01:09 PM
Connect Directly

Twitter Pursues Two-Factor Authentication After Password Breach

Live attack compromised up to 250,000 accounts, leading Twitter to reset affected users' passwords.

Twitter is pursuing two-factor authentication to improve log-on security.

That news follows Twitter's Friday disclosure of a security breach affecting an estimated 250,000 of its 250 million users. Following the breach, Twitter reset passwords for all affected users but said its related investigation -- including identifying exactly what data attackers accessed -- remains underway.

"This week, we detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data," said Bob Lord, Twitter's director of information security, in a Friday blog post.

So far, however, it's not clear exactly what the attackers may have accessed. "We discovered one live attack and were able to shut it down in process moments later," Lord said. "However, our investigation has thus far indicated that the attackers may have had access to limited user information -- usernames, email addresses, session tokens and encrypted/salted versions of passwords -- for approximately 250,000 users."

[ What is China's role in the recent New York Times and Wall Street Journal hacks? Read NYT, WSJ Hacks Scrutinized By Security Community. ]

To err on the side of caution, Lord said passwords for those 250,000 users had been reset and that they should have received an email from Twitter telling them to create a new password. "As a precautionary security measure, we have reset passwords and revoked session tokens for these accounts," he said. "Your old password will not work when you try to log in to Twitter." Lord also urged users to pay attention to recently issued warnings from the Department of Homeland Security that using any version of the Java browser plug-in should be avoided unless absolutely necessary. But Lord said nothing that explicitly tied the breach of Twitter's system to an exploit of a Java vulnerability.

The ease with which attackers in possession of Twitter users' passwords can gain access to those users' accounts and to all private communications using Twitter appears to have driven company officials to begin pursuing two-factor authentication. This was revealed by a job listing on Twitter's site for a software engineer--product security. Listed in the job description is the responsibility to "design and develop user-facing security features, such as multifactor authentication and fraudulent login detection."

The job listing was spotted Monday by Britain's Guardian newspaper. Twitter didn't immediately respond to an emailed request for comment about whether it planned to add two-factor authentication to the site, or when it might make such a feature available. But Twitter's apparent two-factor authentication plans have already drawn praise. "This is a splendid idea -- I'm looking forward to it. It's something that we've wanted for some time," Graham Cluley, senior technology consultant at Sophos, told the Guardian. "We've often said we would be prepared to pay for it -- Twitter could monetize it by offering it to corporations and branded accounts. It would be pretty attractive."

Twitter's last major user-facing security improvement came in March 2012, when HTTPS became the default option for connecting to the site, thus securing communications between the Twitter site and Twitter users. Two-factor authentication, meanwhile, would add an extra layer of defense to Twitter's log-in processes and help stop attackers who managed to hack into Twitter's systems and steal users' passwords from accessing users' accounts.

Two-factor authentication has long been offered by Google for use with Gmail and other Google Apps. Dropbox, meanwhile, began offering two-factor authentication after suffering an embarrassing password breach. For both Google and Dropbox, users who have enabled two-factor authentication must enter both their password and a unique code -- the second factor -- generated either by an app on their smartphone or sent to their mobile phone in an SMS message.

Until Twitter adopts such a system, its only recourse when attackers hack into its systems and steal users' passwords -- assuming that the company spots the breach -- is to immediately expire those passwords, as Twitter says it has done. Interestingly, however, some affected users have reported that their expired passwords still work when they log into Twitter via the Twitter API, which is used by third-party tools such as Tweetdeck as well as Twitter's own iOS Twitter apps to allow the application to access Twitter.

According to Twitter spokesperson Jim Prosser, the continuing access comes via Twitter's use of the Open Authorization (OAuth) open source standard for authorization. "TweetDeck and other clients use OAuth, so as long as you don't sign out, you don't have to re-input your credential every time you open the app," Prosser told The Register, which first spotted the problem. But Twitter's failing to expire OAuth tokens means that not all users affected by the breach have had their OAuth session tokens likewise expired.

Twitter didn't immediately respond to an emailed request for comment about whether it might expire the OAuth tokens for users affected by the password breach.

This isn't the first seeming glitch in how Twitter handles third-party authentication to its services. Last month, notably, security researcher Cesar Cerrudo reported finding "a simple bypass trick for third-party applications to obtain access to a user's Twitter direct messages." Cerrudo said he made the discovery after finding that a Web application he was testing -- to which he hadn't granted authorization to access his direct messages -- was able to access and display those messages.

Wily attackers are using shape-shifting malware to fool your defenses. Are you ready? Also in the new, all-digital Malware's Next Generation issue of Dark Reading: The shift in hacking requires a new defense mindset. (Free with registration.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/5/2013 | 6:14:27 AM
re: Twitter Pursues Two-Factor Authentication After Password Breach
why don't they use and external system?n++
Christopher Budd
Christopher Budd,
User Rank: Apprentice
2/4/2013 | 10:00:02 PM
re: Twitter Pursues Two-Factor Authentication After Password Breach
I'm surprised that Twitter has taken this long to look into 2FA. I'm even more surprised we haven't seen a bigger problem like this sooner.

For reference, Yahoo and Facebook also have 2FA schemes. Microsoft doesnt, though they have some mitigations with "Trusted PCs" and limited 2FA on sites like their billing and XBox Points sites.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.