Twitter Hacked, 250,000 Email and Password Compromised

If you find that your Twitter password doesn't work the next time you try to login, you won't be alone. The service was busy resetting passwords and revoking cookies on Friday, following an online attack that may have leaked the account data of approximately 250,000 users.

"This week, we detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data," Bob Lord, Twitter's director of information security, writes in a blog post.

According to Lord, Twitter was able to shut down the attack within moments of discovering it, but not before the attackers were able to make off with what he calls "limited user information," including usernames, email addresses, session tokens, and the encrypted and salted versions of passwords.

The encryption on such passwords is generally difficult to crack – but it's not impossible, particularly if the attacker is familiar with the algorithm used to encrypt them.

As a precaution, Lord says Twitter has reset the passwords of all 250,000 affected accounts – which, he observes, is just "a small percentage" of the more than 140 million Twitter users worldwide.

If yours is one of the accounts involved, you'll need to enter a new password the next time you login. Lord reminds all Twitter users to choose strong passwords – he recommends 10 or more characters, with a mix of letters, numbers, and symbols – because simpler passwords are easier to guess using brute-force methods. In addition, he recommends against using the same password on multiple sites.

Lord says Twitter's investigation is ongoing, and that it's taking the matter extremely seriously, particularly in light of recent attacks experienced by The New York Times and The Wall Street Journal:

This attack was not the work of amateurs, and we do not believe it was an isolated incident. The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked. For that reason we felt that it was important to publicize this attack while we still gather information, and we are helping government and federal law enforcement in their effort to find and prosecute these attackers to make the Internet safer for all users.

Although the attack took place this week, it seems to have no relationship to the outage that took Twitter offline for several hours on Thursday. On the other hand, however, Lord's post does make rather cryptic mention of the US Department of Homeland Security's recent recommendation that users disable the Java plug-in in their browsers. He mentions Java twice, in fact.

While it's true that the Java plug-in contains multiple known vulnerabilities and that numerous security experts have warned that it should be considered unsafe, the connection between Java and the attack Twitter experienced isn't clear and twitter is yet to respond to our request for clarification.

How to check if Spammers are on your Twitter Account

With so many risks to your accounts and computer on the Web, wouldn't it be nice to know that none of the people you follow on Twitter are adding to those risks? Safego, a Bitdefender product, offers a free service that will scan your Twitter account for suspicious users, links, and messages. It won't take any action without your consent, but it can be set to alert you when a new issue arises. Here's how to get started:

Step 1: Head over to http://safego.bitdefender.com/twitter/

Step 2: Log in with your Twitter account. This means the Web site will not need you to sign up for a new account (hooray!).

Step 3: Authorize Safego when prompted by Twitter.

Step 4: Wait as Safego redirects you back to its site and starts scanning your Twitter friends for any suspicious behavior. The more people you follow; the longer this process will take.

Step 5: Once scanning is complete, check out the Friends link on the top banner (next to the Scan Now button). This will change to reflect how many, if any, of your friends are showing suspicious activity.

Step 6: Click on this Friends link to get a list of flagged friends.

Step 7: From the list that appears, you can choose to "unfollow" or clear your flagged friends.

In the notifications area (link at top, or right-hand side on dashboard) you'll see the alerts that are currently disabled. If you'd like to enable any of these to help protect your Twitter account, click on Settings at the top and choose the alerts that work best for you. Additionally, you can use Safego to scan a Twitter user for suspicious activities before you follow them from the Home dashboard.

USA Today hacked by Script Kiddies on Twitter

A group of hackers who target the Twitter feeds of news organisations claimed a fresh victim on Sunday when they hijacked the micro-blogging feed of USA Today.

The group, who use the self-disparaging moniker Script Kiddies, hijacked the @USAToday Twitter feed to encourage fans to contact them to suggest new targets. "Please like The Script Kiddies on Facebook! You could choose our next target!" one of the unauthorised (since purged) updates said.

USA Today quickly regained control of the compromised feed. "@usatoday was hacked and as a result false tweets were sent. We worked with Twitter to correct it. The account is now back in our control," it said. "We apologize for any inconvenience or confusion caused to our readers and thank you for reading @usatoday."

Script Kiddies previously hit the micro-blogging feeds of Fox News – where they posted a false bulletin on the fictitious assassination of US President Barack Obama – and NBC News, where they posted false news about an imaginary terrorist attack on New York.

It's unclear how the feeds were compromised but weak password security of one type or another is one obvious suspect. A combination of social engineering and malware is also possible and seems to be the most likely scenario, at least as far as the NBC hack is concerned.

More commentary on the hack – including screenshots of the unauthorised posts – can be found in a blog post by net security firm Sophos here.

Twitter Account of NBC News Hacked

A group of hackers compromised the NBC News Twitter account yesterday and used it to tweet fake news about a terrorist attack on Ground Zero recalling of the attacks of September 11, 2011.

"Breaking News! Ground Zero has just been attacked. Flight 5736 has crashed into the site, suspected hijacking. More as the story develops," was the first tweet this afternoon. It was followed by two others, including one that started "This is not a joke."

The group also replaced the NBC logo to a comic and modified the 'about' section of the account as well.

NBCNews's Digital Officer Vivian Schiller tweeted confirming that their official account had been hacked, and asked followers not to retweet any of the offending messages:

A group calling themselves the Script Kiddies have claimed responsibility for the hack. The same group previously broke into the Fox News Politics Twitter account to post a bogus announcement about the death of Barack Obama.

A search for the NBC News Twitter profile shortly thereafter displayed the message "This user does not exist."

It's unclear who the Script Kiddies are. The profile for the Script Kiddies--a term used to describe novice hackers--also appeared to have been removed from Twitter.

Graham Cluley of security firm Sophos predicted that account hijinks of this sort would continue to happen until Twitter offered extra security measures for popular profiles.

"Twitter should be applauded for taking such quick action (in suspending the accounts), but isn't it time that there was better security available to accounts which have a large number of followers, or who (like media organizations) may cause public panics if someone breaks in and starts tweeting false news stories about terrorist attacks?" he wrote in a blog post. "I, for one, would like to see Twitter and other social media sites offer an additional level of authentication for those who want to better defend their accounts. I fear that, unless that happens, we will continue to see high-profile accounts hacked and brands damaged as hackers run rings around them."

Anonymous Releases Twitter Hijack Tool Called URGE

The long promised tool that can be used to hijack tweets was recently released on the Anonymous hacker group's official blog, complete with download links, source files and how-to instructions.

The Anonymous group of online activists released a new tool yesterday designed to allow people to hijack trending topics on Twitter and tweet messages within them.

Dubbed URGE (for Universal Rapid Gamma Emitter), the beta software is available for download for Windows computers and requires .Net Framework 4 to work.

"This is not a hacking tool nor is it an exploit tool," the group said in a statement. "It was created to make it easier for us to tweet faster without copying and pasting constantly."

Anonymous members say they are annoyed with all the redundant and "pop culture" topics featured on Twitter Trends and want to draw more attention to topics that "actually serve a cause."

"We have taken note of why Twitter would not do so, they only trend topics which would 'appeal' to people and can get people to tweet more," the statement says. "This was pathetic in our eyes, and we could not stand by and take it anymore."

URGE will allow people to spread the message of Anonymous--including "bashing corrupt politicians," among other causes--by riding the coattails of trending topics. "This will help raise awareness of problems going on in this world and show people that real problems exist outside of 'Jersey Shore' and 'Sex,'" according to the statement.