3 ms·
Apparently it was the Twitter admin help desk application that was hacked. It's been taken offline. The phishing was separate. "It will be good for the people
by mattmcknight 18y ago
Apparently it was the Twitter admin help desk application that was hacked. It's been taken offline. The phishing was separate.
"It will be good for the people calling for more secure, standards based authentication on Twitter and elsewhere around the web." [from article]
"it is important to note that OAuth would not have prevented either of these attacks" [from Twitter]
I see the point for OAuth third party applications, but that's not the attack vector here. That's just free association. What more secure authentication do people want? Client certificates? Dongles?
- gojomo 18y agoDo you have a link on the help-desk-app angle? One of my guesses would have been updates via SMS. I've read it's easy to forge caller ID; if it's as easy to forge an SMS origin-number, and you knew these accounts were set up to allow updates via SMS from a certain number... voila!
- cscott 18y agoHere's the info on the compromised support tools: http://blog.twitter.com/2009/01/monday-morning-madness.html http://blog.twitter.com/2009/01/monday-morning-madness.html
- deleted 18y ago[deleted]