5 ms·
Twitter Hacker Says Admin Password Was 'Happiness'
- Jasber 18y agoHe also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines. I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.
- alaskamiller 18y agoHe didn't hijack those accounts; he gave out the credentials in a forum thread and others jumped on it.
- Jasber 18y agoTechnically you're correct, but by giving out the credentials in a public forum he should have known better.
- alaskamiller 18y agoDG is an unique place.
- cdr 18y agoThis was when he was just running a dictionary attack on a random Twitter account, before he even had any idea he was hitting a privileged login.
- trezor 18y agoI don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines. He was hijacking a random account on some totally unknown site called twitter. I know this is hard to grasp outside the valley, but most people have not ever heard about twitter and will probably assume it's about as important to the internet as zombo.com.
- cstejerean 18y agoActually CNN mentions Twitter quite often and especially during the elections a lot of people started hearing of Twitter way outside of the valley. If my parents learned about Twitter from watching TV I assume it's a safe bet that many other people have as well.
- trjordan 18y agoThe last sentence of the article: "He said he'd never even heard of Twitter until he saw someone mention it on YouTube. "
- sanjayparekh 18y agoThis is again a reason why you shouldn't make accessing internal company services too easy. Yeah, it can be a pain but once someone figures out a little piece of the puzzle, they can run amok in your network. In hindsight, tying customer service methods to employee Twitter accounts was the big mistake.
- bprater 18y agoSure was a heck of a guess to end up with a staffer.
- bprater 18y agoAgain, it brings up the case of why passwords are bad at this level. Maybe staffers should have used a secondary password to get administrative rights. Or maybe they should have been using an entirely different account.
- Tangurena 18y agoAdmin accounts should not use the main website for access - they should only have access through an admin website. If you must let admin accounts use the main website, then they should have a whitelist of IP addresses that they may log in from - and those IP addresses should map to the internal company IP addresses. Otherwise, if you absolutely positively MUST have admin accounts use the same website, and allow them access from outside the company, then you need to have a second factor authentication device like a SecurID token.
- bprater 18y agoThis does bring up a good tech question -- how do you prevent people from doing a rapid password attack? Anyone have an article or some ideas on how this could be done? Is limiting attempts the simplest way? Even if you do limits, aren't these session-based? I'm guessing a cracker isn't going to respect sessions.
- fuzzmeister 18y agoYou could just throw recent login attempts into a table, but that might get big quickly.
- liuliu 18y agoor memcachedb, or just use mollom.com
- aniketh 18y agodidn't realize an alternative to akismet existed... quick question : how come mollom says 78% of comments are spam, but akismet says 85%?
- shaunxcode 18y agoand thus could also be archived/truncated frequently as it is only relevant within a certain time frame right?
- catch23 18y agowhy even bother logging that? just store it in memory someone. have a counting bloom filter remember the set of IPs that tried to login during the last 10 seconds. If your ip is in that set, delay the user by 10 seconds or so...
- amix 18y agomemcached is great for these kind of things.
- 18y ago
- staunch 18y agoThis is why ideally you only make your admin tools available on your private network, accessible only via VPN. The very minimum is restricting access to admin functionality to specific IP addresses. Limiting password check attempts is important too, but if all a bad guy could get access to is user accounts the damage is significantly less.
- johns 18y agoLimiting attempts is a great way to allow people to remotely execute a DoS on your admin site. They can keep you out for awhile before you block them. If your company has a password lockout policy, keep guessing the CEO or CIOs password constantly for a few days and the policy will be changed pretty quickly. The other suggestions are good.
- deleted 18y ago[deleted]
- nuclear_eclipse 18y agoYou don't lockout the account, you lockout the attacking client, typically by IP address. It still allows the attacked accounts access from non-attacking IP addresses.
- andrewbadera 18y agoand if the attacking client is someone sitting on the corporate internet? way to block the entire corp from logging in ...
- Alex3917 18y agoIt seems like the three main strategies are locking the account, blocking the IP, or forcing a password reset. What if instead, the account login name automatically got changed after a few missed attempts but the password remained the same. That would get around the DoS problem and also the corporate IP / AOL problem.
- mynameishere 18y agohttp://www.youtube.com/watch?v=qEZxgEgG5Cg#t=1m52s http://www.youtube.com/watch?v=qEZxgEgG5Cg#t=1m52s
- justifyleo 18y agoweak
- axod 18y ago"He said he'd never even heard of Twitter until he saw someone mention it on YouTube." Classic
- tlrobinson 18y agoUnsurprising. Most people have no idea what Twitter is. I've noticed sometimes the tech world feels like a bubble where our sense of what's important in the "real world" gets warped.
- pclark 18y agowe're all human, and twitter is very new. We all make mistakes, doesn't seem terrible honestly.
- eli 18y agoNo, it wasn't. "Happiness" was the password for the account of a user who happened to be on the support staff.