Risk
11/9/2012
09:02 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Twitter Password Security: 5 Things To Know

Twitter's response to compromised accounts teaches us lessons in social (networking) security.

How 6 Tech Execs Set Social Example
How 6 Tech Execs Set Social Example
(click image for larger view and for slideshow)
If you know anything about phishing, you know that a common tactic is to send an email -- under the guise of a commonly used service -- that includes some kind of provocative come-on. Sometimes the email will say that an account has been compromised and that a password reset is required. The idea is to get people to click through to a site and give up their personal info.

But what if a real company sends a real email warning to users that they may have been compromised by a phish from a fake company using a bogus email? Confused?

So were Twitter users on Thursday after all of this happened to them. Here are five things you should know about the alleged Twitter hack, and some things you can do to stay safe (or at least safer).

1. This week, some personal and business Twitter accounts, including TechCruch, fell prey to a phishing scheme of some kind.

2. Hacked Twitter accounts sent out messages promising special "deals" for those who clicked through a link included with the email. The emails, and the site, were not legitimate.

3. As a result, and to be on the safe side, Twitter reset passwords. A lot of passwords. This practice is in keeping with what Twitter states on its Help Center page: "If we suspect your account has been phished or hacked, we may reset your password to prevent the hacker from misusing your account."

[ Learn from those who are doing it right. Read 7 Lessons From Social Business Leaders. ]

4. Twitter sent an email to "affected" users. TechCrunch published the text of the email, which said: "Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account." The email went on to instruct users to create a new password for their Twitter accounts. Unfortunately, users were instructed to select a new password by clicking on a link from the email -- something end users are taught not to do if they are unsure of the source.

5. Twitter acknowledged on its status site that it may have overdone the password resets: "We're committed to keeping Twitter a safe and open community," the blog said. "As part of that commitment, in instances when we believe an account may have been compromised, we reset the password and send an email letting the account owner know this has happened along with information about creating a new password. This is a routine part of our processes to protect our users. In this case, we unintentionally reset passwords of a larger number of accounts, beyond those that we believed to have been compromised. We apologize for any inconvenience or confusion this may have caused."

Twitter also directed users to its support site, which provides tips for keeping accounts and passwords safe. Twitter's recommendations include:

-- Use a strong password.

-- Watch out for suspicious links, and always make sure you're on Twitter.com before you enter your login information.

-- Make sure your computer and operating system is up-to-date with the most recent patches, upgrades and anti-virus software.

-- Make sure you're on Twitter.com before logging in: Whenever you are prompted to enter your Twitter password, just take a quick look at the URL and make sure you're actually on Twitter.com.

-- If you're using a public computer, like at a library or school, make sure you always sign out of Twitter when you're done.

Were you a victim of the phishing scheme? Regardless, did Twitter change your password on you? What did you think of the process? Please let us know in the comments section below.

Follow Deb Donston-Miller on Twitter at @debdonston.

Online retailers are stuck in a maze of e-business security and PCI compliance requirements. The new, all-digital special issue of Dark Reading gives you 10 Ways To Secure Web Data. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Eric_Brown
50%
50%
Eric_Brown,
User Rank: Apprentice
11/12/2012 | 4:55:35 PM
re: Twitter Password Security: 5 Things To Know
The first thing should be THERE IS NO SECURITY! They say G«£WeG«÷re committed to keeping Twitter a safe and open community and educating you, our users, about the best ways to keep your accounts secureG«•. I find it kind of amusing that they virtually want to be hacked, spammed and viewed as not being secure by telling people like they have in the past, that you need to learn how to manage the damage when you get G«£compromisedG«•. And they will continue to be HACKED defrauded and a continual source of annoying spam until they implement stronger guidelines and in my opinion implement some form of 2FA (two-factor authentication) where you can telesign into your account.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5426
Published: 2014-11-27
MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message.

CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?