Slashdot Mirror
55,000 Twitter Accounts Hacked, Passwords Leaked
MojoKid writes "Tens of thousands of Twitter accounts have been compromised in a recent hack attack in which more than 55,000 passwords were leaked and posted to Pastebin by anonymous hackers. Most of the accounts supposedly belonged to spammers, and there were many duplicate entries, Twitter officials pointed out. However, to play it safe, you should probably change your Twitter password ASAP."
Nah, they just tried "12345" on all the accounts.
I think they saw it in a movie once.
How many people use the same password on several services?
From CNet's article:
After Lamo and others found that at least some of the alleged account data had been posted on the Web last year and speculated that the list appeared to be compiled from various sources, including spam accounts, Twitter provided CNET this statement when asked for comment: "We've looked into this and can confirm that Twitter was not compromised. For extra precaution, yesterday, we pushed out password resets to accounts that may have been affected."
There is no evidence Twitter themselves were "hacked".
This is likely the password file from a spambot c&c network.
All* the twitter accounts shown follow the same naming and password rules. This is not typical of how a random selection of users would set up their account.
In addition all/most of these accounts are or were suspended (typically this is for spam).
* I may have missed one, but given several others point out the same...
Ref: Reddit: 55.000+ Twitter usernames and passwords leaked
A huge number of the account names and passwords look clearly auto-generated. I would guess it's not a "real" leak of actual users' data, but a compromise of some spammer's twitter-bot farm.
I mean, this is not what a leak of regular Twitter-user u/p would look like:
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Well managed sites do not store your password. They store an encryption HASH of your password. When you type in your password, they use the same routine to HASH what you type in and compare the hashes. You cannot go backward from a hash to a password (well, not a modern hash, and not with a password that isn't a simple common word). There is no excuse for a web site to actually have a stored copy of your actual password anywhere in their systems.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
Good thing these passwords weren't obtained by attacking Twitter's servers directly then.
Try as hard as I can, still don't care about twits and their tweets.
Oh dear, is this the same Adrian Lamo who turned in Bradley Manning over the Wikileaks incident?
http://www.wired.com/threatlevel/2011/07/manning-lamo-logs/
I don't know why anyone would ever talk to this guy again for the rest of his life.
This post expresses my opinion, not that of my employer. And yes, IAAL.
Seems to me it's more likely that somebody now owns the Twitter password server and is now trying to get everyone to change their password so he'll have all the twitter user passwords.
Hello, FBI, is that you??
Salted and hashed. Without salt you can use rainbow tables to reverse the hash. But you're right, they shouldn't be storing it anywhere or using reversible encryption.
Thanks for the suggestion, but that just showed up as a bunch of asterisks for me. (Maybe that would be a good password?)
If you can't convince them, convict them.