Warez backdoor allows hackers to pwn Twitter accounts
Micro-blogging freetards in mass hack attack
Twitter has lifted the lid on its recent advice to many users to reset their passwords for the micro-blogging site.
Originally, it was thought that the guidance had come in response to a common or garden phishing attack. In a post on Tuesday, Twitter explained that the attack was actually far more devious and elaborate.
Hackers established Torrent user sites and forums with hidden backdoors. They waited for these forums to grow in popularity before they harvested login details.
These login credentials were then used in attempts to break into accounts on third party sites such as Twitter. The attack relied on the frequent mistake of using the same password and user ID combination for multiple sites.
In other words, victims are using the same password/userID combo on warez forums and Twitter, a mistake that left them open to attack because unidentified hackers had backdoor access to these forums.
Twitter detected the attack after it became suspicious of a "sudden surge in followers" to two previously obscure accounts last week. Followers of these accounts were advised to change their passwords over concerns that hackers involved in the attack had compromised their accounts to, err, gain more followers on Twitter.
It's unclear how many profiles were pwned by the attacks or what other sites might have been involved. All might have been prevented via the use of rudimentary password security precautions.
"The takeaway from this is that people are continuing to use the same email address and password (or a variant) on multiple sites," writes Del Harvey director of Trust and Safety at Twitter. "We strongly suggest that you use different passwords for each service you sign up for," he adds. ®
I worked on a project that counters this quite effectively too. Basically it was a rod composed of blended aluminium phyllosilicates and graphite used to encode passwords on a cellulose substrate. This allowed a user to easily retain multiple login credentials for future reference, thereby enabling the use of unique passwords for each site.
And the point is?
I use the same login on a number of sites, none of which matter. twitter would be one of them, so would facebook, so would this site. If they are compromised there is no great loss.
I'm somewhat confused.
I can understand how this was done... Just not why.
It seems an awful lot of effort to go to just to take control of something as fatuous and pointless as a twitter account.
I suppose it could have been a trial run to test the concept, before moving on to trying to hijack something important. Although... while people may be daft enough to use the same password for a dodgy warez site as their inane-celebrity-witter account, surely far fewer people would have the necessary single digit IQ to do the same with a password they use for something that is actualy important?
Oh wait - we're talking about twitter users. I seem to have answered my own question.