5 ms·

The Anatomy Of The Twitter Attack

50 points by malte 17y ago

unohoo 17y ago
the post would have been a more interesting read if it didnt have so much rambling
wallflower 17y ago
> Taken individually, most of these services have reasonable security precautions against intrusion. But there are huge weaknesses when they are looked at together, as an ecosystem. Like dominoes, once one fell (Gmail was the first to go), the others all tumbled as well. Like many others, I gradually gave up my internal resistance on Google knowing most everything about me and have adopted Gmail as my primary mailbox. 1) Enable SSL by default on Gmail https://mail.google.com/mail/#settings https://mail.google.com/mail/#settings Scroll down to bottom and choose 'Always use HTTPS' for 'Browser Connection'. Click 'Save settings' 2) Change your Gmail security question (you may want to do this now because you may have forgotten the answer to your own question that you set way back when you registered) http://mail.google.com/support/bin/answer.py?hl=en&answer=29414 http://mail.google.com/support/bin/answer.py?hl=en&answe... 3) If you can't answer your Gmail security question, it will send a password reset email to your secondary email address. Consider the risks of having the secondary email address compromised (and decide whether to remove it or change it to one with a secure 'secret question' process - e.g. if you work for a company, your work email) http://mail.google.com/support/bin/answer.py?hl=en&answer=6566 http://mail.google.com/support/bin/answer.py?hl=en&answe...
- sounddust 17y ago
  In addition to what you listed, I think the article's point about one's password being findable in their mailfile is a great catch. In order to be aware that someone has compromised your mail, it's essential that they not be able to reset your password to its old value. Therefore, your password for e-mail should never be findable in your mailfile, nor should it be the same password you use for any other web service. Because you never know what stupid web service will send your password to you in cleartext upon request. Of course, it's not a good idea to share passwords among different services in general, but keeping your mail password separate is particularly important.
  - bbgm 17y ago
    Mail and commerce. Those require separate and unique and crazily difficult to guess passwords. The problem is too many people just can't bother with the perceived hassle
- rythie 17y ago
  It's a pity that google docs doesn't have that SSL option
  - jonknee 17y ago
    It does for me, the link to Google Docs from my Gmail is HTTPS. Same for Calendar and Sites. Going directly to docs.google.com redirects me to the secure version--I think it works off the SSL by default setting in Gmail.
  - wallflower 17y ago
    Google will have to eventually respond (with action) to that and more security concerns outlined in this June 2009 open letter to the Google CEO demanding 'security by default' from 38 leading security researchers including Bruce Schneier and Ron Rivest. http://files.cloudprivacy.net/google-letter-final.pdf http://files.cloudprivacy.net/google-letter-final.pdf
    - talison 17y ago
      They did respond. Kind of. http://googleonlinesecurity.blogspot.com/2009/06/https-security-for-web-applications.html http://googleonlinesecurity.blogspot.com/2009/06/https-secur...
      - sriramk 17y ago
        but the original attack wouldn't have changed one bit with SSL. Peter Guttman wrote a great paper on how we defend where the attackers aren't attacking. SSL in this case would have been one such example. Of course, SSL has value in other cases (sniffing, ensuring you're talking to the right site, etc) but is no panacea.
- ErrantX 17y ago
  I deliberately set up a secondary email address that I use for nothing else and has a unique but memorable password. Then I just mashed the keys for the security question.
tdm911 17y ago
The most important lesson here is that no amount of security on a website/server/physical piece of hardware will stand up to the test if the user is lax in their usage. Social engineering is the new wave of security breaches and it would seem that strict password policies etc are just as important as an intrusion proof system/network.
guicifuentes 17y ago
After reading the TSID (Twitter's Secret Internal Documents) which basically tells Twitter plans to "dominate the world" with their Service, is that TC does not deserve any credibility publishing an advertorial making it looks like a revelation from the "underground" hackers; that's cheating.
hymanroth 17y ago
The million dollar question: would we have been so interested in how the attack was made if we hadn't had at least a glimpse of the compromised information? In other words, could TC argue that publishing the confidential information was a valid way of raising awareness of the security issue? I'm not convinced, but it's a tough one.
- deleted 17y ago
  [deleted]
- cdibona 17y ago
  That's just about the worst excuse I've ever heard for unethical conduct. In my mind, this is the equivalent of "I trashed your house, peed on your couch and stole your wine cellar to show you how important a axe proof front door is."
  - hymanroth 17y ago
    I was talking about TC, not the hacker. Also, I made it clear that whilst I didn't agree, the question is a valid one.
TravisLS 17y ago
Everyone here is probably fairly well aware of how easy it is to compromise accounts on these online services. I hope most HN users recognize that the appropriate course of action after hacking a service like this is to notify the account holder to help them improve their security before revealing the details. If you really aren't doing this for profit, and you really don't want to hurt the victim of the attack, (as Hacker Croll claims) then don't disclose the information you stole to major press outlets. This attack is really in poor taste, and I think we all of us here at HN should recognize the difference between pointing out the dangers of the internet and being one of the dangers ourselves.
- whatusername 17y ago
  "We’ve waited to post exactly what happened until Twitter had time to close all of these security holes." Unless you're saying that techcrunch should have waited until gmail/hotmail update their security policies? I've ignored (or tried to at least) most of the twitter documents hype - but I thought this was an interesting and well written article.
mixmax 17y ago
Very interesting, but I still think Techcrunch is way beyond the ethical line in this whole farce.
- Maxious 17y ago
  I think the only unique thing to come out of this is the supposed clear-text-credit-card-number iTunes exploit. That would be a story worth telling, where exposing information is in the public interest.
byrneseyeview 17y ago
They were really cranking up the word count: Now going back to Hacker Croll and his list of Twitter employees and other information. Twitter just happens to be one of a number of a new breed of companies where almost the entire business exists online. Each of these employees, as part of their work, share data with other employees - be it through a feature of a particular application or simply through email. As these users become interwoven, it adds a whole new attack vector whereby the weak point in the chain is no longer just the weakest application - it is the weakest application used by the weakest user. For an attacker such as Hacker Croll looking to exploit the combination of bad user habit, poorly implemented features and users mixing their personal and business data - his chances of success just got exponentially greater. Companies that are heavily web based rely largely on users being able to manage themselves - the odds are not only stacked against Twitter, they are stacked against most companies adopting this model. Could be summarized as "Twitter used Google docs." Everything else in this paragraph repeats things from earlier. (And things from earlier repeat things from earlier.)
edw519 17y ago
"iTunes has a security hole that shows credit card information in clear text..." Where are their auditors, their bankers, and their trading partners? SOX won't let us fart on Tuesdays but a public company can store credit card information in clear text? Unbelievable.
- bcl 17y ago
  The PCI (Payment Card Industry) compliance folks should be interested to know that as well, assuming it is true.
brown9-2 17y ago
So if a hotmail account expires, they allow just anyone to re-register it as their own email address? That sounds completely irresponsible.
- semiquaver 17y ago
  Yep. I tried to log into an old hotmail account last month and found that it had expired. I had no problem re-registering it. This is an inexcusable security flaw that should be obvious.
  - sriramk 17y ago
    I'm guessing it is because all email providers recyle email ids/usernames after a period of inactivity. I don't know what Hotmail does but if I remember, they have a lockdown period (which is quite long) after which the username becomes available to the general public. I'm pretty sure Yahoo and Gmail do the same thing.
    - blasdel 17y ago
      Gmail accounts use to expire after a year of inactivity, but now will never expire on their own. I'm pretty sure they have never recycled old addresses automatically.
    - semiquaver 17y ago
      http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZXQ9ZW4tVVMmY3U9JnRtdD1Ib3RtYWlsUElNX0ZBUSZmb3JtYXQ9%29/help.aspx?querytype=topic&query=PIM_PROC_CloseAcct.htm http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZ... A free Hotmail account becomes inactive if you do not sign in for 30 days, or within the first 10 days after signing up for an account. Once an account becomes inactive, all messages, folders, and contacts are deleted, but the account name is still reserved. If the account stays inactive for a further 90 days, it is permanently deleted. I'm almost positive that the account I had to recreate was no more than 6-9 months inactive.
      - 17y ago
vaksel 17y ago
I think part of the problem is that we have so many places to keep track of(email/passwords wise). I can pretty much guarantee that there is a way for some of my accounts to get compromised with an email address I haven't used in 4 years. Why? Because at this point I probably have a few thousand accounts, and there is just no way to keep track of all of them, when updating your password/email.
forgottenpasswd 17y ago
Disregarding the human "holes", I think the biggest hole here is Hotmail allowing expired accounts' usernames to be registered again. That should be a no-no considering the importance of the use of email as an identity. They can purge the account as it expires, but they should not let others use the username again. Most others are just "best practices" that try to keep balance between security and usability. Except for the practice of emailing a password in clear text which compromises a lot of security for little usability gain.
bcl 17y ago
This story illustrates something that I enforce with users that I deal with. I don't allow them to choose their own passwords. This is especially important when they have access to a shared resource like Google Docs, a company wiki, subversion repository, etc. where a compromised account could expose sensitive company documents. It is also a good argument not to use those kinds of services and keep them 'in house' where you have better control and auditing of access to them. If you are running a company 'in the cloud' you need to make sure you or your system administrators have control over the user's account and passwords. They can't be trusted to choose decent passwords.
- jorgeortiz85 17y ago
  Oh, that's real smart. So when you assign "Oc3j$ool>93*dl" as some user's password, they're just going jot it down on PostIt notes all over their desk, leave little .txt files on their desktop with it, add it to their cellphone as the "Password" contact, and stash it for "safekeeping" in all their email accounts. Great security you've got there.
  - derefr 17y ago
    Or they could, y'know, put it in their wallet. Like their SSN and their credit card number.
    - sriramk 17y ago
      Password complexity requirements don't really help. Most people just wind up picking password001 or password #001. In fact, we almost ensure that people will write passwords down when we make them remember weird, long strings and make them change it every few months as part of an arbitrary password change policy. I remember reading a paper (can't find the reference now) on how password change policies originated in the 60s and there's no data to support that they actually help with security.
    - jorgeortiz85 17y ago
      It boggles the mind that SSNs and CC#s are supposed to be secret. You, literally, give them out to anyone who asks.
ajaya 17y ago
Techcrunch = TwitterCrunch
gojomo 17y ago
Wow, a 3,900-word magnum opus. The nutshell: (1) Hacker deduced from Google password reset that a Twitter employee had a Hotmail account as their secondary email for a personal Google login. (2) Was able to re-register that dormant Hotmail address (!) -- and thus get the Gmail password reset. (3) Saw a cleartext password confirmation from another web service among the Gmail archives; reverted the Google account password to that, in the hopes it would allow the compromise to evade the user's detection. That worked; the user continued to use their personal Gmail as normal. (4) From there, extended compromise to other of that user's accounts elsewhere, including a separate Google Apps for Twitter account, which used the same password. Used information now visible -- internal Twitter docs, private coworker profiles, etc. -- to crack other employee accounts, likely by also deducing password-reset security-questions. Accounts compromised included Evan Williams and Biz Stone. There's some hand-waving at this last step, but if the early-compromised employees were admin assistants, HR, or sysadmins, and/or if Twitter as a matter-of-course trusted Gmail-to-Gmail internal email as being a safe place to share setup passwords and other private information, it's plausible. This branching-out to multiple accounts included "AT&T for phone logs, Amazon for purchasing history, MobileMe for more personal emails and iTunes for full credit card information" -- as there's said to be a flaw in ITunes that sometimes echoes back full credit card numbers.
jpierce420 17y ago
The main thing to take away from this is that this guy got lucky on many fronts. People slipped up. He didn't root any boxes, he didn't exploit a software vulnerability in any webapps, he just took advantage of human mistakes and got lucky. Without the hotmail thing happening, I seriously doubt he would've gotten anywhere. Its almost a complete fluke, but it can happen in many other places because of how users handle accounts. I also agree, if this guy was trying to 'help', he wouldn't have posted the info to a news outlet like TC that he knew would post it. Wow some 'hacker', he got lucky and guessed a gmail password from recovering an expired hotmail account. I guess the apology is to try and keep Twitter from frying his ass.

50 points by malte 17y ago

the post would have been a more interesting read if it didnt have so much rambling

> Taken individually, most of these services have reasonable security precautions against intrusion. But there are huge weaknesses when they are looked at together, as an ecosystem. Like dominoes, once one fell (Gmail was the first to go), the others all tumbled as well. Like many others, I gradually gave up my internal resistance on Google knowing most everything about me and have adopted Gmail as my primary mailbox. 1) Enable SSL by default on Gmail https://mail.google.com/mail/#settings https://mail.google.com/mail/#settings Scroll down to bottom and choose 'Always use HTTPS' for 'Browser Connection'. Click 'Save settings' 2) Change your Gmail security question (you may want to do this now because you may have forgotten the answer to your own question that you set way back when you registered) http://mail.google.com/support/bin/answer.py?hl=en&answer=29414 http://mail.google.com/support/bin/answer.py?hl=en&answe... 3) If you can't answer your Gmail security question, it will send a password reset email to your secondary email address. Consider the risks of having the secondary email address compromised (and decide whether to remove it or change it to one with a secure 'secret question' process - e.g. if you work for a company, your work email) http://mail.google.com/support/bin/answer.py?hl=en&answer=6566 http://mail.google.com/support/bin/answer.py?hl=en&answe...

sounddust 17y ago
In addition to what you listed, I think the article's point about one's password being findable in their mailfile is a great catch. In order to be aware that someone has compromised your mail, it's essential that they not be able to reset your password to its old value. Therefore, your password for e-mail should never be findable in your mailfile, nor should it be the same password you use for any other web service. Because you never know what stupid web service will send your password to you in cleartext upon request. Of course, it's not a good idea to share passwords among different services in general, but keeping your mail password separate is particularly important.
- bbgm 17y ago
  Mail and commerce. Those require separate and unique and crazily difficult to guess passwords. The problem is too many people just can't bother with the perceived hassle
rythie 17y ago
It's a pity that google docs doesn't have that SSL option
- jonknee 17y ago
  It does for me, the link to Google Docs from my Gmail is HTTPS. Same for Calendar and Sites. Going directly to docs.google.com redirects me to the secure version--I think it works off the SSL by default setting in Gmail.
- wallflower 17y ago
  Google will have to eventually respond (with action) to that and more security concerns outlined in this June 2009 open letter to the Google CEO demanding 'security by default' from 38 leading security researchers including Bruce Schneier and Ron Rivest. http://files.cloudprivacy.net/google-letter-final.pdf http://files.cloudprivacy.net/google-letter-final.pdf
  - talison 17y ago
    They did respond. Kind of. http://googleonlinesecurity.blogspot.com/2009/06/https-security-for-web-applications.html http://googleonlinesecurity.blogspot.com/2009/06/https-secur...
    - sriramk 17y ago
      but the original attack wouldn't have changed one bit with SSL. Peter Guttman wrote a great paper on how we defend where the attackers aren't attacking. SSL in this case would have been one such example. Of course, SSL has value in other cases (sniffing, ensuring you're talking to the right site, etc) but is no panacea.
ErrantX 17y ago
I deliberately set up a secondary email address that I use for nothing else and has a unique but memorable password. Then I just mashed the keys for the security question.

tdm911 17y ago

The most important lesson here is that no amount of security on a website/server/physical piece of hardware will stand up to the test if the user is lax in their usage. Social engineering is the new wave of security breaches and it would seem that strict password policies etc are just as important as an intrusion proof system/network.

guicifuentes 17y ago

After reading the TSID (Twitter's Secret Internal Documents) which basically tells Twitter plans to "dominate the world" with their Service, is that TC does not deserve any credibility publishing an advertorial making it looks like a revelation from the "underground" hackers; that's cheating.

hymanroth 17y ago

The million dollar question: would we have been so interested in how the attack was made if we hadn't had at least a glimpse of the compromised information? In other words, could TC argue that publishing the confidential information was a valid way of raising awareness of the security issue? I'm not convinced, but it's a tough one.

deleted 17y ago
[deleted]
cdibona 17y ago
That's just about the worst excuse I've ever heard for unethical conduct. In my mind, this is the equivalent of "I trashed your house, peed on your couch and stole your wine cellar to show you how important a axe proof front door is."
- hymanroth 17y ago
  I was talking about TC, not the hacker. Also, I made it clear that whilst I didn't agree, the question is a valid one.

TravisLS 17y ago

Everyone here is probably fairly well aware of how easy it is to compromise accounts on these online services. I hope most HN users recognize that the appropriate course of action after hacking a service like this is to notify the account holder to help them improve their security before revealing the details. If you really aren't doing this for profit, and you really don't want to hurt the victim of the attack, (as Hacker Croll claims) then don't disclose the information you stole to major press outlets. This attack is really in poor taste, and I think we all of us here at HN should recognize the difference between pointing out the dangers of the internet and being one of the dangers ourselves.

whatusername 17y ago
"We’ve waited to post exactly what happened until Twitter had time to close all of these security holes." Unless you're saying that techcrunch should have waited until gmail/hotmail update their security policies? I've ignored (or tried to at least) most of the twitter documents hype - but I thought this was an interesting and well written article.

mixmax 17y ago

Very interesting, but I still think Techcrunch is way beyond the ethical line in this whole farce.

Maxious 17y ago
I think the only unique thing to come out of this is the supposed clear-text-credit-card-number iTunes exploit. That would be a story worth telling, where exposing information is in the public interest.

byrneseyeview 17y ago

They were really cranking up the word count: Now going back to Hacker Croll and his list of Twitter employees and other information. Twitter just happens to be one of a number of a new breed of companies where almost the entire business exists online. Each of these employees, as part of their work, share data with other employees - be it through a feature of a particular application or simply through email. As these users become interwoven, it adds a whole new attack vector whereby the weak point in the chain is no longer just the weakest application - it is the weakest application used by the weakest user. For an attacker such as Hacker Croll looking to exploit the combination of bad user habit, poorly implemented features and users mixing their personal and business data - his chances of success just got exponentially greater. Companies that are heavily web based rely largely on users being able to manage themselves - the odds are not only stacked against Twitter, they are stacked against most companies adopting this model. Could be summarized as "Twitter used Google docs." Everything else in this paragraph repeats things from earlier. (And things from earlier repeat things from earlier.)

edw519 17y ago

"iTunes has a security hole that shows credit card information in clear text..." Where are their auditors, their bankers, and their trading partners? SOX won't let us fart on Tuesdays but a public company can store credit card information in clear text? Unbelievable.

bcl 17y ago
The PCI (Payment Card Industry) compliance folks should be interested to know that as well, assuming it is true.

brown9-2 17y ago

So if a hotmail account expires, they allow just anyone to re-register it as their own email address? That sounds completely irresponsible.

semiquaver 17y ago
Yep. I tried to log into an old hotmail account last month and found that it had expired. I had no problem re-registering it. This is an inexcusable security flaw that should be obvious.
- sriramk 17y ago
  I'm guessing it is because all email providers recyle email ids/usernames after a period of inactivity. I don't know what Hotmail does but if I remember, they have a lockdown period (which is quite long) after which the username becomes available to the general public. I'm pretty sure Yahoo and Gmail do the same thing.
  - blasdel 17y ago
    Gmail accounts use to expire after a year of inactivity, but now will never expire on their own. I'm pretty sure they have never recycled old addresses automatically.
  - semiquaver 17y ago
    http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZXQ9ZW4tVVMmY3U9JnRtdD1Ib3RtYWlsUElNX0ZBUSZmb3JtYXQ9%29/help.aspx?querytype=topic&query=PIM_PROC_CloseAcct.htm http://help.msn.com/%28cHJvamVjdD1ob3RtYWlscGltX2ZhcSZtYXJrZ... A free Hotmail account becomes inactive if you do not sign in for 30 days, or within the first 10 days after signing up for an account. Once an account becomes inactive, all messages, folders, and contacts are deleted, but the account name is still reserved. If the account stays inactive for a further 90 days, it is permanently deleted. I'm almost positive that the account I had to recreate was no more than 6-9 months inactive.
    - 17y ago

vaksel 17y ago

I think part of the problem is that we have so many places to keep track of(email/passwords wise). I can pretty much guarantee that there is a way for some of my accounts to get compromised with an email address I haven't used in 4 years. Why? Because at this point I probably have a few thousand accounts, and there is just no way to keep track of all of them, when updating your password/email.

forgottenpasswd 17y ago

Disregarding the human "holes", I think the biggest hole here is Hotmail allowing expired accounts' usernames to be registered again. That should be a no-no considering the importance of the use of email as an identity. They can purge the account as it expires, but they should not let others use the username again. Most others are just "best practices" that try to keep balance between security and usability. Except for the practice of emailing a password in clear text which compromises a lot of security for little usability gain.

bcl 17y ago

This story illustrates something that I enforce with users that I deal with. I don't allow them to choose their own passwords. This is especially important when they have access to a shared resource like Google Docs, a company wiki, subversion repository, etc. where a compromised account could expose sensitive company documents. It is also a good argument not to use those kinds of services and keep them 'in house' where you have better control and auditing of access to them. If you are running a company 'in the cloud' you need to make sure you or your system administrators have control over the user's account and passwords. They can't be trusted to choose decent passwords.

jorgeortiz85 17y ago
Oh, that's real smart. So when you assign "Oc3j$ool>93*dl" as some user's password, they're just going jot it down on PostIt notes all over their desk, leave little .txt files on their desktop with it, add it to their cellphone as the "Password" contact, and stash it for "safekeeping" in all their email accounts. Great security you've got there.
- derefr 17y ago
  Or they could, y'know, put it in their wallet. Like their SSN and their credit card number.
  - sriramk 17y ago
    Password complexity requirements don't really help. Most people just wind up picking password001 or password #001. In fact, we almost ensure that people will write passwords down when we make them remember weird, long strings and make them change it every few months as part of an arbitrary password change policy. I remember reading a paper (can't find the reference now) on how password change policies originated in the 60s and there's no data to support that they actually help with security.
  - jorgeortiz85 17y ago
    It boggles the mind that SSNs and CC#s are supposed to be secret. You, literally, give them out to anyone who asks.

ajaya 17y ago

Techcrunch = TwitterCrunch

gojomo 17y ago

Wow, a 3,900-word magnum opus. The nutshell: (1) Hacker deduced from Google password reset that a Twitter employee had a Hotmail account as their secondary email for a personal Google login. (2) Was able to re-register that dormant Hotmail address (!) -- and thus get the Gmail password reset. (3) Saw a cleartext password confirmation from another web service among the Gmail archives; reverted the Google account password to that, in the hopes it would allow the compromise to evade the user's detection. That worked; the user continued to use their personal Gmail as normal. (4) From there, extended compromise to other of that user's accounts elsewhere, including a separate Google Apps for Twitter account, which used the same password. Used information now visible -- internal Twitter docs, private coworker profiles, etc. -- to crack other employee accounts, likely by also deducing password-reset security-questions. Accounts compromised included Evan Williams and Biz Stone. There's some hand-waving at this last step, but if the early-compromised employees were admin assistants, HR, or sysadmins, and/or if Twitter as a matter-of-course trusted Gmail-to-Gmail internal email as being a safe place to share setup passwords and other private information, it's plausible. This branching-out to multiple accounts included "AT&T for phone logs, Amazon for purchasing history, MobileMe for more personal emails and iTunes for full credit card information" -- as there's said to be a flaw in ITunes that sometimes echoes back full credit card numbers.

jpierce420 17y ago

The main thing to take away from this is that this guy got lucky on many fronts. People slipped up. He didn't root any boxes, he didn't exploit a software vulnerability in any webapps, he just took advantage of human mistakes and got lucky. Without the hotmail thing happening, I seriously doubt he would've gotten anywhere. Its almost a complete fluke, but it can happen in many other places because of how users handle accounts. I also agree, if this guy was trying to 'help', he wouldn't have posted the info to a news outlet like TC that he knew would post it. Wow some 'hacker', he got lucky and guessed a gmail password from recovering an expired hotmail account. I guess the apology is to try and keep Twitter from frying his ass.