Risk
1/5/2009
04:00 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Twitter Has Security Meltdown

The microblogging site recommends users reset their passwords and verify their e-mail addresses because of a phishing campaign directed at its users and the hacking of its support software.

Twitter's security melted down on Monday in the face of a phishing campaign directed at Twitter users and the hacking of Twitter's support software.

The security failure has resulted in the temporary takeover of Twitter accounts associated with Facebook, Fox News, The Huffington Post, Barack Obama, Britney Spears, and CNN's Rick Sanchez.

The phishing campaign was first reported on Saturday. Tech blogger Chris Pirillo warned that he had received a direct message from one of his Twitter followers advising him to visit sites designed to look like Twitter's logon page that smelled "phishy."

"The message bears a link to a Web site that only appears to come from Twitter but is of course a scam Web site where your account information will be stolen," Symantec researcher Marian Merritt explained in a blog post.

On Monday, Twitter acknowledged that it was having other security problems. "A number of high-profile Twitter accounts were compromised this morning, and fake/spam updates were sent on their behalf," Twitter said in a blog post. "We have identified the cause and blocked it. We are working to restore compromised accounts."

Twitter said that the issue with these 33 accounts was separate from the phishing scam noted over the weekend. "These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the e-mail address associated with their Twitter account when they can't remember or get stuck," the company explained. "We considered this a very serious breach of security and immediately took the support tools offline. We'll put them back only when they're safe and secure."

Twitter is advising users to reset their passwords and to verify that the e-mail address stored in Twitter's account setting area is legitimate.

Twitter said the two of the compromised accounts belong to CNN's Sanchez and President-elect Obama, who "has not been Twittering since becoming the president-elect due to transition issues."

Flickr users have posted screenshots of other hijacked accounts.

Dan Tentler, a freelance security researcher based in San Diego, said in a phone interview that for some reason, "people seem to be OK with giving their Twitter passwords away to other sites." He pointed to a gullibility experiment conducted by another Twitter user at the site TwitterAwesomeness.com.

The site openly asks visitors for their Twitter passwords. "It's ok, 247 other people gave their passwords too!" the site explains.

For all its popularity, Twitter has been dogged by privacy and security issues. In July, for example, security researcher Aviv Raff noted that Twitter suffered from a vulnerability that allowed an attacker to force victims to join his or her Twitter follow list automatically.

Last month, spammers created a Twitter account in the name of Google's Internet evangelist Vint Cerf and used it for spamming.

In November, blogger Dare Obasanjo laid some of the blame for Twitter's insecurity on its habit of encouraging "its users to hand out their credentials to any application that asks for them in the first place."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This is a secure windows pc.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.