42 Points

Things were looking tough for Twitter earlier this week, after last week's phishing scam and the breach of security earlier this week that left 33 high-profile Twitter accounts compromised.

Now that details of the hack are surfacing, though, it's looking even more embarrassing.

According to Wired's Threat Level blog, the hacker was an 18-year old who goes by GMZ, and his weapon of choice was a simple brute force dictionary hack.

Exploiting lax security protocols, the hacker was able to repeatedly flood Twitter's servers with login attempts using passwords garnered from a simple dictionary file. He didn't even have to go far - the password, as it turns out, ironically, was "happiness."

The details of the rudimentary hack reveal a startling lack of essential security within Twitter's halls, and raises eyebrows about the potential for Twitter to be marketed as an internal collaboration tool for business use. The so called dictionary-hack has been a mainstay of hackers for decades, and the servers should have been configured to recognize the repeated login attempts. A lack of strong password enforcement (ensuring that passwords are complex) and a failure to "lock out" accounts after multiple failed attempts are a breeding ground for would be hackers and crackers - with a situation like that, it was only a matter of time.

Perhaps this is a blessing in disguise. Twitter will certainly have to up the ante on their security protocols, and it's fortunate that it happened before Twitter made the move to monetize, rather than during. This will give them a chance to shore up their defenses before it costs them actual revenue, and on the bright side, at least the prankster had a sense of humor.

Note: A Youtube Video of the hack has been posted online - although the quality isn't the best, the process is quite clear.

Jan 8, 2009

Share this post on:

Comments
Twittown Comments
Submitted by yuridebura on Nov 23, 2009 14:36 says:

A hacker who uses the pseudonym GMZ accepted responsibility for the recent Twitter hack in an IM interview to Threat Level on Tuesday. He divulged little personal details except that he is an 18-year old student on the East Coast for domain registration. It is also known that he is a member of the online forum for hackers called Digital Gangster; forum members had claimed that GMZ was responsible for the hack even before the hacker owned up.

He revealed that he successfully gained access to the account of a female Twitter staffer named “Crystal.” He had serendipitously stumbled upon her account and had no idea that she was a Twitter staff member with administrative control. He then proceeded to hack her account using a dictionary attack.

The program didn’t have to break a sweat as she was using the password “happiness.” Her flimsy password coupled with Twitter’s primeval security, which allows rapid-fire log-in attempts, led to several high profile Twitter accounts, including the ones belonging to President-elect Barack Obama and Fox News, being compromised.

Submitted by coffee fiend (not verified) on Jan 10, 2009 12:04 says:

did the Twitter Admin change his password to "sadness" after he was hacked? haha... ok not funny

Submitted by Twittonary on Jan 8, 2009 15:24 says:

I agree that it was almost a blessing in disguise- it could have been MUCH worse. It was bound to happen at some point and now hopefully they will be able to avoid such attacks in the future, or at least have stronger protocols in place. Plus it gave them publicity. I have had several people ask me about twitter who had never heard about it before and are actually considering signing their businesses up. So, perhaps in the end it will come a win win for them.

http://www.twittonary.com -The Twitter Dictionary