When authorities arrested Graham Ivan Clark, who they said was the mastermind of the recent Twitter hack that ensnared Kanye West, Bill Gates and others, one detail that stood out was his age: He was only 17.
Now authorities have homed in on another person who appears to have played an equal, if not more significant, role in the July 15 attack, according to four people involved in the investigation who declined to be identified because the inquiry was ongoing. They said the person was at least partly responsible for planning the breach and carrying out some of its most sensitive and complicated elements.
His age? Just 16, public records show.
On Tuesday, federal agents served the teenager with a search warrant and scoured the Massachusetts home where he lives with his parents, said one of the people involved in the operation. A spokesman for the F.B.I. confirmed a search warrant had been executed at the address.
The search warrant and other documents in the case are under seal, and federal agents may decide not to charge the youth with a crime. If he is ultimately arrested, the case is likely to be handed over to Massachusetts authorities, who have more leverage than federal prosecutors in charging minors as adults. (The New York Times is not naming the teenager at this point because of his age and because he has not been charged.)
Rarely have federal agents gone after someone so young in a hacking case, especially given the apparent sophistication of the attack. During the hack, much of Twitter including President Trumps unfiltered communications on the service was largely immobilized. The attackers gained control of the social networks systems and compromised the accounts of Barack Obama, Joseph R. Biden Jr., Jeff Bezos and many other prominent people, exposing just how vulnerable Twitter could be.
Authorities have already charged three other people in the hack. They include Mr. Clark, who Florida prosecutors charged in late July as an adult with 30 felonies. He has pleaded not guilty and has not made the bail payment to get out of jail. The other two people are Mason John Sheppard, 19, of the United Kingdom, and Nima Fazeli, 22, of Orlando, Fla., who were charged by federal prosecutors.
Twitter declined to comment.
The Massachusetts teenager appeared to get involved in planning the Twitter attack with Mr. Clark in May, according to investigators. While Mr. Clark and some of his accomplices talked with one another on the messaging board Discord, the youth restricted himself to using encrypted messaging systems like Signal and Wire, several hackers who saw the messages said.
He was smarter than the rest, Joseph OConnor, a hacker known as PlugWalkJoe, said of the teenager. Mr. OConnor said he talked with some of the people involved in the hack on the day of the Twitter attack and was aware of the teenagers role in the scheme.
The youths secure communications made it harder for investigators to identify him. But Mr. OConnor and other people in the online conversation that day said that he made video calls to friends on the day of the hack and showed them that he was inside Twitters back-end systems, which some accomplices never got near.
The teenager was known for calling employees of companies, such as Twitter, according to investigators and other hackers. He often posed as a contractor or employee to convince employees to enter their login credentials into fraudulent websites where the credentials could be captured, a method known as voice phishing or vishing. The login credentials made it possible for the hackers to then access the inner workings of the companies systems.
After the Twitter hack, the boy became a focus of investigators because he continued to be involved in voice phishing attacks, people involved in the probe said.
Using vished credentials, cybercriminals mined the victim company databases for their customers personal information to leverage in other attacks, federal authorities said in a warning about the ongoing scheme issued in August.
According to online forensic research and social media posts, the teenager lives in a modest two-story house in a coastal Massachusetts city where he attended a nearby private school. Facebook posts showed him with floppy hair when going for his black belt in martial arts at age 11.
His parents filed for divorce two years ago and appeared to struggle with money. His mother, a wellness instructor, reportedly lost her job after lying about her credentials, according to local newspapers. His father was foreclosed on four times and declared bankruptcy twice, according to public records.
Around age 13, the boy bought a series of websites with pornographic names and tried to resell them using his personal address and email, according to domain records.
Around the same time, online forum accounts tied to his email address and home internet protocol address showed up on the website OGusers.com, a site that was the home for the others involved in the Twitter attack, according to two online forensic firms. The site provides a place for hackers to buy and sell coveted original gangster user names on social media sites, such as single letter accounts like @a or @6.
The teenager rotated among several aliases tied to his various online accounts, according to intelligence analysis done by the firm Intel471. The messages from the accounts included profanities, anti-Semitic remarks and homophobic comments. At one point, the teenager complained about losing around $200,000 on a Bitcoin gambling site. He also offered to sell a user name for $3,000 in Bitcoin, according to messages from the forum that were later leaked.
IF your broke and cant afford or dont think thats a good price JUST DONT EVEN MESSAGE ME! he wrote in late 2018.
He later linked up with Mr. Clark online and they began working together, people involved in the investigation said. Their early work, hackers said and investigators confirmed, was on so-called SIM swaps, a hacking method that is often used to steal social media accounts and cryptocurrency.
Late last year and early this year, hackers and investigators said, the teenager was part of a group that got inside the site GoDaddy, a company that sells and secures website names. The hackers were able to access and change customer records. GoDaddy confirmed the hack in a letter to customers.
In May, the Massachusetts teenager and Mr. Clark began tricking Twitter employees to give up their logins, leading to the July 15 hack. The boys, using the alias Kirk, began selling valuable Twitter user names to customers.
Just after noon California time that day, the other accomplices dropped out, they said in interviews with The Times a few days later. Mr. Clark and the Massachusetts teenager then took over prominent Twitter accounts like those belonging to Mr. Obama and Elon Musk and used them to send out a Bitcoin scam. Investigators said the Massachusetts teenager was logged into Twitters systems and handled at least some of the changes to the accounts and the tweets that went out from them.
People responding to the scam sent the teenagers around 12 Bitcoin, worth around $140,000. Those proceeds appeared to have been roughly split in half between the two people in charge, according to the public ledger of Bitcoin transactions.
Kate Conger contributed reporting. Sheelagh McNeil contributed research.
Read the rest here:
Did a 16-Year-Old Have A Hand in Twitter Hack? - The New York Times
- The Principality of Sealand - Become a Lord, Lady, Baron or ... - December 8th, 2016 [December 8th, 2016]
- SeaLand Toilets - Motorhome, RV & Marine - PPL Motor Homes - December 23rd, 2016 [December 23rd, 2016]
- Schedules - SeaLand - December 28th, 2016 [December 28th, 2016]
- Sealand man jailed for high speed police chase near Chester - LeaderLive - February 10th, 2017 [February 10th, 2017]
- sealand | eBay - February 15th, 2017 [February 15th, 2017]
- Floatplane fuselage donated for entrance feature - Campbell River Mirror - February 22nd, 2017 [February 22nd, 2017]
- Burglar in 'lunatic' Flintshire police chase jailed - Daily Post North Wales - February 23rd, 2017 [February 23rd, 2017]
- Did you get married in this Sealand church? - Daily Post North Wales - March 1st, 2017 [March 1st, 2017]
- Global Camping Toilet Market 2017 By Manufacturers Zodi, Camco, SeaLand, Thetford Marine - NetDugout - March 2nd, 2017 [March 2nd, 2017]
- Sealand Natural Resources, Inc. (OTCMKTS:SLNR) Files An 8-K Unregistered Sales of Equity Securities - Market Exclusive - March 2nd, 2017 [March 2nd, 2017]
- Sealand - The Principality of Sealand - March 8th, 2017 [March 8th, 2017]
- Sealand of the Pacific - Wikipedia - March 11th, 2017 [March 11th, 2017]
- Gardening club launch at Sealand and Queensferry Dementia Caf - Deeside.com - April 8th, 2017 [April 8th, 2017]
- Sealand - The Principality of Sealand - thoughtco.com - April 8th, 2017 [April 8th, 2017]
- Malawi govt over paid farm input suppliers by K61billion - Nyasa Times - June 7th, 2017 [June 7th, 2017]
- About Sealand - June 7th, 2017 [June 7th, 2017]
- How Are Analysts Interpreting Sealand Natural Resources Inc (SLNR)'s Relative Strength? - Nelson Research - June 8th, 2017 [June 8th, 2017]
- Inquiry date for Chester flood plain homes plan - ChesterChronicle.co.uk - June 14th, 2017 [June 14th, 2017]
- sealand toilet | eBay - June 14th, 2017 [June 14th, 2017]
- Unusual Activity Spotted in Sealand Natural Resources Inc (SLNR) - BVN - June 16th, 2017 [June 16th, 2017]
- Sealand Natural Resources Inc (SLNR) Moving -40.00% in Session - BVN - June 17th, 2017 [June 17th, 2017]
- Pivot Points in Focus: Sealand Natural Resources Inc (SLNR) - Nelson Research - June 21st, 2017 [June 21st, 2017]
- Independence Day 2017 SeaLand & Port Schedule - American Journal of Transportation - June 27th, 2017 [June 27th, 2017]
- Flooding on Chester's Sealand Road after downpour - ChesterChronicle.co.uk - July 14th, 2017 [July 14th, 2017]
- Chester floodplain housing scheme unanimously rejected - ChesterChronicle.co.uk - August 6th, 2017 [August 6th, 2017]
- 150 years of the Shipping Forecast: The magic and poetry of Dogger, Fisher and German Bight - Country Life - August 25th, 2017 [August 25th, 2017]
- Sealand - Wikitravel - August 25th, 2017 [August 25th, 2017]
- About Us - Principality of Sealand - August 25th, 2017 [August 25th, 2017]
- About - Principality of Sealand - February 6th, 2018 [February 6th, 2018]
- Principality of Sealand - Wikipedia - June 5th, 2018 [June 5th, 2018]
- Sealand | MicroWiki | FANDOM powered by Wikia - July 29th, 2018 [July 29th, 2018]
- Sealand The Mystery Solved - Part One - YouTube - August 30th, 2018 [August 30th, 2018]
- Sealand Marine Toilet Parts | West Marine - September 16th, 2018 [September 16th, 2018]
- Search for a route - sealand.com - September 16th, 2018 [September 16th, 2018]
- About Sealand - Become a Lord, Lady, Baron or Baroness - October 16th, 2018 [October 16th, 2018]
- SeaLand is now Dometic | Dometic - Mobile living made easy. - November 24th, 2018 [November 24th, 2018]
- Sealand | Dynamic Ship Simulator III Wiki - dss-iii.wikia.com - December 5th, 2018 [December 5th, 2018]
- Sealand | Fifth World Wiki | FANDOM powered by Wikia - December 5th, 2018 [December 5th, 2018]
- Vacuflush Parts and Systems for marine and RV toilets. - January 11th, 2019 [January 11th, 2019]
- Sealand | West Marine - January 11th, 2019 [January 11th, 2019]
- Sealand | Hetalia Archives | FANDOM powered by Wikia - January 11th, 2019 [January 11th, 2019]
- About Sealand | The Principality Of Sealand - January 11th, 2019 [January 11th, 2019]
- Sealand Marine - 4 Locations Across Nebraska and South ... - May 14th, 2019 [May 14th, 2019]
- Surfer cleans his playground by turning pollution into functional fashion - East Coast Radio - October 1st, 2019 [October 1st, 2019]
- Hefty bill for Sealand farmer who ignored warnings to clear waste off his land - LeaderLive - October 1st, 2019 [October 1st, 2019]
- IN PICTURES: Terry is first person to complete nine-mile swim from Sealand to Dovercourt - Harwich and Manningtree Standard - October 1st, 2019 [October 1st, 2019]
- Great Escapes: The Pristine Shores and Year-Round Charm of Denmarks North Sealand - Barron's - October 1st, 2019 [October 1st, 2019]
- Terra Firma Imagines a Tiny Country Surviving the Rising Waters - TheaterMania.com - October 14th, 2019 [October 14th, 2019]
- Appeal launched over refusal of plans to store cars and caravans on green barrier land in Sealand - LeaderLive - October 14th, 2019 [October 14th, 2019]
- Queues on Sealand Road in Chester due to water works - Cheshire Live - October 14th, 2019 [October 14th, 2019]
- Coleg Cambria volunteers clean-up streets and rivers of Deeside for community event - Deeside.com - October 16th, 2019 [October 16th, 2019]
- Review: In Terra Firma, a Wee Wet Country on the Brink - The New York Times - October 16th, 2019 [October 16th, 2019]
- Appeal launched over refusal of plans to store cars and caravans on green barrier land in Sealand - Deeside.com - October 16th, 2019 [October 16th, 2019]
- Global Smart Container Market Set to Reach $5.74 Billion by 2024 - Asia-Pacific Expected to Grow at the Highest CAGR - PRNewswire - December 18th, 2019 [December 18th, 2019]
- Panerai Celebrates the Year of the Rat With Sparsello-Decorated Luminor Sealand - HYPEBEAST - December 18th, 2019 [December 18th, 2019]
- Former football star and Telegraph photographer Gary Talbot dies at 82 - Lancashire Telegraph - December 27th, 2019 [December 27th, 2019]
- SeaWorld Prisoner Kyuquot the Orca Needs Our Help! - The Union Journal - December 27th, 2019 [December 27th, 2019]
- Somaliland in the Guide to the 'almost countries' of The World - MENAFN.COM - December 27th, 2019 [December 27th, 2019]
- All the shops and businesses Chester said goodbye to in 2019 - Cheshire Live - January 2nd, 2020 [January 2nd, 2020]
- Easter eggs are already on sale in Plymouth - Plymouth Live - January 2nd, 2020 [January 2nd, 2020]
- This is what was happening in Chester as the 1990s dawned - Cheshire Live - January 2nd, 2020 [January 2nd, 2020]
- Chinese New Year Gifting 2020: From Gucci to Faberg, Rats & Mice Galore | Jewellery | Watches & Jewellery - Luxury London - January 14th, 2020 [January 14th, 2020]
- Sealand Community Council to decide three new positions by co-option | The Leader - LeaderLive - January 30th, 2020 [January 30th, 2020]
- Roadworks in and around Flintshire over the next few days - Deeside.com - February 24th, 2020 [February 24th, 2020]
- Photographer from Deeside on 'cloud nine' with accolade - LeaderLive - February 24th, 2020 [February 24th, 2020]
- China firms in $10 billion share sale rush as funding rules eased amid virus worries - Reuters - February 24th, 2020 [February 24th, 2020]
- Sealand reduces transit time between Chile and the US for table grapes - FreshPlaza.com - February 24th, 2020 [February 24th, 2020]
- The 72 businesses with a five star food hygiene rating in Flintshire - Daily Post - March 16th, 2020 [March 16th, 2020]
- More than three weeks of overnight closures on Cheshire roads to start - Cheshire Live - March 22nd, 2020 [March 22nd, 2020]
- Flintshire man who went to see son play in band in Chester caught drink-driving on way home - The Chester Standard - March 22nd, 2020 [March 22nd, 2020]
- Heres Why Sealand Capital Galaxy (LON:SCGL) Must Use Its Cash Wisely - Simply Wall St - March 22nd, 2020 [March 22nd, 2020]
- Man charged with alleged offence under new Covid 19 legislation following incident in Deeside on Thursday - Deeside.com - April 9th, 2020 [April 9th, 2020]
- SeaWorld trainer torn limb from limb by killer whale turned 'psychotic' by captivity - Mirror Online - April 26th, 2020 [April 26th, 2020]
- Revamped Aldi Chester store to open its doors next week - The Chester Standard - May 11th, 2020 [May 11th, 2020]
- Weekly Update: Global Coronavirus Impact and Implications on Fresh and Naturally Fermented Birch Juice Market Analysis, Trends, Forecast, 2019-2025 -... - June 1st, 2020 [June 1st, 2020]
- Residents urged to take care after house fire in Sealand - LeaderLive - June 1st, 2020 [June 1st, 2020]
- Someone has used a chainsaw to cut down a tree in Garden City which blocked Welsh Road - Deeside.com - June 9th, 2020 [June 9th, 2020]
- Covid-19 Impact on Global Coriolis Mass Flowmeters Market (2020-2026) | Potential growth, attractive valuation make it is a long-term investment | Top... - June 25th, 2020 [June 25th, 2020]
- Sales in the Birch Water Market Expected to Grow as Demand from End-Use Industries Gathers Pace 2017 2025 - Jewish Life News - July 10th, 2020 [July 10th, 2020]
- Breaking down the top 10 LB recruits in Vanderbilt history - 247Sports - July 12th, 2020 [July 12th, 2020]