Risk
11/9/2012
09:02 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Twitter Password Security: 5 Things To Know

Twitter's response to compromised accounts teaches us lessons in social (networking) security.

How 6 Tech Execs Set Social Example
How 6 Tech Execs Set Social Example
(click image for larger view and for slideshow)
If you know anything about phishing, you know that a common tactic is to send an email -- under the guise of a commonly used service -- that includes some kind of provocative come-on. Sometimes the email will say that an account has been compromised and that a password reset is required. The idea is to get people to click through to a site and give up their personal info.

But what if a real company sends a real email warning to users that they may have been compromised by a phish from a fake company using a bogus email? Confused?

So were Twitter users on Thursday after all of this happened to them. Here are five things you should know about the alleged Twitter hack, and some things you can do to stay safe (or at least safer).

1. This week, some personal and business Twitter accounts, including TechCruch, fell prey to a phishing scheme of some kind.

2. Hacked Twitter accounts sent out messages promising special "deals" for those who clicked through a link included with the email. The emails, and the site, were not legitimate.

3. As a result, and to be on the safe side, Twitter reset passwords. A lot of passwords. This practice is in keeping with what Twitter states on its Help Center page: "If we suspect your account has been phished or hacked, we may reset your password to prevent the hacker from misusing your account."

[ Learn from those who are doing it right. Read 7 Lessons From Social Business Leaders. ]

4. Twitter sent an email to "affected" users. TechCrunch published the text of the email, which said: "Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account." The email went on to instruct users to create a new password for their Twitter accounts. Unfortunately, users were instructed to select a new password by clicking on a link from the email -- something end users are taught not to do if they are unsure of the source.

5. Twitter acknowledged on its status site that it may have overdone the password resets: "We're committed to keeping Twitter a safe and open community," the blog said. "As part of that commitment, in instances when we believe an account may have been compromised, we reset the password and send an email letting the account owner know this has happened along with information about creating a new password. This is a routine part of our processes to protect our users. In this case, we unintentionally reset passwords of a larger number of accounts, beyond those that we believed to have been compromised. We apologize for any inconvenience or confusion this may have caused."

Twitter also directed users to its support site, which provides tips for keeping accounts and passwords safe. Twitter's recommendations include:

-- Use a strong password.

-- Watch out for suspicious links, and always make sure you're on Twitter.com before you enter your login information.

-- Make sure your computer and operating system is up-to-date with the most recent patches, upgrades and anti-virus software.

-- Make sure you're on Twitter.com before logging in: Whenever you are prompted to enter your Twitter password, just take a quick look at the URL and make sure you're actually on Twitter.com.

-- If you're using a public computer, like at a library or school, make sure you always sign out of Twitter when you're done.

Were you a victim of the phishing scheme? Regardless, did Twitter change your password on you? What did you think of the process? Please let us know in the comments section below.

Follow Deb Donston-Miller on Twitter at @debdonston.

Online retailers are stuck in a maze of e-business security and PCI compliance requirements. The new, all-digital special issue of Dark Reading gives you 10 Ways To Secure Web Data. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Eric_Brown
50%
50%
Eric_Brown,
User Rank: Apprentice
11/12/2012 | 4:55:35 PM
re: Twitter Password Security: 5 Things To Know
The first thing should be THERE IS NO SECURITY! They say G«£WeG«÷re committed to keeping Twitter a safe and open community and educating you, our users, about the best ways to keep your accounts secureG«•. I find it kind of amusing that they virtually want to be hacked, spammed and viewed as not being secure by telling people like they have in the past, that you need to learn how to manage the damage when you get G«£compromisedG«•. And they will continue to be HACKED defrauded and a continual source of annoying spam until they implement stronger guidelines and in my opinion implement some form of 2FA (two-factor authentication) where you can telesign into your account.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.