Ouch! 250,000 compromised Twitter accounts! Not good!
Twitter also hacked this week, up to 250,000 accounts may have been compromised
“It’s been a rough week for security breaches, and Twitter has just announced it was a victim of attacks this week as well. In a blog post, the company states that during this past week it detected ‘unusual access patterns’ that led it to uncover unauthorized attempts to access user’s data. Twitter even discovered one attack as it was happening, and was able to shut it down shortly thereafter. However, Twitter’s post-mortem revealed that the perpetrators of the attack may have had access to account information for approximately 250,000 different users. According to the company, ‘usernames, email addresses, session tokens and encrypted/salted versions of passwords’ would have been available.
Twitter has reset the passwords and revoked session tokens for all such accounts; affected users should be receiving emails notifying them of the reset shortly. Users will be required to create new passwords from scratch.
While no explanation is given for how the vulnerability occurred, Twitter’s post does take a moment to ‘echo’ the recent advisory given by the Department of Homeland Security for computer users to disable Java on their systems for optimal security.
This comes as just the latest in a series of high-profile security breachers that have been revealed this week. Both the Wall Street Journal and the New York Times revealed this week that they had been hacked, identifying hackers from China as the likely culprits. While Twitter does not directly make similar accusations, it does warn that ‘The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked.’
‘This attack was not the work of amateurs, and we do not believe it was an isolated incident,’ Twitter’s Director of Information Security, Bob Lord, writes in the company’s post. ‘For that reason we felt that it was important to publicize this attack while we still gather information, and we are helping government and federal law enforcement in their effort to find and prosecute these attackers to make the Internet safer for all users.’
Update: We just spoke with a Twitter representative that stressed that the company doesn’t have definitive evidence that the accounts were in fact compromised at this time, and that the steps being taken today are a preventative measure. Twitter’s investigation is ongoing.”
