Saturday, February 02, 2013

250,000 Twitter accounts hacked, company contacts affected end users

Approximately a quarter of a million Twitter users may have had their account information compromised, the company reported on Friday. However, the company also report on Friday night that those accounts which may have been hacked have already had their passwords reset and users informed.

Therefore, if you haven't heard from Twitter by now -- and you should check your spam folder, just in case -- you are probably safe. That is, of course, if Twitter does not determine other accounts were compromised.

In a blog post, the company said:
This week, we detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data. We discovered one live attack and were able to shut it down in process moments later. However, our investigation has thus far indicated that the attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.
The fact that only encrypted/salted version of passwords should be of comfort to end users. However, as we have long recommended, the use of the same password on multiple accounts should be discouraged, no matter what. A hacker could get your Twitter password and from there, get into your email, perhaps your account, and far more.

Twitter's report comes hot on the heels of earlier -- and major -- security breaches at major media publications, including The New York Times and The Wall Street Journal. In both of their stories relating the intrusions, both of the publications alleged that the attacks stemmed from hackers who were attempting to monitor the sites' investigative reporting efforts covering Chinese officials, and that the Chinese government itself may be involved in some way.

It's unclear if the Twitter hack is related in any way. However, Twitter users should take comfort in the security differences between the companies. The Times and WSJ use enterprise-level security -- such as the Symantec security software The Grey Lady said it had installed on its systems, only to see only one of the 45 major security intrusions over the last few months detected. When it came to investigating their intrusions, both the Times and the WSJ opted for third-party security consultants.

Twitter, on the other hand, has an in-house team of security researchers which are considered world-class. In addition, in January of 2012, Twitter acquired Dasient, a security firm focused on malware.

Also of note: The Times admitted its intrusion was related to spear phishing, in which emails or other communications are used to convince a recipient to click through, enter their login information, or install malware. While it can be said that one would expect that Symantec's security software would be able to detect these, it's also the that the weakest link in security remains human beings.

No comments: