Korte update

On October 27, 2016 – after hacker conference BruCON – 3 Dutch hackers, members of the Guild Of The Grumpy Old Hackers, gained access to Donald Trump’s Twitter account.
Two weeks prior to the US elections, the hackers got access to a LinkedIn-database containing 117 million usernames and passwords. The database had been circulating in criminal networks since 2012 and was only put up for sale in the dark markets in 2016. After this, the file also started circulating within the information security community. This is how and when the grumpy old hackers also gained access.
<img decoding="async" class="alignnone size-image_640 wp-image-479851" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding1-1-640x369.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding1-1-320x185.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding1-1-640x369.png 640w" alt="" width="640" height="369" />
As it turns out, this database also contained Donald Trump’s information.
<img decoding="async" class="alignnone size-image_640 wp-image-479853" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding2-1-640x409.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding2-1-320x204.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding2-1-640x409.png 640w" alt="" width="640" height="409" />
donaldtrump@trump.com:07b8938319c267dcdb501665220204bbde87bf1d 
From which the hackers distilled the following password: yourefired. 
This can be easily verified with applications such as <a href="https://passwordsgenerator.net/sha1-hash-generator/">https://passwordsgenerator.net/sha1-hash-generator/</a>.
To their great surprise Twitter accepted the password, however asked for an email address for verification purposes. donaldtrump@trump.com didn’t work, but after a few wild guesses from the hackers the correct Twitter email address for Trump surfaced: twitter@donaldjtrump.com.
<img decoding="async" class="alignnone size-image_640 wp-image-479857" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding3-1-640x372.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding3-1-320x186.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding3-1-640x372.png 640w" alt="" width="640" height="372" />
With this email address they were able to log into Trump’s Twitter account. Since the contents of the piece, as well as the timing of publication have raised questions about authenticity, please find here below the timeline the grumpy hackers made, as well as additional screenshots from their own presentation, which they have been sharing in security intel circles.
<img decoding="async" class="alignnone size-image_640 wp-image-479859" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding4-1-640x135.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding4-1-320x68.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding4-1-640x135.png 640w" alt="" width="640" height="135" />
<img decoding="async" class="alignnone size-image_640 wp-image-479861" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding5-1-640x388.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding5-1-320x194.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding5-1-640x388.png 640w" alt="" width="640" height="388" />
<img decoding="async" class="alignnone size-image_640 wp-image-479863" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding6-1-640x33.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding6-1-320x16.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding6-1-640x33.png 640w" alt="" width="640" height="33" />
<img decoding="async" class="alignnone size-image_1280 wp-image-479873" src="https://www.vn.nl/wp-content/uploads/2020/09/Unknown-1280x950.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Unknown-320x238.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Unknown-640x475.png 640w, https://www.vn.nl/wp-content/uploads/2020/09/Unknown-1280x950.png 1280w" alt="" width="1280" height="950" />
The grumpy hackers addressed the above email to Trump and to US CERT (United States Computer Emergency Readiness Team). When no response came, they tried to get in touch via alternative routes. They sent a similar message to the Dutch CERT, NCSC-NL (Nationaal Cyber Security Centrum), who forwarded on the message to USCERT for a second time.
<img decoding="async" class="alignnone size-image_1280 wp-image-479875" src="https://www.vn.nl/wp-content/uploads/2020/09/Schermafbeelding-2020-09-10-om-12.42.21-1280x616.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Schermafbeelding-2020-09-10-om-12.42.21-320x154.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Schermafbeelding-2020-09-10-om-12.42.21-640x308.png 640w, https://www.vn.nl/wp-content/uploads/2020/09/Schermafbeelding-2020-09-10-om-12.42.21-1280x616.png 1280w" alt="" width="1280" height="616" />
Below one of the emails from the NCSC-NL.
<img decoding="async" class="alignnone size-image_1280 wp-image-479877" src="https://www.vn.nl/wp-content/uploads/2020/09/Unknown-1-1280x536.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Unknown-1-320x134.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Unknown-1-640x268.png 640w, https://www.vn.nl/wp-content/uploads/2020/09/Unknown-1-1280x536.png 1280w" alt="" width="1280" height="536" />
Finally, on November 2nd, there was a response.
<img decoding="async" class="alignnone size-image_640 wp-image-479821" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding9-640x90.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding9-320x45.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding9-640x90.png 640w" alt="" width="640" height="90" />
Something changed at the White House, this much became clear after publication of <a href="https://www.nytimes.com/2016/11/07/us/politics/donald-trump-presidential-race.html">this New York Times story</a>:
<img decoding="async" class="alignnone size-image_640 wp-image-479823" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding10-640x86.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding10-320x43.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding10-640x86.png 640w" alt="" width="640" height="86" />
<img decoding="async" class="alignnone size-image_640 wp-image-479825" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding11-640x204.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding11-320x102.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding11-640x204.png 640w" alt="" width="640" height="204" />
<img decoding="async" class="alignnone size-image_640 wp-image-479827" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding12-640x282.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding12-320x141.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding12-640x282.png 640w" alt="" width="640" height="282" />
<img decoding="async" class="alignnone size-image_640 wp-image-479829" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding13-640x198.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding13-320x99.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding13-640x198.png 640w" alt="" width="640" height="198" />
Trump’s name not only surfaced in the LinkedIn database, but also in leaked databases of some computer games and dating site Ashley Madison.
<img decoding="async" class="alignnone size-image_640 wp-image-479831" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding14-640x360.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding14-320x180.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding14-640x360.png 640w" alt="" width="640" height="360" />
These can of course be fake accounts. But the leaked Ashly Madison database didn’t contain readable passwords, only coded ones (bcrypt), which are difficult to crack with existing techniques. However – by running the password ‘yourefired’ through the bcrypt process, the grumpy hackers found there was a Trump-account at Ashley Madison with the same password: ‘yourefired’.
<img decoding="async" class="alignnone size-image_640 wp-image-479833" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding15-640x294.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding15-320x147.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding15-640x294.png 640w" alt="" width="640" height="294" />
While the Grumpy Hackers never informed the media, their story was known in close-knit hacker circles.
<img decoding="async" class="alignnone size-image_640 wp-image-479835" src="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding16-640x339.png" srcset="https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding16-320x170.png 320w, https://www.vn.nl/wp-content/uploads/2020/09/Afbeelding16-640x339.png 640w" alt="" width="640" height="339" />
This is how I traced the story, at the Chaos Computer Conference in Leipzig, in December 2019.