Slashdot Mirror
Twitter #Hacked
theodp writes "Earlier this week, hackers gained access to Twitter's internal systems and stole information, compromising 250,000 Twitter accounts before the breach was stopped. Reporting the incident on the company's official blog, Twitter's manager of network security did not specify the method by which hackers penetrated its system, but mentioned vulnerabilities related to Java in Safari and Firefox, and echoed Homeland Security's advisory that users disable Java in their browsers. Sure, blame everything on Larry Ellison. Looks like bad things do happen in threes — Twitter's report comes on the heels of disclosures of hacking attacks on the WSJ and NY Times."
java app => cron: reboot/restart apache/jboss/tomcat : every week
Who reads twitter with a web browser anymore? All quarter million of these accounts?
Or was that avenue used to gain access on a server to a password databases or what?
TFA says
hackers gained access to Twitter's internal systems and stole information, compromising 250,000 accounts
They then reference an advisory from the U.S. Department of Homeland Security that users disable Java on their computers.
Maybe Twitter should follow DHS?
This sounds like half the story. And press accounts aren't much more informative. Seems everyone is playing this java angle
pretty close to the vest.
Sig Battery depleted. Reverting to safe mode.
I'm not happy about Oracle control over Java, but when Flash and Windows are (still) riddled with vulnerabilities after all these years, why has no quasi-governmental organization ever recommended that either of those be disabled or uninstalled from every computer? Only Steve Jobs took substantive, albeit indirect, steps to eliminate these obvious threats to computer security.
They meant "did not specify security"
Speak this way, most of us do.
For those keeping score:
I'm having trouble following this. If I understand correctly, if I had Java disabled in my browser already, then my Twitter account is safe? It's really hard to tell from the article.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Well, one thing is for sure - the exploit was written with a context-free grammar.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
really slashdot? Yay for supersition..
I guarrantee that more than three organizaions have been cracked in the last week.
It reminds me somewhat of Tim Minchin at minute 2 in this video: https://www.youtube.com/watch?v=ET1-_PeExMs
"vulnerabilities related to Java in Safari and Firefox" have to do with twitter's "internal systems"
sounds more like some twits with old java plugins got their passwords swiped by malware, which is nothing new these days.
Stop hacking our S**T! We already got North Korea to worry about...
nothing of value was lost
I don't know (or specifically care) if I'm among that quarter million users, but it would have been peachy keen if Twitter had taken five minutes to e-mail their friggin' users to tell them.
Three Squirrels
Re:"manager of network did security not specify"
.
You say:the exploit was written with a context-free grammar.
.
I say: the article was written with a grammar-free context!
;>)
All their user are by definition.
actually the sentence should be "...manager of network security did not specify...", so no, they didn't mean "did not specify security".
I call foul.
I don't even have Java installed....and yet my twitter account was hacked due to a java vulnerability? I got one of the emails saying my account had been compromised...but according to this, that wouldn't have been possible.
Someone's mistaken...or lying.
If a security hole in Java running on a Twitter user's browser allowed someone to get to Twitter's internal data (i.e. not just the data of the user whose browser who had Java) - then it's a security hole in Twitter.
I think Twitter is being dishonest here.
How can java and safari be to blame? Unless of course an employee was surfing porn or something questionable and his PC was hijacked but I would say the problem is with twitter not doing more to protection their employee machines and network.
I think it was a joke referring to the poor security on Twitter's part, as in "Twitter did not specify security.
Nice to see you back, APK.
Its unclear why twitter are resetting passwords. Is it simply a precaution as the password data is encrypted and useless (as it should be)? Surely in this day and age Twitter aren't storing passwords in clear text?
The pattern reveals media and social companies as the low hanging fruit. As long as they don't do a big hit on the 3 big ones: Apple, Google, Amazon then there is not much cause for alarm.
- these are not the droids you are looking for -
You got the joke. Congratulations! /golfclap
We've been hacked because of our inability to deal with known java vulnerabilities - quick say it took advanced techniques and blame the Chinese!
How is their head of network 'security' still in a job?
No. Internal systems that are secure do not get compromised by rouge clients.
Could it be that someone used Java in the browsers to snatch credentials from users on their local machines? Sure.
Could someone infect a browser and that cause Twitter's network to be insecure? No.
This is an awfully good illustration of one of the many reasons why I don't drink the social-networking Kool Aid. I make exceptions for Goodreads and RateYourMusic, plus a few forum accounts, but that's it.
That like having you grass clippings stolen.
I check my passwords with tools like http://password-checker.online-domain-tools.com/ and https://www.microsoft.com/en-gb/security/pc-security/password-checker.aspx. Is there something more that I can do?