Risk

Twitter, Feds Settle Security Charges

Twitter must establish and maintain a "comprehensive information security program" and allow third-party review of the program biannually for the 10 years.

Twitter has settled Federal Trade Commission charges that the social network put users' personal information at risk, while deceiving them about safeguards to protect data.

The settlement, announced Thursday, closed the FTC's first action against a social networking site for faulty security. Twitter's failings led to two well-publicized attacks, one of which resulted in a hacker gaining access to several high-profile accounts, including that of then President-elect Barack Obama.

The settlement requires Twitter to take a number of security steps to protect user data, steps the site said it has already taken. "Even before the agreement, we'd implemented many of the FTC's suggestions and the agreement formalizes our commitment to those security practices," Twitter said in response to the FTC's settlement announcement.

Nevertheless, the FTC said Twitter failed to provide the security it promised users.

"When a company promises consumers that their personal information is secure, it must live up to that promise," David Vladeck, director of the FTC's Bureau of Consumer Protection, said in a statement. "Likewise, a company that allows consumers to designate their information as private must use reasonable security to uphold such designations."

The first security breach occurred in January 2009 when a hacker used an automated password-generation tool to continuously try to log in to a person's account. In some cases, the hacker made thousands of attempts before striking pay dirt. Twitter's culpability was in failing to implement password rules that would have led to stronger passwords, the FTC said. In addition, Twitter should have had technology in place to lock out the hacker after several failed attempts.

The hacker accessed the accounts of 45 Twitter users, including Facebook, Fox News, The Huffington Post, Obama, Britney Spears and CNN host Rick Sanchez. In some cases, the hacker sent phony tweets under the accounts. Tweets are the short messages of 140 characters or less people broadcast to followers on the site.

A bogus tweet sent from Obama's account offered his more than 150,000 followers a chance to win $500 in free gasoline, according to the FTC.

The second breach occurred in April 2009 when a hacker broke into a Twitter employee's administrative account by first accessing the employee's Yahoo e-mail account, where the password was stored in plain text.

In gaining access to the administrative account, the hacker could access private information from any Twitter user, according to the FTC. The hacker did post more than a dozen screenshots of Twitter's administrative console on several Web sites.

To help prevent the second breach, Twitter should have prohibited employees from storing passwords within personal e-mail accounts, enforced periodic changes of administrative passwords, restricted access to administrative controls to employees whose jobs required it and imposed other reasonable restrictions on administrative access, the FTC said.

Under the terms of the settlement. Twitter is barred for 20 years from misleading users about the extent to which it protects their privacy and personal information. The company also must establish and maintain a "comprehensive information security program," the FTC said. A third party has to assess the program every other year for 10 years.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
Cybercriminals Think Small to Earn Big
Dark Reading Staff 3/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.