Risk
1/5/2009
04:00 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Twitter Has Security Meltdown

The microblogging site recommends users reset their passwords and verify their e-mail addresses because of a phishing campaign directed at its users and the hacking of its support software.

Twitter's security melted down on Monday in the face of a phishing campaign directed at Twitter users and the hacking of Twitter's support software.

The security failure has resulted in the temporary takeover of Twitter accounts associated with Facebook, Fox News, The Huffington Post, Barack Obama, Britney Spears, and CNN's Rick Sanchez.

The phishing campaign was first reported on Saturday. Tech blogger Chris Pirillo warned that he had received a direct message from one of his Twitter followers advising him to visit sites designed to look like Twitter's logon page that smelled "phishy."

"The message bears a link to a Web site that only appears to come from Twitter but is of course a scam Web site where your account information will be stolen," Symantec researcher Marian Merritt explained in a blog post.

On Monday, Twitter acknowledged that it was having other security problems. "A number of high-profile Twitter accounts were compromised this morning, and fake/spam updates were sent on their behalf," Twitter said in a blog post. "We have identified the cause and blocked it. We are working to restore compromised accounts."

Twitter said that the issue with these 33 accounts was separate from the phishing scam noted over the weekend. "These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the e-mail address associated with their Twitter account when they can't remember or get stuck," the company explained. "We considered this a very serious breach of security and immediately took the support tools offline. We'll put them back only when they're safe and secure."

Twitter is advising users to reset their passwords and to verify that the e-mail address stored in Twitter's account setting area is legitimate.

Twitter said the two of the compromised accounts belong to CNN's Sanchez and President-elect Obama, who "has not been Twittering since becoming the president-elect due to transition issues."

Flickr users have posted screenshots of other hijacked accounts.

Dan Tentler, a freelance security researcher based in San Diego, said in a phone interview that for some reason, "people seem to be OK with giving their Twitter passwords away to other sites." He pointed to a gullibility experiment conducted by another Twitter user at the site TwitterAwesomeness.com.

The site openly asks visitors for their Twitter passwords. "It's ok, 247 other people gave their passwords too!" the site explains.

For all its popularity, Twitter has been dogged by privacy and security issues. In July, for example, security researcher Aviv Raff noted that Twitter suffered from a vulnerability that allowed an attacker to force victims to join his or her Twitter follow list automatically.

Last month, spammers created a Twitter account in the name of Google's Internet evangelist Vint Cerf and used it for spamming.

In November, blogger Dare Obasanjo laid some of the blame for Twitter's insecurity on its habit of encouraging "its users to hand out their credentials to any application that asks for them in the first place."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.