Risk
11/9/2012
09:02 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Twitter Password Security: 5 Things To Know

Twitter's response to compromised accounts teaches us lessons in social (networking) security.

How 6 Tech Execs Set Social Example
How 6 Tech Execs Set Social Example
(click image for larger view and for slideshow)
If you know anything about phishing, you know that a common tactic is to send an email -- under the guise of a commonly used service -- that includes some kind of provocative come-on. Sometimes the email will say that an account has been compromised and that a password reset is required. The idea is to get people to click through to a site and give up their personal info.

But what if a real company sends a real email warning to users that they may have been compromised by a phish from a fake company using a bogus email? Confused?

So were Twitter users on Thursday after all of this happened to them. Here are five things you should know about the alleged Twitter hack, and some things you can do to stay safe (or at least safer).

1. This week, some personal and business Twitter accounts, including TechCruch, fell prey to a phishing scheme of some kind.

2. Hacked Twitter accounts sent out messages promising special "deals" for those who clicked through a link included with the email. The emails, and the site, were not legitimate.

3. As a result, and to be on the safe side, Twitter reset passwords. A lot of passwords. This practice is in keeping with what Twitter states on its Help Center page: "If we suspect your account has been phished or hacked, we may reset your password to prevent the hacker from misusing your account."

[ Learn from those who are doing it right. Read 7 Lessons From Social Business Leaders. ]

4. Twitter sent an email to "affected" users. TechCrunch published the text of the email, which said: "Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account." The email went on to instruct users to create a new password for their Twitter accounts. Unfortunately, users were instructed to select a new password by clicking on a link from the email -- something end users are taught not to do if they are unsure of the source.

5. Twitter acknowledged on its status site that it may have overdone the password resets: "We're committed to keeping Twitter a safe and open community," the blog said. "As part of that commitment, in instances when we believe an account may have been compromised, we reset the password and send an email letting the account owner know this has happened along with information about creating a new password. This is a routine part of our processes to protect our users. In this case, we unintentionally reset passwords of a larger number of accounts, beyond those that we believed to have been compromised. We apologize for any inconvenience or confusion this may have caused."

Twitter also directed users to its support site, which provides tips for keeping accounts and passwords safe. Twitter's recommendations include:

-- Use a strong password.

-- Watch out for suspicious links, and always make sure you're on Twitter.com before you enter your login information.

-- Make sure your computer and operating system is up-to-date with the most recent patches, upgrades and anti-virus software.

-- Make sure you're on Twitter.com before logging in: Whenever you are prompted to enter your Twitter password, just take a quick look at the URL and make sure you're actually on Twitter.com.

-- If you're using a public computer, like at a library or school, make sure you always sign out of Twitter when you're done.

Were you a victim of the phishing scheme? Regardless, did Twitter change your password on you? What did you think of the process? Please let us know in the comments section below.

Follow Deb Donston-Miller on Twitter at @debdonston.

Online retailers are stuck in a maze of e-business security and PCI compliance requirements. The new, all-digital special issue of Dark Reading gives you 10 Ways To Secure Web Data. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Eric_Brown
50%
50%
Eric_Brown,
User Rank: Apprentice
11/12/2012 | 4:55:35 PM
re: Twitter Password Security: 5 Things To Know
The first thing should be THERE IS NO SECURITY! They say G«£WeG«÷re committed to keeping Twitter a safe and open community and educating you, our users, about the best ways to keep your accounts secureG«•. I find it kind of amusing that they virtually want to be hacked, spammed and viewed as not being secure by telling people like they have in the past, that you need to learn how to manage the damage when you get G«£compromisedG«•. And they will continue to be HACKED defrauded and a continual source of annoying spam until they implement stronger guidelines and in my opinion implement some form of 2FA (two-factor authentication) where you can telesign into your account.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant