Risk
1/5/2009
04:00 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Twitter Has Security Meltdown

The microblogging site recommends users reset their passwords and verify their e-mail addresses because of a phishing campaign directed at its users and the hacking of its support software.

Twitter's security melted down on Monday in the face of a phishing campaign directed at Twitter users and the hacking of Twitter's support software.

The security failure has resulted in the temporary takeover of Twitter accounts associated with Facebook, Fox News, The Huffington Post, Barack Obama, Britney Spears, and CNN's Rick Sanchez.

The phishing campaign was first reported on Saturday. Tech blogger Chris Pirillo warned that he had received a direct message from one of his Twitter followers advising him to visit sites designed to look like Twitter's logon page that smelled "phishy."

"The message bears a link to a Web site that only appears to come from Twitter but is of course a scam Web site where your account information will be stolen," Symantec researcher Marian Merritt explained in a blog post.

On Monday, Twitter acknowledged that it was having other security problems. "A number of high-profile Twitter accounts were compromised this morning, and fake/spam updates were sent on their behalf," Twitter said in a blog post. "We have identified the cause and blocked it. We are working to restore compromised accounts."

Twitter said that the issue with these 33 accounts was separate from the phishing scam noted over the weekend. "These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the e-mail address associated with their Twitter account when they can't remember or get stuck," the company explained. "We considered this a very serious breach of security and immediately took the support tools offline. We'll put them back only when they're safe and secure."

Twitter is advising users to reset their passwords and to verify that the e-mail address stored in Twitter's account setting area is legitimate.

Twitter said the two of the compromised accounts belong to CNN's Sanchez and President-elect Obama, who "has not been Twittering since becoming the president-elect due to transition issues."

Flickr users have posted screenshots of other hijacked accounts.

Dan Tentler, a freelance security researcher based in San Diego, said in a phone interview that for some reason, "people seem to be OK with giving their Twitter passwords away to other sites." He pointed to a gullibility experiment conducted by another Twitter user at the site TwitterAwesomeness.com.

The site openly asks visitors for their Twitter passwords. "It's ok, 247 other people gave their passwords too!" the site explains.

For all its popularity, Twitter has been dogged by privacy and security issues. In July, for example, security researcher Aviv Raff noted that Twitter suffered from a vulnerability that allowed an attacker to force victims to join his or her Twitter follow list automatically.

Last month, spammers created a Twitter account in the name of Google's Internet evangelist Vint Cerf and used it for spamming.

In November, blogger Dare Obasanjo laid some of the blame for Twitter's insecurity on its habit of encouraging "its users to hand out their credentials to any application that asks for them in the first place."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1750
Published: 2015-07-01
Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as cross-sit...

CVE-2014-1836
Published: 2015-07-01
Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

CVE-2015-0848
Published: 2015-07-01
Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

CVE-2015-1330
Published: 2015-07-01
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vecto...

CVE-2015-1950
Published: 2015-07-01
IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report