browser seemingly logged into Trump’s Twitter account, displaying a tweet dating from 27 October 2016 referring to a speech Trump delivered in Charlotte, North Carolina, USA.

The Dutch hackers also alleged that they found Trump’s details in a database hacked from Ashley Madison, a dating website aimed at cheating spouses. Amusingly, just 1.4 per cent of its 31 million users were actual women.

Despite trying to alert American authorities to just how insecure Trump’s account was (no multi-factor authentication, recycled password from an earlier security breach) the hackers’ efforts got nowhere, until in desperation they tried Netherland’s National Cyber Security Centrum – which acknowledged receipt of their prepared breach report, which the increasingly concerned men had prepared immediately once they realised their digital trail was not particularly well covered.

“In short, the grumpy old hackers must set a good example. And to do it properly with someone they 'may not really like' they think this is a good example of a responsible disclosure, the unsolicited reporting of a security risk,” concluded VN’s Janssen.

Professor Alan Woodward of the University of Surrey added: “It’s password hygiene 101: use a different password for each account. And, if you know a password has been compromised in a previous breach (I think LinkedIn is well known) then for goodness sake, don’t use that one. [This is] a textbook example of credential stuffing.” ®


Keep Reading

Donald Trump thought-bubbles an Alibaba ban as Chinese clouds clam up about Clean Cloud plan

President says ‘other’ Chinese companies could feel the ban-hammer

Former HP CEO and Republican Meg Whitman – who split HP with mixed success – says Donald Trump can't run a business

Vows to vote for Democrat Joe Biden instead - as will ex-HP chief Carly Fiorina

Dutch officials say Donald Trump really did protect his Twitter account with MAGA2020! password

And no, we’re not going to prosecute the bloke who found out

Microsoft confirms pursuit of TikTok after Satya Nadella chats to Donald Trump

‘Appreciates President Trump’s personal involvement’ and promises so much security, you’ll be tired of securing

One man is standing up to Donald Trump's ban on US chip tech going to Huawei. That man... is Donald Trump

President slams his own administration's 'ridiculous' China crackdown

Trump administration says Russia behind SolarWinds hack. Trump himself begs to differ

Microsoft’s analysis of hack suggests someone else had a crack at SolarWinds in 2019 when next-level 'DLL hell' followed likely developer pipeline compromise

Trump's official campaign website vandalized by hackers who 'had enough of the President's fake news'

Well, that narrows down the list of suspects to just a few billion people

Trump reveals US cyber-attack on Russian election-misdirection troll farms

Maybe Donald isn’t in love with Vlad after all – but he did just give Russia attribution and maybe a peek at tradecraft

Biting the hand that feeds IT © 1998–2021