Twitter hack details revealed
Published: 07 Jan 2009 14:36 GMT
A brute-force attack on a Twitter administrator's account led to a break-in of Twitter accounts belonging to celebrities, according to an email sent to ZDNet UK.
The 33 accounts, hacked on Monday, included those for Barack Obama, Britney Spears and US newscaster Rick Sanchez.
A hacker called 'GMZ' launched a basic dictionary-based attack on the Twitter account for 'Crystal', a Twitter administrator, and successfully cracked the account's password, according to the email. A dictionary attack is a technique to fool authentication mechanisms, in this case to gain a password. An attacker successively tries words in a long list at the point of authentication, usually from a dictionary, using software to automate the process.
The email describing the events was sent to ZDNet UK by a person who was on the same forum as the hacker while the attacks were taking place, and who observed the fake posts on Twitter. The person asked to remain anonymous.
According to the email, the hacker provided the details on the Digital Gangster forum for others to make fake posts to any account, with many on the forum choosing celebrity accounts to compromise.
The brute-force attack was made easier by Twitter having no limitations on login attempts, including not using a Captcha challenge-response process. Captchas are typically used during authentication to check whether the response has been generated by a computer or a human, and usually consist of a partially obscured word or combination of letters and numbers that needs to be entered to proceed with the login.
"Most websites, after three failed login attempts, will ask you to answer a Captcha," the sender of the email wrote on Tuesday. "Twitter does nothing of that sort, which made this attack incredibly easy."
After approximately 30 minutes of multiple users defacing Twitter accounts, Digital Gangster moderators closed and deleted the forum thread.
Twitter co-founder Biz Stone told ZDNet UK that Twitter had been hacked using a dictionary attack, and confirmed that the Twitter login processes would be amended.
"We're modifying account sign-in to be more secure for all accounts, including admin accounts," Stone told ZDNet UK in an email interview. "Additionally, we are creating a higher level of security access to the support tools."
Stone declined to comment as to whether Twitter would be taking any legal action as a result of the hack.
Did you find this article useful?
21 out of 23 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
