Slashdot Mirror
Twitter #Hacked
theodp writes "Earlier this week, hackers gained access to Twitter's internal systems and stole information, compromising 250,000 Twitter accounts before the breach was stopped. Reporting the incident on the company's official blog, Twitter's manager of network security did not specify the method by which hackers penetrated its system, but mentioned vulnerabilities related to Java in Safari and Firefox, and echoed Homeland Security's advisory that users disable Java in their browsers. Sure, blame everything on Larry Ellison. Looks like bad things do happen in threes — Twitter's report comes on the heels of disclosures of hacking attacks on the WSJ and NY Times."
java app => cron: reboot/restart apache/jboss/tomcat : every week
Who reads twitter with a web browser anymore? All quarter million of these accounts?
Or was that avenue used to gain access on a server to a password databases or what?
TFA says
hackers gained access to Twitter's internal systems and stole information, compromising 250,000 accounts
They then reference an advisory from the U.S. Department of Homeland Security that users disable Java on their computers.
Maybe Twitter should follow DHS?
This sounds like half the story. And press accounts aren't much more informative. Seems everyone is playing this java angle
pretty close to the vest.
Sig Battery depleted. Reverting to safe mode.
At least Firefox did the right thing and doesn't run plugins automatically anymore by default, with a recent enough Flash being an exception.
For those keeping score:
I'm having trouble following this. If I understand correctly, if I had Java disabled in my browser already, then my Twitter account is safe? It's really hard to tell from the article.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Well, one thing is for sure - the exploit was written with a context-free grammar.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
nothing of value was lost
Protip: Right-click video, then "Copy Video URL at Current Time.". Like So: https://www.youtube.com/watch?v=ET1-_PeExMs#t=116s
Someone forgot to take their meds this morning ...
Only Steve Jobs took substantive, albeit indirect, steps to eliminate these obvious threats to computer security.
If by "took steps" you mean "died," then yeah you are right.
Re:"manager of network did security not specify"
.
You say:the exploit was written with a context-free grammar.
.
I say: the article was written with a grammar-free context!
;>)
You really shouldn't be calling other users sadomasochistic when you are running NoScript which breaks every other site. You signed up for this, so bend-over bitchboy, and take your configuration problems harder.
captcha: virgins
actually the sentence should be "...manager of network security did not specify...", so no, they didn't mean "did not specify security".
I call foul.
I don't even have Java installed....and yet my twitter account was hacked due to a java vulnerability? I got one of the emails saying my account had been compromised...but according to this, that wouldn't have been possible.
Someone's mistaken...or lying.
They DID. My account was compromised. I got an email.
If a security hole in Java running on a Twitter user's browser allowed someone to get to Twitter's internal data (i.e. not just the data of the user whose browser who had Java) - then it's a security hole in Twitter.
I think Twitter is being dishonest here.
Sometimes you gotta lead by example.
How can java and safari be to blame? Unless of course an employee was surfing porn or something questionable and his PC was hijacked but I would say the problem is with twitter not doing more to protection their employee machines and network.
Windows is far more secure than Java these days. There isn't a lot of active "load a webpage and your computer is owned" exploits going around, unlike for Java where it's a weekly thing.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
"Old" as in from two days ago?
Or maybe it's another unpatched Java flaw being used. Those are a dime a dozen.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Its unclear why twitter are resetting passwords. Is it simply a precaution as the password data is encrypted and useless (as it should be)? Surely in this day and age Twitter aren't storing passwords in clear text?
Yes, and they did the right thing by allowing you to choose to still run Java. As opposed to Safari where it is blocked and they give you no indication as to how to go about reenabling it.
There are two things here that Firefox solves better:
1. They allow you to choose to override the denial so that you can opt to trust a particular applet.
2. They allow you to still use Java but you have to specifically enable/trust the applets that you need, rather than it being all or nothing.
The pattern reveals media and social companies as the low hanging fruit. As long as they don't do a big hit on the 3 big ones: Apple, Google, Amazon then there is not much cause for alarm.
- these are not the droids you are looking for -
No. Internal systems that are secure do not get compromised by rouge clients.
Could it be that someone used Java in the browsers to snatch credentials from users on their local machines? Sure.
Could someone infect a browser and that cause Twitter's network to be insecure? No.
This is an awfully good illustration of one of the many reasons why I don't drink the social-networking Kool Aid. I make exceptions for Goodreads and RateYourMusic, plus a few forum accounts, but that's it.
> Windows is far more secure than Java these days. There isn't a lot of active "load a webpage and your computer is owned" exploits going around
To be fair, the typical Java exploit actually goes "load a webpage, Java downloads a Windows executable, runs it, and your computer is owned".
There are 0x40000000 types of people: those who understand 32-bit IEEE 754 floating point, and those who don't.