13 ms·
Passwords for 32M Twitter accounts may have been hacked and leaked
- latenightcoding 10y agoI have received 3 warnings about suspicious activity on a twitter account I haven't used since 2011. I wonder how old that leak is.
- dijit 10y agoI also keep getting these for a relative inactive account. I assumed phishing since the subject of the email was "suspicious sign in detected" but the content made no claim of successful sign in.
- goldenkey 10y agoThats nothing compared to the amount of fake twitter accounts for paid followers. Probably in the range of 100s of millions of accounts. For the downvoters, or doubters, goto https://www.fiverr.com/ https://www.fiverr.com/ and see if you don't find these services being offered all over the damn place. 1 million followers for 20 bucks.
- minimaxir 10y agoYou are likely being downvotesd because the comment is off topic.
- thesimpsons1022 10y agoi mean if you try your hardest to make sense of it, maybe he means these could be all fake accounts passwords??
- imdsm 10y agoat a push
- JorgeGT 10y agoYes, I think this is what he means, that this list could have been leaked from some "bot controller" server/network. Or maybe the bot network wants to quit and is selling their assets. This would be coherent with Twitter denying a breach, these would be accounts hacked at some point of the past (and some purposefully generated) and added to the bot network database.
- goldenkey 10y agoThat is what I meant, thank you for clarifying. Too late to edit the post though, it won't let me.
- Olscore 10y agoQuestion: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of those user accounts at all, aside from the obvious that their username is known?
- andrewmunsell 10y agoIt would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.
- Olscore 10y agoAh derp. Totally forgot about rate limiting. Thank you.
- sintaxi 10y agoI thought bcrypt was a deliberately slow algorithm so it cant necessarily be brute forced.
- WA 10y agoBut still much faster than an HTTP request to an Auth API that allows only, say, 5 requests per minute.
- Olscore 10y agoRight, but you would still bypass the rate limiting of the server whether that be login attempts, http requests per second, firewall rules, latency or whatever when checking.
- bad_user 10y agoTwitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.
- middleclick 10y agoJust to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.
- zeeZ 10y agoEven if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?
- irremediable 10y agoWhat exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.
- sitharus 10y agoHardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Twitter uses a one-time code sent via sms so I don't think this would be an issue unless the hack is persistent.
- irremediable 10y ago> Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Oh, damn. Thanks for pointing this out. I'd never looked into the details of HOTP or TOTP -- I assumed they were using public-key crypto rather than just a hash of shared values. That sucks. :(
- visarga 10y agoI am sure Twitter can grab this list and invalidate all passwords quickly.
- yawniek 10y agowhy the heck is 9111961 and 9-11-1961 such a popular password? botfarm?
- simonswords82 10y agoI didn't need another reason to dislike Twitter but this puts another nail in their coffin, for me at least. It seems the two platforms I derive the least amount of value from (Twitter and Linked In) are the most vulnerable to hackers and leaked passwords. I was caught up in the Linked In password debacle recently and now have my e-mail address in the haveIbeenpwned.com database - thanks Linked In. I wonder if I'll get caught up in this mess too. I only keep my Twitter and Linked In accounts to avoid FOMO (Fear of Missing Out) but this is making me want to shut it all down and erase every trace of personal information I have on both sites.
- fizx 10y agoRTFA. Twitter didn't get hacked. Browser malware screen-scraped the passwords.
- simonswords82 10y agoI did RTFA. Do you think a typical end user is going to care the technicalities of how their password might have been leaked? I certainly don't. The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. Had I never used Twitter all of this would be a non-event. Please do tell me if you think I'm being illogical - I'm all ears.
- Matt3o12_ 10y agoIt is also important to note that Russian accounts seem to be affected, which might indicate that only Russian browsers have been affected. Furthermore, if your browser is infected, a lot worse things can happen then having your Twitter account compromised (e.g. access to your PayPal, bank and even your personal files).
- simonswords82 10y agoTrue that - good points well made.
- simonswords82 10y agoI didn't need another reason to dislike Twitter but this puts another nail in the coffin. It seems the two platforms I derive the least amount of value from (Twitter and Linked In) are the most vulnerable to hackers and leaked passwords. I was caught up in the Linked In debacle recently and now have my e-mail address in the haveIbeenpwned.com database - thanks Linked In. I wonder if I'll get caught up in this mess too. I only keep my Twitter and Linked In accounts to avoid FOMO (Fear of Missing Out) but this is making me want to shut it all down and erase every trace of personal information I have on both sites.
- Tinned_Tuna 10y agoI can finally recover my account!
- iDemonix 10y agoI hoped for this but alas, it wasn't there.
- varunom 10y agoSomeone said to me the other day "There are two types of companies, those that have been hacked, and those that don’t yet know they have been hacked."
- supercoder 10y agothere are probably more types
- campuscodi 10y agoCan someone change the op's link to: https://www.leakedsource.com/blog/twitter https://www.leakedsource.com/blog/twitter The real source, not this redundant media crap that buried the lede...
- nailer 10y agodang - ping! (I think he has a regex!)
- broodbucket 10y agoNeeds some sophisticated language parsing to filter out expressions of mild disappointment.
- chucksmash 10y agoHa! Doing NLP to filter out what, like 1-2 false positives a week? Dang, that must win some kind of an award for overengineering.
- return0 10y ago> Subscribe today to view the raw data itself and receive unlimited searches! As low as $0.76 a day! Is that site legit ?
- jswny 10y agoYes. They are a well known data leak source. LeakedSource is probably the most realiable one right now. There is always https://haveibeenpwned.com/ https://haveibeenpwned.com/ but they don't have anywhere near the amount of records places like LeakedSource have. In addition, LeakedSource has access to private databases that aren't public.
- cpncrunch 10y ago>Can someone change the op's link to: >https://www.leakedsource.com/blog/twitter https://www.leakedsource.com/blog/twitter No, let's not. First of all, leakedsource has already been submitted separately, but has fewer upvotes. Presumably people prefer the techcrunch version. It's not really surprising, as leakedsource's article is poorly laid out. It doesn't even have a title (they've put "Preface" as a title, but that's the heading of the first section). Then there's the banner adverts at the top. >The real source, not this redundant media crap that buried the lede... The techcrunch article has responses from twitter and others, along with some analysis, so it's not "redundant media crap".
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- eumoria 10y agoWho has 123456 as their password in 2016!? Oh, wait... 120,417 people apparently. ::head in hands::
- wodenokoto 10y agoWho has a twitter account they don't care about, even at sign-up? Probably millions of people.
- mrweasel 10y agoBots? Combines with the insane high number of mail.ru it would be my guess that mail.ru has made it easy to creates account in some automatic way and that's what the bots are using, along with a silly password.
- webtechgal 10y agoYou would be surprised how many people in India (and elsewhere, for that matter), have that as their online banking password.
- tim333 10y ago>the malware sent every saved username and password from browsers like Chrome and Firefox back to the hackers I wonder how you protect against that apart from the thing banks do where they say enter the third and six character? Even with those if the malware monitored a few of them it could probably figure your info.
- MichaelGG 10y agoSaved user/pass are available to any process running on the machine. You don't have to wait until the user logs in, just access the saved pass DB. (Exception is if you use a password to encrypt the browser saved passes, like Firefox's master password. Then the malware needs to wait until you unlock.)
- cdnsteve 10y agoWhy doesn't Twitter have 2FA or U2F? Problem solved, at least in terms of users not losing reputation within their own social space because someone is posting as them.
- ajoy39 10y agotwitter does have 2FA. You can either get a login code texted to you whenever you login or use the Twitter app to verify logins from new devices.
- deleted 10y ago[deleted]
- mavhc 10y agoIt does https://support.twitter.com/articles/20170388 https://support.twitter.com/articles/20170388
- granos 10y agoThey do. In fact, I just logged in to change my password and had to go get my phone from another room so I could read the code. The annoying thing is that they don't support Google Authenticator or some other TOTP/HOTP token generator. It sucks trying to log into services that use SMS based 2FA when you are not in an are where you get cell reception.
- J_Darnley 10y agoAnd nothing of value was lost.
- deleted 10y ago[deleted]
- pmlnr 10y agoI should just close and burn all my social/bigco accounts and keep only the ones where an RSA token is available and forget to worry about passwords, shouldn't I?
- atom-morgan 10y agohttp://www.reuters.com/article/us-usa-security-nsa-rsa-idUSBREA2U0TY20140331 http://www.reuters.com/article/us-usa-security-nsa-rsa-idUSB...
- puddintane 10y agoWith over 270 million accounts (the largest number I could find) at only roughly 12% of the accounts leaked I'm wondering where the leak occurred? Or possibly the hackers were interrupted mid-download stream? edit That number is actually active users and I do apologize the number of registered accounts is estimated to be over 645 million! edit2 Actually 4.9% of the estimated accounts were "leaked" (if this is an actual twitter leak since still no official word)
- ec109685 10y agoTwitter used to support authentication to their API's with a username / password combination. So this leak could come from an app or service that utilized Twitter apis in some fashion and was hacked.
- niccaluim 10y agoThat seems unlikely. Twitter hasn't supported Basic auth for years.
- 0xfaded 10y agoJust got the email: Your account may have been compromised by a website or service not associated with Twitter. I'd like to know how Twitter credentials were compromised from outside Twitter.
- breakend 10y agoLike they said in the article, Twitter uses bcrypt to store your password, but many of the passwords in the dump were plain text. This suggests that they were scraped together from external sources (i.e. malware on your machine, re-use of a password from one of the other dumps like LinkedIn). Hence, compromised from outside Twitter.
- jobigoud 10y agoThey mention browser password database in the article. If true at the scale of 32M people that would be an even bigger news. Twitter may just be the beginning. Maybe the malware authors are processing and leaking the data per-website for monetization purposes? Another way would be that only a specific twitter app has been targeted by the malware.
- ryanlol 10y ago>They mention browser password database in the article. If true at the scale of 32M people that would be an even bigger news. Twitter may just be the beginning. No, it's not news at all. Anyone who's been running spyeye, zeus, whatever for a while ends up with a similar amount of logs. They don't tend to get posted publicly, but are regularly sold on various forums. 32M simultaneous installs would be a lot, 32M lifetime installs isn't.
- geofft 10y agoPassword reuse and phishing are also plausible.
- wepple 10y agoThey may've checked the password from the breach against your twitter password. If they match, they know that the password breach data could be (and will eventually) be used to access your twitter account.
- mbrd 10y agoDoes anyone know the significance of the date 9-11-1961? The password list has 10,444 matches for "9-11-1961" and 10,231 for "9111961". From Wikipedia, I see that Hurricane Carla hit Texas that day but that doesn't seem noteworthy enough to warrant two instances of the date in the top 20, It would be surprising if it was only due to date of birth too, given I can't spot any other date-like entries.
- hammock 10y agoCould have been a single person mass-creating accounts
- mbrd 10y agoI did wonder whether there was some batch of "fake" Twitter accounts that all had the same password. That is the most plausible thing I can think of.
- arprocter 10y agoI was wondering the same thing "cepetsugih" and "exigent" seem like odd ones too
- diyseguy 10y agocepet sugih means 'rich quick' in Javanese
- varikin 10y agoI also looked up Nov 9, 1961 as most of non-US used day-month-year. Nothing spectacular either.
- steveeq1 10y agoProbably somebody's birthday. And probably part of a bot.
- deleted 10y ago[deleted]
- Zikes 10y ago> Other major security compromises which have hit the news recently include a Myspace hack that involved over 360 million accounts The buried lede for me here is that MySpace has 360+ million accounts. I thought it was DOA.
- gravypod 10y agoDoes anyone here have a raw download to this data set? I'm a student at a university interested in doing some statistical analysis of passwords for a small project. If anyone is able to help me, I'd appreciate them emailing me. You can find my email under my account. It would be a huge help!