Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter Hack Details Revealed

Posted by CmdrTaco on from the my-password-is-p4ssw0rd dept.

Jack Spine writes "Twitter co-founder Biz Stone has confirmed both to ZDNet UK and Wired's Threat Level blog that a dictionary attack was used to hack Twitter. After the hacker distributed details on the Digital Gangster forum, celebrities such as Britney Spears and Barack Obama had their accounts defaced. Wired spoke to the alleged hacker, while ZDNet UK got in contact with someone who had been on the Digital Gangster forum at the time."

46 of 222 comments (clear)

  1. Lack of Hacker Ethics by alain94040 · · Score: 5, Insightful

    Cracking the site was easy, because Twitter allowed an unlimited number of rapid-fire log-in attempts.

    Twitter is doubly at fault here. First, it's not that hard to detect rapid-fire password attacks. Even Unix (way before Linux) knew to kick you out after 3 failed attempts. Second, they should enforce better passwords for their employees (not necessarily for regular users, that's another discussion).

    He decided not to use other hacked accounts personally. Instead he posted a message to Digital Gangster offering access to any Twitter account by request.

    That's where the 18-year old kid is at fault. He showed a lack of hacker ethics. Good hackers may discover an exploit, but they don't do harm.

    When I hacked my university's computer network (Vax machines on Bitnet back in 1990), I did it with the knowledge of the sysadmin staff. And once you have made your point, you stand back.

    --
    FairSoftware.net -- geeks starting fair and open software businesses together

    1. Re:Lack of Hacker Ethics by Anonymous Coward · · Score: 5, Funny

      That's where the 18-year old kid is at fault. He showed a lack of hacker ethics. Good hackers may discover an exploit, but they don't do harm.

      Maybe so, but really nice hackers patch the exploit with fairy dust and unicorn farts.

    2. Re:Lack of Hacker Ethics by Jonah+Bomber · · Score: 5, Funny

      Aw, what's the use of going through all that trouble if you can't have Bill O'Reilly announce he's gay?

    3. Re:Lack of Hacker Ethics by TheCycoONE · · Score: 5, Insightful

      That's where the 18-year old kid is at fault. He showed a lack of hacker ethics. Good hackers may discover an exploit, but they don't do harm.

      Perhaps, but it's likely because this kid did a little harm that he's captured the attention of so many people. It adds a healthy dose of sensationalism to the story which convinces people to treat security seriously better than some hypothetical 'it could have been really bad if..' would"

    4. Re:Lack of Hacker Ethics by silentquasar · · Score: 5, Insightful

      That's where the 18-year old kid is at fault. He showed a lack of hacker ethics. Good hackers may discover an exploit, but they don't do harm.

      When I hacked my university's computer network (Vax machines on Bitnet back in 1990), I did it with the knowledge of the sysadmin staff. And once you have made your point, you stand back.

      Indeed. At my college a while back, some seniors found a way to hack into the school's network. They posted every user's password on a local network site. Only a handful of weeks away from graduation, they were expelled. Sure, they meant no harm, just to expose the weaknesses in the system, but they broke the rules and seriously compromised the system by posting the passwords, so they had to pay the price. Yikes!

    5. Re:Lack of Hacker Ethics by bughunter · · Score: 5, Insightful

      Um... what kind of harm can you cause by hacking Twitter? It's the internet equivalent of writing on a bathroom wall.

      (Yes, I'm aware of the recursive metaphor I'm creating here.)

      --
      I can see the fnords!
    6. Re:Lack of Hacker Ethics by girlintraining · · Score: 4, Insightful

      As much as I don't want to say it, ethics don't mean crap these days. If you hack into a system and leave a note saying "Hey, hacked your box, here's how I did it, here's how to fix it, Thanks. Signed, Good Samaritan"... It only means they will send an army of lawyers and g-men after you because you embarassed them, and because while techies like us might understand what the hacker wanted to accomplish, management will not. Frankly, given that there is no protection for people who adhere to the hacker ethos as opposed to those who don't, there is no incentive do be nice. If you get the chance, gut the bastards and don't leave anything behind except a zero'd drive and a message on the screen saying "Next time, don't use a 'password' as the root login." Is it damaging? Yes. But if you don't crap the server, all you're doing is beating the hornet's nest with a stick.

      It's sad that nobody has thought to pass a law to protect digital good samaritans -- that is, people who discover and report (in good faith) security issues either to the people running the servers directly, or the vendor(s) of the software/hardware that is vulnerable -- provided they do nothing else but confirm the exploit is present and notify the appropriate parties. And, of course, do not retain copies of any sensitive information once the report is made.

      Is it any different than finding an unlocked car in the parking lot and opening the door, pushing the door lock, closing the door, and continuing on your merry way? A pity the legal system does not see it this way... Which leaves only the recourse of scorched earth to make the point.

      --
      #fuckbeta #iamslashdot #dicemustdie
    7. Re:Lack of Hacker Ethics by RemoWilliams84 · · Score: 5, Funny

      Is it any different than finding an unlocked car in the parking lot and opening the door, pushing the door lock, closing the door, and continuing on your merry way?

      I like to do this when I find a car sitting outside a gas station still running.

      --
      "I don't have to think. I only have to do it. The results are always perfect, but that's old news." - Meat Puppets
    8. Re:Lack of Hacker Ethics by sexconker · · Score: 2, Interesting

      Anyone trusting blogs, twitter, etc. for news is a moron. Any newspaper, news network, etc. doing the same is run by morons, and should go back to journalism school.

    9. Re:Lack of Hacker Ethics by not+new+here · · Score: 3, Funny

      Liar, I'm not new here!

    10. Re:Lack of Hacker Ethics by severoon · · Score: 2, Insightful

      I think if you run a system that a good number of people depend upon, and a breach in security could cause important problems, then you have a serious obligation to institute a good security policy. If you don't, it's negligence and should be treated as such.

      Are unethical hackers responsible for their actions? Sure, just as responsible as a business that takes on the trust of its users willingly.

      --
      but have you considered the following argument: shut up.
    11. Re:Lack of Hacker Ethics by MyHair · · Score: 2, Funny

      Liar, I'm not new here!

      Oh no, not again...

    12. Re:Lack of Hacker Ethics by INTERNET+EXPERT · · Score: 2, Funny

      I won't even shit the guy's lights off

      The guy's already drained his car battery. He doesn't need your vulgarities.

    13. Re:Lack of Hacker Ethics by dwarg · · Score: 5, Funny

      Yeah, Hacker Ethics, that's it.

      That reminds me of the time I thought I heard a noise at night and I walked into my kids room and there was this guy standing there looking at my 8 month old daughter sleeping. Scared the shit out of me. I was about to either kick his ass, or shit myself when he told me to calm down. He was an Ethical Burglar(TM).

      He had used some pretty basic lock picking methods to break in and just wanted me to know my family was at risk and that we should cage ourselves in our own home so that the marauding Visigoths couldn't break in and kill us all.

      I thanked him for his generous service and he said it was no problem. On his way out he looked at my house one more time and mentioned that he might come back another time and set the place on fire, so we should probably get a coating of asbestos or something to be ready for that.

      I only wish we had more of these ethical hackers and burglers to keep up safe.

    14. Re:Lack of Hacker Ethics by Anonymous Coward · · Score: 5, Funny

      To show I have a sense of humor, I modded the parent Troll.

    15. Re:Lack of Hacker Ethics by dwarg · · Score: 2, Funny

      First of all, it was the (grand)parent comment that coined the term "Hacker Ethics."

      Secondly, the problem with your argument is in actual usage. People that engage in cracking call themselves hackers because calling yourself a cracker implies you married your sister and spend most of your time playing banjo on the porch.

    16. Re:Lack of Hacker Ethics by dwarg · · Score: 3, Insightful

      That was terribly funny, but also terribly stupid.

      I must say you're awfully good looking, but you smell horrible.

      The analogy simply doesn't hold. You know quite well how secure your home is.

      I can see you've put a lot of thought into this... I'll type slowly for you.

      People who like to defend the romantic image of the hacker usually make two mistakes.

      One; they assume the crux of the argument is security when it's actually law.

      Two; they assume intent should be accounted for after the fact.

      The legality of the activity is determined by the possible intent of the actor. When an unauthorized person attempts to bypass a security measure the law is forced to assume they are doing so with malicious intent because they are subverting the means put in place to prevent just that action.

      Breaking into a house is identical to breaking into a computer system in that respect.

      If a crime could only be charged AFTER a person has circumvented security, so they could be sure of intent, what kind of outcomes would that invite before a charge could be filed?

      Seriously, read that last sentence again and think about it.

      On the other hand, if there are security issues with IT infrastructure, you probably don't know about them.

      Considering this is Slashdot, I would certainly hope most of us would have a better idea of the security of our computer systems/networks than the security of our parent's basement.

      It's not very useful for you if somebody tells you that your door locks suck; having crappy locks may even be a conscious decision on your part.

      Really? This is what you're going with? Tell me, why exactly would I want crappy locks on my doors? If you're referring to the fact that I don't choose to wrap the house in razor wire and dig a moat, then yes I have taken a laissez-faire approach to domestic security. The reason none of us need to go that far is because breaking into a house in unconditionally illegal and there are LEGAL mechanisms in place to protect me and provide recourse if that should happen. That is the primary deterrent that keeps people from walking around and "checking" their neighbor's locks to make sure they're secure.

      It is, however, very useful for you if somebody points out security issues with your computer systems. Having security holes in your system is never (well, rarely) a conscious decision.

      Yes it is useful, and there are means to do that which don't involve breaking into someone else's systems and compromising potentially sensitive information--even if only to one person. The difference is that between a hacker and a security consultant.

      If a bank's systems are hacked by anyone outside the organization, regardless of what they do with the information, they are required to inform their customers that their data has been compromised. People close accounts, money is lost and there are repercussions that go beyond the romantic image of the lone hacker who's sticking it to the man, but will never know the soft touch of a woman.

      If a "nice" hacker had alerted twitter to this issue, the current situation would never have occurred.

      Fine, let's assume we live in a world that values the noble efforts of hackers and someone hacked Twitter and alerted them to this problem before an evil cracker used this exploit for his nefarious designs. So we've created an atmosphere where everyone feels secure walking around "checking the locks" as I said earlier.

      Are you going to feel more secure knowing there are a lot of people trying to find ways into your system and that some of them are aren't the good kind of hackers and you have no way of knowing what kind of hacker they are until AFTER they've gotten into your system?

      As an admin, if you see suspicious activity on your server logs do you want that activity stopped or should yo

  2. Re:After all of this... by NewbieV · · Score: 3, Interesting

    Blackberries are safer than Twitter accounts. If you enter the wrong password into a Blackberry a set number of times (usually 10), it erases its contents.

    --


    "For every right, an equal responsibility..."
  3. Limit logins without DOS? by Manip · · Score: 4, Interesting

    This is one of my favourite security conundrums.

    How do you limit someone's login attempts to an account without allowing an account to be denial of serviced?

    Captcha - hurts young, old, and disabled users. It can also make it hard for normal users if poorly designed (as many are).

    IP Limit - Very easy to bypass with a proxy list.

    Hard Account Limits - Denial of service

    Thus is the problem. How do you limit logins without hurting legitimate users?

    1. Re:Limit logins without DOS? by larry+bagina · · Score: 5, Insightful

      Slow down cowboy! It's been 1 minute since your last failed attempt to login.

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    2. Re:Limit logins without DOS? by jeffmeden · · Score: 3, Insightful

      Easy, increase the amount of time between the password being supplied and the pass/fail response being sent. If the script has to wait for 5 seconds to see if the password is bad, it increases the dictionary run time by a LOT. The only way around this is to run multiple iterations of the script, each with a section of the list to run. This makes them much easier to spot by other filters.

      However, a legit user waiting 5 seconds for the login to complete probably won't generate a lot of complaints.

    3. Re:Limit logins without DOS? by paulhar · · Score: 3, Interesting

      One way would be to get progressively slower at *processing* a login for a particular user based on the number of failed attempts. I.e. user enters a password, the timer ticks away, and then at the end it really does the test and checks if the password was right.

      You would typically double the time delay with a reasonable limit of say 1 minute so that each failed attempt sticks at 1 minute delay.

      You put up a banner after the delay reaches 10 secs or so saying "Your login will be slower as you have had X failed attempts recently".

      Then elsewhere you limit the number of failed logins from a single IP address to different accounts via a similar method to slow them down trying 100,000,000 accounts with password X.

      Oh, and you internally you check that passwords aren't common dictionary attack words to prevent users from running with knives when they create / modify their account...

    4. Re:Limit logins without DOS? by causality · · Score: 3, Insightful

      This is one of my favourite security conundrums.

      How do you limit someone's login attempts to an account without allowing an account to be denial of serviced?

      Captcha - hurts young, old, and disabled users. It can also make it hard for normal users if poorly designed (as many are).

      IP Limit - Very easy to bypass with a proxy list.

      Hard Account Limits - Denial of service

      Thus is the problem. How do you limit logins without hurting legitimate users?

      One approach is to still allow the login but to insert artificial delays. Maybe your password cracker can guess several thousand passwords in one second; too bad, because the site will only allow you to try one every three seconds. Even a fairly weak password can be extremely difficult to guess this way, though it is no substitute for strong passwords that are never sent as cleartext.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    5. Re:Limit logins without DOS? by Phrogman · · Score: 4, Interesting

      Perhaps even add +x seconds after every attempt, so your first attempt goes through and fails the next one has a delay of 5s and thereafter its incremented. Most users will get their password correct on the second try or perhaps the third, the script will die a slow death.

      --
      "The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
  4. why is this news? by iron+spartan · · Score: 2, Insightful

    Why should we care about this? Its not like someones SSN or Credit Card info was stolen. Stuff like this happens all the time.

    If you want to defame someone, its a lot easier to just make some wild and unprovable claim on the right webs sites and let the internet do its thing.

  5. Re:iam3prez by Anonymous Coward · · Score: 2, Informative

    It wasn't Obama's account that got attacked. They attacked the account of a Twitter administrator, and then got access to the web-based control panel to reset Obama's password. Pretty lame that a) the admin had such a bad password and b) you can access the control panel from the public internet with the same login as your twitter account.

  6. Comment removed by account_deleted · · Score: 5, Insightful

    Comment removed based on user account deletion

  7. Comment removed by account_deleted · · Score: 4, Informative

    Comment removed based on user account deletion

  8. Re:iam3prez by Mr.+Sketch · · Score: 3, Informative

    Looks like you didn't actually read the article. The account of a twitter admin was hacked with a dictionary attack. That account was then used to reset the passwords for various other accounts (Fox News, Obama, Britney Spears, etc) to gain access to those accounts. The original passwords for those additional accounts were not obtained. Only one account (the twitter admin) was hacked, the rest just had their passwords reset.

    --
    Things you think are in the Constitution, but are not.
  9. Comment removed by account_deleted · · Score: 4, Insightful

    Comment removed based on user account deletion

  10. Re:Compromise One Password, Compromise Them All by SighKoPath · · Score: 5, Informative
    FTA:

    GMZ doesn't know what the reset passwords were, because Twitter resets them randomly with a 12-character string of numbers and letters.

    No passwords were compromised except for the admin account he used the dictionary attack on. So really, the GP's analysis of harm done is pretty accurate.

  11. Comment removed by account_deleted · · Score: 4, Interesting

    Comment removed based on user account deletion

  12. Obama, a celebrity? by IronChef · · Score: 4, Funny

    Somehow it is disturbing that the President-Elect is lumped in with Britney as a celebrity.

    What is the level of discourse on Mr. Obama's twitter thing, anyway? I could look, I suppose, but it is more fun to imagine.

    ---

    im in ur white house

    secret service bitches following me everywhere. about 3 minutes ago from web

    these pancakes are righteous! about 2 hours ago from airforce1r

    are ufoz real? I am going to find out! about 4 hours ago from web

    I think Hillary just cut the cheese LOLz about 8 hours ago from twitterrific

  13. Comment removed by account_deleted · · Score: 2, Interesting

    Comment removed based on user account deletion

  14. Re:Compromise One Password, Compromise Them All by Anonymous Coward · · Score: 2, Informative

    Many credit card companies offer a one-time-use credit card number you can use for online purchases. I find it invaluable for online shopping.

  15. Re:After all of this... by Joe+Snipe · · Score: 2, Funny

    That sounds more dangerous; because now my buddy is going to have a blank phone when we go out drinking tonight.

    --
    Sometimes, life itself is sarcasm...
  16. Re:Compromise One Password, Compromise Them All by mcgrew · · Score: 2, Interesting

    You don't (probably) use the same key for your house and your care and your safety deposit box

    No, but I wish I could. They're all on the same key ring, after all. If I lost my keys and whoever found them knew whose keys they were, I'd have to change all the locks anyway.

    Another "bad security practice" I do is to keep my passwords written down. That's a no-no in the security field, but it's a stupid no-no. I keep them in my wallet, along with my security code for the building I work in, my money, debit card, and other valuables. Unlike money and cards, the passwords are easily disguised as building addresses (1234 Spring Street) or phone numbers (525-1234). Yeah, posting it on a post-it on the monitor is stupid, but keeping it written down with other valuables allows you a tougher to crack password, one a dictionary attack like the one used at Twitter is impossible. E.g., d5#6*;mtTMbp can't be remembered by anyone but a savant, but if it's written down it can't be forgotten.

    You could also use the title of a book, write that down, and use every n character in the password. For example, Shrew 9 would be SBlatsle which is every ninth character (exclusing spaces) from the introduction to Wm Shakespeare's Taming Of The Shrew.

    --
    Free Martian Whores!
  17. Re:Compromise One Password, Compromise Them All by everett · · Score: 2, Informative

    Please RTFA before you post. Thank you. The accounts in question had their password reset to a random 12 character string that was then used to post fake tweets. Your comment is irrelevant.

    --
    Sig withheld to protect the innocent.
  18. Re:After all of this... by mcgrew · · Score: 2, Informative

    That's not why they want him to give it up. Federal alw says that all Presidential emails must be kept and can be used as evidence of wrongdoing. If he keeps his blackberry he's a fool.

    --
    Free Martian Whores!
  19. Re:Compromise One Password, Compromise Them All by FredFredrickson · · Score: 2, Informative

    Paypal has secure cards too now for free, just install the paypal plugin. I use single use mastercard numbers for all my online purchasing. Especially nice for porn sites, so you don't have to worry about random charges.

    --
    Belief? Hope? Preference?The Existential Vortex
  20. Re:So why do you hate gay people? by Anonymous Coward · · Score: 2, Funny

    Don't forget lame people! Your seething hatred of lame people comes out in treating "pretty lame" as an insult. How many more frightened people still at home in a wheelchair will be afraid to come out when it's demonstrated so clearly that being "lame" is uncool.

  21. Assumptions by bill_mcgonigle · · Score: 2, Insightful

    Is it any different than finding an unlocked car in the parking lot and opening the door, pushing the door lock, closing the door, and continuing on your merry way?

    That's a great analogy. How do you know the owner hasn't left his keys under the seat? Security through obscurity is the best strategy for low-value assets.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  22. Re:Compromise One Password, Compromise Them All by MegaFur · · Score: 2, Insightful

    Yes, in general, if you compromise one password, you might be compromising them all. In this specific case however, the "hacker" in question never got the passwords himself. He got the password-reset tool to help out a user who has forgotten their password. So that's one happy out of the whole thing--there was a good security practice there that actual passwords are a little harder to get at than that.

    --
    Furry cows moo and decompress.
  23. Re:Compromise One Password, Compromise Them All by JWSmythe · · Score: 2, Insightful

        Locks are for honest people.

        If I wanted your motorcycle, I'd bring a couple friends, and throw it in the back of a pickup truck, to be rekeyed later.

        If I wanted into your house, I'd kick in the door, or go through a window.

        If I wanted into your shed, I'd put a pry bar through the padlock and twist.

        It's a good thing I don't want these things. :)

        Really, I've helped people get around things they've locked accidentally.

        One was a door with a "security" lock (one extra pin). They closed it, and couldn't reopen it, because no one had the key. That took me 5 minutes with a lockpick set.

        Once the CEO of a company I worked for needed a document on his desk. He was very insistent he needed it immediately. We told him the door was locked, and he had the only key. We then asked for permission to get in by alternative means. His only response was "don't break anything" I had one of the guys stand on a chair and lift a drop ceiling panel out, so he could climb over the wall. It took about 45 seconds.

        We had a a life or death emergency at my house, and someone was in the locked room. The fastest method was required to open the door. A swift kick just beside the doorknob, and the door opened, without me missing a step running into the room.

        I don't know how many times when I was a kid, someone would get home before their parents, and couldn't get into their own house because they forgot their keys. I'd usually be in, in less than 5 minutes. There's always a window or door that isn't locked, or doesn't latch well.

        The same applies here. You have 100 employees with access to do something (like in this case play with twitter accounts). If every one of them isn't secured well (good passwords, good password protection policies, good security measures) it doesn't matter how great one is, someone will walk in through the easier method.

        I was moving some servers, and no one knew the password to one of them. I couldn't log in to set the new IP. I asked politely, and then rebooted into single user to change it. I didn't need the password, I had physical access.

       

    --
    Serious? Seriousness is well above my pay grade.
  24. Re:Compromise One Password, Compromise Them All by Chrono11901 · · Score: 3, Insightful

    wait wait wait... you're on slashdot... news for nerds... and you pay for porn?!

    Please hand over your geek card on the way out.

  25. Re:After all of this... by Fulcrum+of+Evil · · Score: 2, Funny

    There has to be someway for a server to archive it all while allowing him access via a blackberry. Even if he has to lean on RIM for a custom server.

    A corporate email service archiving mail? Whodathunkit?

    --
    "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"