9 ms·
Twitter Hacked – 250,000 User Accounts Potentially Compromised
- 0x0 14y agoOfficial blogpost: http://blog.twitter.com/2013/02/keeping-our-users-secure.html http://blog.twitter.com/2013/02/keeping-our-users-secure.htm... Edit: I wonder if the bad guys were able to access private Direct Messages, too. There's always talk about resetting passwords, but nobody ever mentions all the other confidential data that might be pastebin'ed later.
- nemothekid 14y agoThis attack was not the work of amateurs, and we do not believe it was an isolated incident. The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked. Anyone have any clue what the possible motives behind this could be? My best guess is someone is trying to mine for private data that may have been sent over DM (Maybe Obama is sending nuke launch codes over DM). Other than that twitter's data is mostly public and I don't see the benefit of carrying out such an attack to simply impersonate Justin Bieber on Twitter. I also don't suspect Twitter to be the type of company that would leave their passwords easily crackable either. Doesn't make sense that were mining for valid emails either, there are cheaper ways of getting access to those.
- deleted 14y ago[deleted]
- rdl 14y ago"HACKED BY CHINESE!!!" is the default assumption. There are moderate numbers of people who use Twitter for online activism. That would point more to Syria or Iran or another Middle Eastern country, since Twitter is more popular there than in China or the Chinese language.
- taligent 14y agoNobody hacks Twitter just to get valid emails or impersonate someone. That's ridiculous. Pretty clearly this was the work of governments e.g. China, Iran who are trying to find out more about political dissidents or the sources of leaks. They are the only ones who would use lucrative exploits against Twitter, NYT, WSJ etc.
- nemothekid 14y agoSo to make this clear, the best guess is these attacks are being done by governments in an effort to find out who is leaking data to Twitter, NYT, etc? Pretty interesting if you ask me, is it likely the use would sick the best hackers at the NSA if top secret information was being leaked on the bizzaro world's Chinese Twitter? It almost sounds like the prologue to the worlds first CyberWar.
- 0x0 14y agoTo reiterate what I've been posting elsewhere, I'm sure there is a lot of compromising material in the Direct Messages of certain well-picked accounts, for a wide range of motives.
- bitcartel 14y agoThere is nothing clear about this attack at all, thus it's grossly unfair to cast aspersions on any country or select group of individuals unless there is hard evidence.
- chris_mahan 14y agoOr perhaps US government...
- rasengan0 14y agoAt first i thought the email was phishing but sure enough my acct was reset even with 17 chars. i wonder if Twitter can cull any correlations from this compromised pool, epidemiological-like
- wallywax 14y agoHmm. Perhaps that explains why I got an email from them saying my account was compromised. Specifically, it said "Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account." It then went on to imply that I was phished, which is extremely unlikely (not only am I incredibly paranoid about that kind of thing, but I haven't actually entered my Twitter password on any website in a long time. I just use the mobile app on my phone.)
- wiredfool 14y agoMe too, and I've never attached an app to twitter. (I've got an account that I basically have signed into 3 or 4 times in 5 years). I'm curious why my username came up as being compromised, unless they're doing something sneaky about updating all passwords older than x yrs old. edit: The attacker got salted password hashes. That explains it.
- 0x0 14y agoMaybe they stopped the hackers in the middle of dumping the database and they only got away with the earliest accounts created.
- wiredfool 14y agoIirc, my usernumber is ~ 700k. So, probably an early version of the hash, unless they silently upgrade on logins.
- wallywax 14y agoCould be. My account dates from 2006, and my userid is sub 50k.
- kape 14y agoGot also the message. My account was created in January 2007 and user id is about 700k. So this could be the case.
- 14y ago
- akkartik 14y agoI wonder if this is related to the Rails YAML issues (https://news.ycombinator.com/item?id=5145397 https://news.ycombinator.com/item?id=5145397)
- gklitt 14y agoI sincerely hope Twitter would know better than to leave those vulnerabilities exposed on any Rails code they're still using. Also, that probably wouldn't count as a "sophisticated" attack in their book...
- sp_ 14y agoAttacks are always described as sophisticated in press releases. What do you expect them to say? We were asleep at the wheel and got owned by someone pointing Metasploit on our servers?
- upthepunx 14y agoThe way these things have been going (client-side vulnerability exploitation), I would suspect that the exploited vulnerabilities were closer to the laptops of Twitter employees than the Twitter application itself. The blog post mentions turning off Java in your browser, which could be a clue to the attack vector Twitter suffered, and it's written by someone from "Information Security" rather than someone from Application Security.
- 0x0 14y agoGreat point. I'm sure it's easier to compromise a developer or sysadmin and use that to jump onto the production system, rather than going straight at the main app.
- taligent 14y agoIssue is that you don't know which of the tens of thousands of internal IP addresses would correspond to the one or two sysadmins who would have production access. Which means either the production servers were hacked or there was a widespread compromise of their internal network and systems e.g. email, IM.
- kzahel 14y agoMy bet is Chinese govt sponsored hackterrorism
- alanh 14y agoDownvoted your guess because you didn’t even cite the recent trend (which is mentioned in the article) of reported Chinese hackings, and you contribute nothing.
- rdl 14y agoWhy the fuck is it 2013 and Twitter doesn't support two factor auth?
- bo1024 14y agoIt would be nice to know how well-protected the passwords were. (Were the salts also accessed? How were the passwords hashed?)
- madsushi 14y ago> usernames, email addresses, session tokens and encrypted/salted versions of passwords Wow, finally a breach where the hackers DIDN'T make off with all of our passwords in plain-text. Kudos to Twitter for actually handling passwords properly, considering the eventuality that all websites are vulnerable to attack.
- josephscott 14y agoI would feel better if I new how they handled passwords. Hopefully it is a hash and not encrypted. And hopefully that hash method is bcrypt (or something similarly painful to crack).
- riffraff 14y agomy first thought when reading the mail was exactly this: oh nice, salted and hashed but _how_? I remember a time when many people assumed md5("notreallysalt"+password) was a good practice, and twitter is old.
- slig 14y agoWho is telling the truth? From the email I just got from them: > Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account.
- alanh 14y agoSounds like a coincidence, to me
- marcoamorales 14y agoI got both of these emails.
- ianstormtaylor 14y agoI really don't like how they decided to release this on a friday afternoon. I know exactly why they did it, and why it is a smart PR move but it also means two things: - People's accounts might have been compromised earlier "this week" and they could have used that extra warning time to make sure the damage didn't spread to their other online accounts. - People who might have been compromised are now less likely to see the announcement, so if anything is compromised there's less chance they will react to mitigate damages. Great for PR, horrible for their users.
- jug6ernaut 14y agoSadly you are exactly right. I wish companies would put both of these things first. Why so often does one have to come at the expense of the other? Yes i know this is "naive" thinking, but i also think its the kind of thinking that can change a company for the better. Would it be easy? No. But in the end it its use the users that have to not think so critically of these "political pitfalls"(my words). Hacking happens, time and time again this stuff happens. If twitter(or another company) took measures to protector there users and didn't do something completely stupid like keeping plain text info, we should all just take what happened for what it is and move on. With these situations coming more and more common we are going to have to do this anyways.
- taf2 14y agoOr it could have actually just been discovered today. It's too easy to sit from afar and assume the worst. Maybe sometimes things just happened this way. Maybe the "bad" people involved in the attack figured if they got away with it less people would be looking on a weekend so they could get further. Just saying... it's easy to assume "big" companies do what's best for them aways... but really they're just a bunch of people trying in most cases to do the right thing. So, before you click "fire" on that enter key... think about it.. there are people on the receiving end... probably a lot like you.
- ianstormtaylor 14y agoI don't think they would have said "this week" if they could have gotten away with "today". "Today" sounds a lot less dangerous, prolonged, etc.
- dewitt 14y agoThis is the text of the message I received (once for each account, all created back around the same time January 2007): Hi, dewitt Twitter believes that your account may have been compromised by a website or service not associated with Twitter. We've reset your password to prevent others from accessing your account. You'll need to create a new password for your Twitter account. You can select a new password at this link: *** As always, you can also request a new password from our password-resend page: https://twitter.com/account/resend_password Please don't reuse your old password and be sure to choose a strong password (such as one with a combination of letters, numbers, and symbols). In general, be sure to: Always check that your browser's address bar is on a https://twitter.com website before entering your password. Phishing sites often look just like Twitter, so check the URL before entering your login information! Avoid using websites or services that promise to get you lots of followers. These sites have been known to send spam updates and damage user accounts. Review your approved connections on your Applications page at https://twitter.com/settings/applications. If you see any applications that you don't recognize, click the Revoke Access button. For more information, visit our help page for hacked or compromised accounts. The Twitter Team Best of luck to the security and support teams. Days like these are not fun at all.
- dewitt 14y agoAnd for people trying to puzzle out who was impacted, several these accounts (all with random strings for passwords, btw) were barely ever used at all, often not for several years. The only thing they had in common was their early creation date, and hence relatively low user ids. My guess is that the hackers simply scanned user ids starting from 1 and worked their way up.
- guelo 14y agoThat would explain the high incidence among hackers, who are more often early adopters. I've been surprised by how many people I've heard of getting the email, including people in this comment thread and myself, considering only 250,000 emails were sent out of their couple hundred million accounts.
- baconhigh 14y ago
- seldo 14y agoThe timing of this hack, and the fact that Twitter was (at least at one point) a Rails app, and still uses Ruby on the front end, makes me think this is likely a YAML vulnerability exploit. Can anyone confirm/rule this out?
- thezilch 14y agoOf course, that potentially means that 250,000 user accounts were also compromised on Facebook, Pinterest, Instagram, GMail, Yahoo Mail, Hotmail, et al. If you aren't using a different password for every service or are using only a derivative of a master password (eg. hunter2@twitter, hunter2@gmail, etc), CHANGE YOUR PASSWORD on all services using the same email address (or derivatives) as your Twitter account. Setup 1Password.
- dewitt 14y agoIf only the salt and the hash were stolen as is being stated, and you used secure (read, non-dictionary-word-derived strings) you're probably okay even if you reused passwords. But you shouldn't be reusing passwords anyway, of course, so go change them regardless.
- sxtxixtxcxh 14y agotwitter passwords were salted and hashed.
- thezilch 14y agoYeah, big deal; assume it's known. Change it; change any other service with something "identical." Of course, if you are smart enough to know the implications of both a strong password and salting and not using the same password, you can make your own decision, but if you are at that point, why not change it regardless?
- mosburger 14y agoAnd while you're at it, setup two-factor authentication on your Google account. It's a PITA, but much less of a pain than trying to get your account back.
- sabat 14y agoYou know, I've had this going on all four of my Gmail/Google accounts (!) for well over a year now, and I still think it's totally worth it. It's not really a pain, and I can sleep better because of it.
- deleted 14y ago[deleted]
- artursapek 14y agoHahah, Jack Dorsey was speaking at my school today. Can't have helped his stage confidence to have this on his mind.
- tanepiper 14y agoI'm a Nov 2006 account and I just got the email - since then I have reset my password to be particularly strong - but it seems it's forcing me to do it again (not that I mind, I use a very strong password stored in LastPass)
- baconhigh 14y agoyeap, just got one too. my id is around the 19000s.. Of note, the apps I have allowed access to my account are: tweetdeck, twitter for android/OSX and instagram. (if that helps any diagnosis of potential attack vectors)
- bengillies 14y agoSalted and hashed passwords? Companies emailing affected users? What is this the future?
- martinced 14y agoCompanies that do not allow remote attackers to gain access to their DB? Not that I disagree with you but it's not exactly as if Twitter was a role-model of security on this one...
- KMag 14y agoI was an engineer at Google when the Aurora attacks happened. Until we know more about the attackers and how it was pulled off, we don't know if this was amateur hour security, or if Twitter was facing an Advanced Persistent Threat with multiple 0days and custom malware. Google used a combination of kerberos, SSH public key auth, client-side SSL certs, and a custom crypto system called Low Overhead Authentication System (LOAS), all of which utilize zero-knowledge proofs rather than sending passwords to the server. Google still got compromised, using a (0day?) Adobe Reader exploit sent via impersonating a co-worker on AIM or MSN Messenger (as I remember). Let's leave the jury out on this one until we find out what happened.
- mikegioia 14y agoThat's insane. Is there a write-up about the security behind that Google server configuration?
- KMag 14y agoI'm not aware of any such public documentation. Given the sorts of highly capable threats Google is up against, I imagine they want to do everything in their power to slow down attackers. Also, they don't even allow the codenames of various parts of their infrastructure to be leaked, much less how the parts relate and how they're protected. I'd really like to see LOAS open-sourced. I imagine that, like Kerberos, it's based on Needham-Schroeder, but I've never seen its source code or any design documentation.
- pbhjpbhj 14y agoHmm, I saw this story, changed my account password(s). Then I noticed that I'd already had the email. The email said that the password had been reset (as in dewitt's post) but I'd just logged in - after the claimed reset - with the old credentials. That's kinda worrying.
- tmsh 14y agoEverything needs to shift to MFA... http://news.ycombinator.com/item?id=5149023 http://news.ycombinator.com/item?id=5149023
- Adaptive 14y agoI received this same mail earlier. Very glad that I have a policy of strong random passwords for each site. Not affiliated with them other than being a user, but I recommend Lastpass + Yubikey for two factor (you can Google Auth as well with Lastpass).
- dpweb 14y agoThey need to make public the details. How was it done? They left that out of the announcement. You guys know better public disclose of hacking techniques prepares much less tech savvy (about everyone) that twitter website operators can prepare and protect themselves. Please consider signing.. https://www.change.org/petitions/twitter-com-release-the-details-of-how-your-systems-were-compromised-hacked#share https://www.change.org/petitions/twitter-com-release-the-det...
- jtokoph 14y agoI'm guessing they got a non-anonymized mini dump of the database for local development. An engineer may have had a small subset of data on his local machine.
- 0x0 14y agoThat actually sounds very likely!
- michaelhoffman 14y ago"[W]e encourage all users to take this opportunity to ensure that they are following good password hygiene..." Wow, that's so insulting. How about you just do your job instead?
- talaketu 14y agoWow, poor precious. Are you likewise insulted when the bank tells you not to keep a written note of your PIN with your card? As obvious as it is to you to ensure good password hygiene, it should be obvious that Twitter has a clear interest in encouraging less informed users doing the same.
- bradly 14y agoVery concerning that while my session was terminated in my browser my iPhone and iPad apps are still authenticated. Shouldn't those sessions have been invalidated too?
- fredoliveira 14y agomost apps use xAuth, which means your password isn't sent down the wire except for the very first time you authenticate.
- nikcub 14y agoI still killed all my oauth tokens, since they can be replayed
- gfosco 14y agoPerforming a "forced-reset" on waves of accounts is a pretty effective way of eliminating 'anonymous' accounts no longer linked to a valid email. I bet a decent number of users were permanently locked out of their accounts.
- rasengan0 14y agoDid any one get any stranger followers before or after the twitter warning/password reset? Not sure if this is a coincidence but i got a follower at 3am today then the twitter warning. the follower is legit but i can't make a connection/context as to why they would follow me. After i did a pswd reset i get another follower who i known for years in business but now wonder if these coincidences are related. this all reminds me of that twilight zone episode on Maple St where the aliens fiddle with the lights and the whole town goes paranoid bonkers :-)
- abadidea 14y agoI made a spreadsheet of 53 victims I found. It seems the defining trait is that the account was opened in 2007. There was like one or two from 2006 and one from 2012 but that one may be spurious. Also, almost everyone on the list unambiguously owns an iPhone, but that may just be a coincidence owing to popularity and my sample being inherently weighted to English-speakers. Only found one non-English user I was confident was saying they got the email. https://docs.google.com/spreadsheet/ccc?key=0AmIfHssIKuJgdFFEbC14dDdOOWZQcHlKbWI3dHpNQmc#gid=0 https://docs.google.com/spreadsheet/ccc?key=0AmIfHssIKuJgdFF... If anyone wants to take those usernames and write their own script to divine some knowledge from the API, feel free
- lhl 14y agoOne discussion I didn't see in the earlier NYT hack discussion (http://news.ycombinator.com/item?id=5143046 http://news.ycombinator.com/item?id=5143046) was what current best practices/readily available tools are for containing/detecting attacks, from the perspective of running a corp network/startup service, and as an end-user when faced w/ APT-level attacks? For those deep in the trenches, is there a good resource for getting started for those technically inclined/interested in learning more? Presumably there are basic things like proper firewalls and MFA, but also more advanced things like pattern/anomaly detecting IDS's or traffic monitoring tools? On the user side, are there smarter ways for detecting when your system is RAT infested (seems like a IDS running on your laptop should be able to notify you if you're system is sending out a new VNC/IRC connection...) Back when I was more into system/network security, the open source tools (Tripwire, AIDE, Snort) were all ... rather manual/labor intensive. Have things evolved as the sheer amount of attacks/attack vectors have increased?
- JuDue 14y agoThere is a hack/virus where your account gets hijacked and messages are sent to your contacts with wording like "I found this pic of you" or "and embarrassing photo of you!"... and anyone who clicks is themselves hacked. Thing is... this spammy virus has been around for a WHOLE YEAR It's AMAZING Twitter hasn't analysed those messages by now and worked out a way to detect them Especially because the account spams rapidly until you reach your message limit..... WTF Twitter?!
- joelthelion 14y agoTime to advocate for a truly decentralized version of Twitter :)
- ajanuary 14y agoNot that I'm against a decentralised Twitter, but wouldn't that increase the attack vector?
- joelthelion 14y agoIf you have many different implementations running on thousands of different servers, it makes taking down the whole thing much more difficult.
- tlrobinson 14y agoNo reset requests for me on the following account numbers: 142060xx 871300xx 926735xx 1059356xx 1123682xx 1889149xx 2307901xx 8364203xx 9024384xx I had no idea I had so many accounts until I searched my email.
- tlrobinson 14y agoI’m collecting Twitter IDs that were hacked to determine if there is a pattern, please contribute: https://docs.google.com/forms/d/1vCRluBxNGlMs9WFh1bFtOfLYqrD8P-i9vMMESeQlIgo/viewform https://docs.google.com/forms/d/1vCRluBxNGlMs9WFh1bFtOfLYqrD... Here's the results: https://docs.google.com/spreadsheet/oimg?key=0AmwLhnBvBBD7dFhCMHhPYkNWNkI4QnVoTy1iYzZacHc&oid=3&zx=2a05mise2vuf https://docs.google.com/spreadsheet/oimg?key=0AmwLhnBvBBD7dF...
- pauldavis 14y agoI have a mid-four-digit user name and I have received three emails in the last 24 hours from Twitter telling me that my password has been reset. Disturbing.
- jaequery 14y agowonder if it's that notorious ruby/YAML hack
- tubbo 14y agoHi Twitter, tubbo believes that you haven't updated Rails recently. You'll need to create a new website for your company. The Tubbo Team
- ForFreedom 14y agoMy account also got hacked, got an email from Twitter.
- ehtisham 14y agoThey should've been salted and hashed !
- radq 14y agoThe passwords were, apparently. “However, our investigation has thus far indicated that the attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.”
- xkiwi 14y agoRuby on Rails, Java, ?=> Twitter.
- baconhigh 14y agoI notice the tweetdeck web (and therefore client) ssl cert has just been revoked... https://pbs.twimg.com/media/BCJ8yC_CcAAHZlJ.png:large https://pbs.twimg.com/media/BCJ8yC_CcAAHZlJ.png:large