Risk
11/9/2012
09:02 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Twitter Password Security: 5 Things To Know

Twitter's response to compromised accounts teaches us lessons in social (networking) security.

How 6 Tech Execs Set Social Example
How 6 Tech Execs Set Social Example
(click image for larger view and for slideshow)
If you know anything about phishing, you know that a common tactic is to send an email -- under the guise of a commonly used service -- that includes some kind of provocative come-on. Sometimes the email will say that an account has been compromised and that a password reset is required. The idea is to get people to click through to a site and give up their personal info.

But what if a real company sends a real email warning to users that they may have been compromised by a phish from a fake company using a bogus email? Confused?

So were Twitter users on Thursday after all of this happened to them. Here are five things you should know about the alleged Twitter hack, and some things you can do to stay safe (or at least safer).

1. This week, some personal and business Twitter accounts, including TechCruch, fell prey to a phishing scheme of some kind.

2. Hacked Twitter accounts sent out messages promising special "deals" for those who clicked through a link included with the email. The emails, and the site, were not legitimate.

3. As a result, and to be on the safe side, Twitter reset passwords. A lot of passwords. This practice is in keeping with what Twitter states on its Help Center page: "If we suspect your account has been phished or hacked, we may reset your password to prevent the hacker from misusing your account."

[ Learn from those who are doing it right. Read 7 Lessons From Social Business Leaders. ]

4. Twitter sent an email to "affected" users. TechCrunch published the text of the email, which said: "Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account." The email went on to instruct users to create a new password for their Twitter accounts. Unfortunately, users were instructed to select a new password by clicking on a link from the email -- something end users are taught not to do if they are unsure of the source.

5. Twitter acknowledged on its status site that it may have overdone the password resets: "We're committed to keeping Twitter a safe and open community," the blog said. "As part of that commitment, in instances when we believe an account may have been compromised, we reset the password and send an email letting the account owner know this has happened along with information about creating a new password. This is a routine part of our processes to protect our users. In this case, we unintentionally reset passwords of a larger number of accounts, beyond those that we believed to have been compromised. We apologize for any inconvenience or confusion this may have caused."

Twitter also directed users to its support site, which provides tips for keeping accounts and passwords safe. Twitter's recommendations include:

-- Use a strong password.

-- Watch out for suspicious links, and always make sure you're on Twitter.com before you enter your login information.

-- Make sure your computer and operating system is up-to-date with the most recent patches, upgrades and anti-virus software.

-- Make sure you're on Twitter.com before logging in: Whenever you are prompted to enter your Twitter password, just take a quick look at the URL and make sure you're actually on Twitter.com.

-- If you're using a public computer, like at a library or school, make sure you always sign out of Twitter when you're done.

Were you a victim of the phishing scheme? Regardless, did Twitter change your password on you? What did you think of the process? Please let us know in the comments section below.

Follow Deb Donston-Miller on Twitter at @debdonston.

Online retailers are stuck in a maze of e-business security and PCI compliance requirements. The new, all-digital special issue of Dark Reading gives you 10 Ways To Secure Web Data. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Eric_Brown
50%
50%
Eric_Brown,
User Rank: Apprentice
11/12/2012 | 4:55:35 PM
re: Twitter Password Security: 5 Things To Know
The first thing should be THERE IS NO SECURITY! They say GÇ£WeGÇÖre committed to keeping Twitter a safe and open community and educating you, our users, about the best ways to keep your accounts secureGÇ¥. I find it kind of amusing that they virtually want to be hacked, spammed and viewed as not being secure by telling people like they have in the past, that you need to learn how to manage the damage when you get GÇ£compromisedGÇ¥. And they will continue to be HACKED defrauded and a continual source of annoying spam until they implement stronger guidelines and in my opinion implement some form of 2FA (two-factor authentication) where you can telesign into your account.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-5367
Published: 2015-08-27
The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows local users to gain privileges via unspecified vectors.

CVE-2015-5368
Published: 2015-08-27
The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before 12.500.00.15.1803 on EliteBook, ElitePad, Elite, ProBook, Spectre, ZBook, and mt41 Thin Client devices allows remote attackers to modify data or cause a denial of service, or execute arbitrary code, via unspecified vectors.

CVE-2013-7424
Published: 2015-08-26
The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to pin...

CVE-2015-2139
Published: 2015-08-26
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5403.

CVE-2015-2140
Published: 2015-08-26
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.