Twitter hires veteran hacker Mudge as head of security

Twitter has appointed one of the world’s most respected hackers as its new head of security in the wake of a humiliating mass attack in July.

The company has placed Peiter Zatko in charge of protecting its platform from threats of all varieties, poaching him from the payments startup Stripe. Zatko is better known as Mudge, his handle for more than 20 years of operation on both sides of the information security arena.

Why are public thinkers flocking to Substack? | Sean Monahan

Read more

“Looks like the cat is out of the bag,” Mudge tweeted after the news of his hiring broke. “I’m very excited to be joining the executive team at Twitter! I truly believe in the mission of (equitably) serving the public conversation. I will do my best!”

Mudge made his name in the 1990s as a member of the notorious hacker collectives Cult of the Dead Cow and L0pht Heavy Industries.

The groups were notorious for making and distributing hacking tools such as Back Orifice, which could allow a hacker to take over an infected machine, and L0phtCrack, a tool for pirating Windows. But they were also drivers of the unique culture of the hacker community, distributing music and zines, running conventions, and engaging in pranks and activism online.

In the later part of the 90s, Mudge’s central role in the hacker community, combined with the growing commercial importance of the internet, led to growing dialogue with political leaders. In 1998, he and the other members of L0pht testified before the US Congress about the shoddy standards of information security at the time. Styling themselves as a “hacker thinktank”, the group told representatives that they could, within 30 minutes of work, shut down the internet for a couple of days if they put their minds to it.

Two years later, Mudge joined a group of experts advising the then-president Bill Clinton on internet security, after a series of hacking attacks that hit CNN, eBay, Yahoo and Amazon. An awed CNN reported that one participant at the meeting “set up his laptop on the conference table, an agenda on the screen”.

As Twitter’s new head of security, Mudge will have a large to-do list. The company’s information security failings were highlighted by July’s attack, when a series of prominent accounts including those of Kim Kardashian West, Barack Obama and Elon Musk, were taken over by attackers to propagate a bitcoin scam. The hack’s postmortem was embarrassing for Twitter, revealing that crucial passwords had been left in plain view in a Slack channel that anyone could join, and that the power to completely take over accounts was in effect unmonitored internally.

The former hacker’s job will also cover security in other realms: physical security of the company’s offices, as well as the task of fighting misinformation on the website, he told Reuters.