X Account Security Troubleshooting and Reinforcement Guide

Background Overview

Recently, there have been frequent incidents of Web3 project/celebrity X accounts being stolen and used to send phishing tweets. Hackers are good at using various means to steal user accounts. The more common routines are as follows:

• Induce users to click on fake Calendly/Kakao meeting appointment links to steal user account authorization or control user devices;

• Private messages trick users into downloading programs with Trojans (fake games, meeting programs, etc.). In addition to stealing private keys/mnemonics, Trojans may also steal X account permissions;

• Use SIM Swap attacks to steal X account permissions that rely on mobile phone numbers.

The SlowMist security team assisted in solving many similar incidents. For example, on July 20, the account X of the TinTinLand project was stolen, and the attacker pinned a tweet containing a phishing link. With the assistance of the SlowMist security team, TinTinLand promptly solved the account theft problem and conducted authorization review and security reinforcement for the X account.

Considering the frequent victims, many users do not know much about how to enhance the security of the X account. The SlowMist security team will explain to you how to do authorization troubleshooting and security settings for the X account in this article. The following are the specific steps.

Authorization Troubleshooting

Let's take the Web end as an example. After opening the x.com page, click "More" in the sidebar and find the "Settings and privacy" option, which is mainly used to set the security and privacy of the account.

After entering the "Settings" column, select "Security and account access" to set the security and authorization access of the account.

View authorized applications

Many phishing methods take advantage of users accidentally clicking on authorized application links, resulting in the authorization of the tweeting permission of account X, which is then used to send phishing messages.

Troubleshooting method: Select the "Apps and sessions" column to view which applications the account has authorized. As shown in the following figure, the demo account has authorized these 3 applications.

After selecting a specific application, you can see the corresponding permissions. Users can remove permissions through "Revoke app permissions".

Check the delegation status

Troubleshooting method: Settings → Security and account access → Delegate

If you find that the current account has enabled invitation management, you need to go to "Members you’ve delegated" to check which accounts the current account has been shared with, and cancel the delegation as soon as possible when sharing is no longer needed.

Check abnormal login logs

If the user suspects that the account has been maliciously logged in, he can check the login log to view the device, date and location of the abnormal login.

Checking method: Settings → Security and account access → Apps and sessions → Account access history

As shown below, enter Account access history to view the model, login date, IP and region of the login device. If abnormal login information is found, it means that the account may have been stolen.

Check the login device

If a malicious login occurs after the X account is stolen, the user can check the login device of the current account and then kick the malicious login device offline.

Troubleshooting method: Select "Log out the device shown" to log out the account from a certain device.

Security Settings

2FA Verification

Users can enable 2FA verification to enable two-factor verification insurance for their accounts to avoid the risk of their accounts being directly taken over after their passwords are leaked.

Configuration method: Settings → Security and account access → Security→ Two-factor authentication

You can set up the following 2FA to enhance the security of your account, such as SMS verification code, authenticator, and security key.

Additional password protection

In addition to setting an account password and 2FA, users can also enable additional password protection to further enhance the security of their X accounts.

Configuration method: Settings → Security and account access → Security → Additional password protection

Summary

Regularly checking authorized applications and login activities is the key to ensuring account security. The SlowMist Security Team recommends that users regularly perform authorization checks on the X account according to the troubleshooting steps to enhance account security and reduce the risk of being hacked. If you find that your account has been hacked, please take immediate measures to change the account password, conduct authorization checks, revoke suspicious authorizations, and set up security enhancements for the account.