Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/5/2009
04:00 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Twitter Has Security Meltdown

The microblogging site recommends users reset their passwords and verify their e-mail addresses because of a phishing campaign directed at its users and the hacking of its support software.

Twitter's security melted down on Monday in the face of a phishing campaign directed at Twitter users and the hacking of Twitter's support software.

The security failure has resulted in the temporary takeover of Twitter accounts associated with Facebook, Fox News, The Huffington Post, Barack Obama, Britney Spears, and CNN's Rick Sanchez.

The phishing campaign was first reported on Saturday. Tech blogger Chris Pirillo warned that he had received a direct message from one of his Twitter followers advising him to visit sites designed to look like Twitter's logon page that smelled "phishy."

"The message bears a link to a Web site that only appears to come from Twitter but is of course a scam Web site where your account information will be stolen," Symantec researcher Marian Merritt explained in a blog post.

On Monday, Twitter acknowledged that it was having other security problems. "A number of high-profile Twitter accounts were compromised this morning, and fake/spam updates were sent on their behalf," Twitter said in a blog post. "We have identified the cause and blocked it. We are working to restore compromised accounts."

Twitter said that the issue with these 33 accounts was separate from the phishing scam noted over the weekend. "These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the e-mail address associated with their Twitter account when they can't remember or get stuck," the company explained. "We considered this a very serious breach of security and immediately took the support tools offline. We'll put them back only when they're safe and secure."

Twitter is advising users to reset their passwords and to verify that the e-mail address stored in Twitter's account setting area is legitimate.

Twitter said the two of the compromised accounts belong to CNN's Sanchez and President-elect Obama, who "has not been Twittering since becoming the president-elect due to transition issues."

Flickr users have posted screenshots of other hijacked accounts.

Dan Tentler, a freelance security researcher based in San Diego, said in a phone interview that for some reason, "people seem to be OK with giving their Twitter passwords away to other sites." He pointed to a gullibility experiment conducted by another Twitter user at the site TwitterAwesomeness.com.

The site openly asks visitors for their Twitter passwords. "It's ok, 247 other people gave their passwords too!" the site explains.

For all its popularity, Twitter has been dogged by privacy and security issues. In July, for example, security researcher Aviv Raff noted that Twitter suffered from a vulnerability that allowed an attacker to force victims to join his or her Twitter follow list automatically.

Last month, spammers created a Twitter account in the name of Google's Internet evangelist Vint Cerf and used it for spamming.

In November, blogger Dare Obasanjo laid some of the blame for Twitter's insecurity on its habit of encouraging "its users to hand out their credentials to any application that asks for them in the first place."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18216
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.