Risk
1/5/2009
04:00 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Twitter Has Security Meltdown

The microblogging site recommends users reset their passwords and verify their e-mail addresses because of a phishing campaign directed at its users and the hacking of its support software.

Twitter's security melted down on Monday in the face of a phishing campaign directed at Twitter users and the hacking of Twitter's support software.

The security failure has resulted in the temporary takeover of Twitter accounts associated with Facebook, Fox News, The Huffington Post, Barack Obama, Britney Spears, and CNN's Rick Sanchez.

The phishing campaign was first reported on Saturday. Tech blogger Chris Pirillo warned that he had received a direct message from one of his Twitter followers advising him to visit sites designed to look like Twitter's logon page that smelled "phishy."

"The message bears a link to a Web site that only appears to come from Twitter but is of course a scam Web site where your account information will be stolen," Symantec researcher Marian Merritt explained in a blog post.

On Monday, Twitter acknowledged that it was having other security problems. "A number of high-profile Twitter accounts were compromised this morning, and fake/spam updates were sent on their behalf," Twitter said in a blog post. "We have identified the cause and blocked it. We are working to restore compromised accounts."

Twitter said that the issue with these 33 accounts was separate from the phishing scam noted over the weekend. "These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the e-mail address associated with their Twitter account when they can't remember or get stuck," the company explained. "We considered this a very serious breach of security and immediately took the support tools offline. We'll put them back only when they're safe and secure."

Twitter is advising users to reset their passwords and to verify that the e-mail address stored in Twitter's account setting area is legitimate.

Twitter said the two of the compromised accounts belong to CNN's Sanchez and President-elect Obama, who "has not been Twittering since becoming the president-elect due to transition issues."

Flickr users have posted screenshots of other hijacked accounts.

Dan Tentler, a freelance security researcher based in San Diego, said in a phone interview that for some reason, "people seem to be OK with giving their Twitter passwords away to other sites." He pointed to a gullibility experiment conducted by another Twitter user at the site TwitterAwesomeness.com.

The site openly asks visitors for their Twitter passwords. "It's ok, 247 other people gave their passwords too!" the site explains.

For all its popularity, Twitter has been dogged by privacy and security issues. In July, for example, security researcher Aviv Raff noted that Twitter suffered from a vulnerability that allowed an attacker to force victims to join his or her Twitter follow list automatically.

Last month, spammers created a Twitter account in the name of Google's Internet evangelist Vint Cerf and used it for spamming.

In November, blogger Dare Obasanjo laid some of the blame for Twitter's insecurity on its habit of encouraging "its users to hand out their credentials to any application that asks for them in the first place."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8617
Published: 2015-03-04
Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/re...

CVE-2015-2209
Published: 2015-03-04
DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.

CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.