Hacker behind fake White House bombing tweet gets 42 months in prison

A U.S. federal court has sentenced Ahmad Umar Agha, a Syrian hacker known online as "Th3Pr0," to 42 months in prison. He is the man behind a 2013 fake tweet from the Associated Press that said President Obama was hurt in White House explosions. The Justice Department announced the sentence on October 29.

What he did

On April 23, 2013, the group hijacked the AP's Twitter account and posted the false report. The Justice Department said the hack caused a temporary $136 billion drop in the value of Dow Jones stocks. Agha later told Business Insider that a big drop was "our goal" and "a big victory for us."

In all, Agha hacked about 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies, the department said.

How they got in

The group, called the Syrian Electronic Army, sent phishing emails. These are fake messages built to trick people into giving up their passwords. With those passwords, members defaced websites, redirected web traffic and hijacked social media accounts, according to a 2014 FBI affidavit.

Agha also got into the company that hosted the U.S. Marine Corps recruiting website. About 3,500 potential visitors saw an image urging Marines to refuse their orders instead of recruiting material. He twice tried to take over the White House's social media accounts by stealing staff email passwords.

The cost to victims

• One company that supplies content and ads to publishers lost about $35,000 a day for about six months.
• A global non-profit lost $480,000, including about $250,000 on new network monitoring tools.
• That non-profit also had to retrain more than 800 staff members.

What is still unclear

The Justice Department said the plot was organized and led by members of former Syrian President Bashar al-Assad's inner circle. Earlier public documents from 2014, 2016 and 2018 do not describe Syrian officials organizing or leading the group. The 2016 announcement said only that it acted "in support of" the Syrian government. Co-defendant Firas Dardar remains a fugitive.

What to do

The lesson for any business is simple. The attackers did not break clever locks. They tricked employees into handing over passwords. Use a different password for every account, and turn on two-step login for work email and social media accounts.