Twitter's network gets breached again

Twitter has confirmed that someone broke into its network and gained access to 10 accounts, which appear to include Britney Spears and Ashton Kutcher, according to screenshots posted on a French blog site.

"Our initial security reviews and investigations indicate that no account information was altered or removed in any way," Twitter co-founder Biz Stone wrote in a blog post Thursday afternoon.

"Personal information that may have been viewed on these 10 individual accounts includes email address, mobile phone number (if one was associated with the account), and the list of accounts blocked by that user," the posting said. "Password information was not revealed or altered, nor were personal messages (direct messages) viewed."

Stone did not respond to an e-mail seeking comment.

Someone using the alias "Hacker Croll" claims to have gotten access to a Twitter administrator's Twitter password by guessing the secret question to reset the administrator's password on a Yahoo e-mail account where the Twitter password was located, according to a post in the Warez Scene forum.

The 13 screenshots posted on the Korben blog and another site include not only what looks like admin pages for the celebrities' accounts, but also a page of blacklisted users and other administrative-type pages.

Sure enough, Twitter employee Jason Goldman tweeted on Monday that his Yahoo e-mail account had gotten hacked, IDG News Service discovered.

This isn't the first time Twitter's network has been breached. In January, someone hacked into the Twitter internal network and gained access to the Twitter accounts of President Obama, CNN anchor Rick Sanchez, and 31 other high-profile Twitterers. Wired later revealed that the hacker used an automated password guesser to figure out the Twitter administrator's password, which was "happiness."

The popular microblogging site has had more than its share of security challenges lately. It had to clean up after a series of worms spread quickly and modified user profiles a few weeks ago, as well as fight off an attack that hijacked accounts in March, and battle "clickjacking" attacks in February.

This screenshot shows what appears to be an administrator view of Britney Spears' Twitter account. This and 12 other screenshots were posted on the Internet by a hacker claiming to have gained access to the Twitter system by getting a Twitter administrator's password from his Yahoo e-mail account after breaking into that.

(Credit: Korben)

[n3td3v]

How long till that forum gets shut down?

[jtlevin]

How stupid can you be to use a real answer as your secret question or use a real word for your password that can be easily hacked with a brute force dictionary attack?

Sigh. Maybe people will learn from this but I doubt it...

[septa44]

Twitter is always going to be susceptible to this. But that guy should be fired for such an easy password. Twitter Backlash had a recent post of the hackability of Twitter that was good.

http://twitterbacklash.squarespace.com/journal/2009/4/16/too-trusting-on-twitter.html

[B-Ri]

Fired for a bad password? Seems a bit extreme don't you think? If they need real security then they should be using 2 factor authentication. A password is rarely secure since it requires a human to remember it and so often it is set to something simple. Plus you then get these systems that require a forgotten password link that is able to be used to reset and gain access. Just my .02 worth.

[Dalkorian]

I'm with septa here, any "admin" that's capable of using such an idiotic password as "happiness" deserves to be fired. It's not extreme at all, it's expecting someone to be capable of doing their job in a safe and secure way. If you had a bus driver who drove down the sidewalk and ran over school children, you would fire him.

Need a password that's easier to remember than a random set of characters? Fine, but at least sub in some numbers. "h4pp1n3s5" is much more secure than "happiness" is. Anyone who doesn't understand that shouldn't have an administrator level account on any computer system.

[rsrupert1972]

Twitter's a joke anyway. I have a ATT account, but can't use twitter because eventhough they tweet on the att network, my att numbers not supported