Twitterhacks

Nachdem vorige Woche die sog. *[Syrian Electronic Army (SEA)][3]* mit einem gehackten Twitteraccount der Nachrichtenagentur AP für Unruhe bis auf die Wallstreet sorgte, [hat es nun den Guardian getroffen][1]. Nach einer weiteren Phishing-Attacke, fielen der SEA gleich 11 Twitteraccounts in die Hände, von denen sie dann [wieder gefälschte Tweets absetzten][4] (diesmal allerdings nicht so dramatisch wie im Falle von AP).

Während man bei Twitter also immer noch dabei ist, die ganz offensichtlich dringend benötigte *[two-factor authentication][2]* zu basteln, es aber ebenso offensichtlich einfach nicht hinbekommt, fallen die nächsten Accounts in die Hände der SEA. Und das, wo inzwischen klar ist, dass ein einziger gutplatzierter, aber falscher Tweet, die Börsen in Aufregung versetzen kann. Offenbar ist man sich im Hause Twitter seiner Verantwortung noch nicht ganz bewusst, aber es ist ja auch noch nicht der Account von Justin Bieber gehackt worden. Dann würde man wahrscheinlich eher reagieren.

Zu einem gehackten Twitteraccount gehören aber natürlich auch immer zwei Dumme, neben dem Anbieter, der sich nicht um Sicherheit schert, natürlich auch derjenige, der sich sein Passwort entlocken lässt. In beiden Fällen (Guardian und AP) wird in den Medien gerne über [cleverly-disguised phishing emails][1] berichtet.

Sicher ist aber schonmal eines: alle Zukunftsromane über den Cyberwar und seine Auswirkungen auf Wirtschaft und Gesellschaft **sind alle wahr**.

**Update:** Offenbar hat man bei Twitter auch [inzwischen zumindest ratgebenderweise reagiert][5]:

> According to Twitter, the hacking incidents seem to be the result of phishing attacks targeted at corporate email accounts. Twitter suggests that companies employ a pretty standard set of password security practices in response: changing current passwords, using new ones that are at least 20 characters long and are made up of either randomly-generated characters or random words, and to never email said passwords, even internally (programs like 1Password are mentioned as good solutions to ensure password security).

[1]: http://www.theverge.com/2013/4/29/4282202/the-guardian-falls-victim-syrian-electronic-army-11-twitter-accounts-hacked
[2]: http://en.wikipedia.org/wiki/Two-factor_authentication
[3]: http://en.wikipedia.org/wiki/Syrian_Electronic_Army#Syrian_Electronic_Army_.28SEA.29
[4]: http://nakedsecurity.sophos.com/2013/04/29/guardian-twitter-hacked-syrian-electronic-army/
[5]: http://www.theverge.com/2013/4/29/4283854/twitter-warns-news-organizations-about-ongoing-hacking-threats

Veröffentlicht von

Nico

Nico Brünjes ist Digitalkreativer und Internethandwerker. Seit mehr als 15 Jahren erdenkt, baut und programmiert er moderne, standardkonforme und zugängliche Webseiten in HTML, CSS und Javascript.

3 Gedanken zu „Twitterhacks“

  1. This mail is from twitter:

    Hello from Twitter,

    Please help us keep your accounts secure. There have been several recent incidents of high-profile news and media Twitter handles being compromised. We believe that these attacks will continue, and that news and media organizations will continue to be high value targets to hackers.

    What to be aware of:

    These incidents appear to be spear phishing attacks that target your corporate email. Promoting individual awareness of these attacks within your organization and following the security guidelines below is vital to preventing abuse of your Twitter accounts.

    Take these steps right now:

    * Change your Twitter account passwords. Never send passwords via e-mail, even internally. Ensure that passwords are strong- at least 20 characters long. Use either randomly-generated passwords (like “LauH6maicaza1Neez3zi”) or a random string of words (like “hewn cloths titles yachts refine”).
    * Keep your email accounts secure. Twitter uses email for password resets and official communication. If your email provider supports two-factor authentication, enable it. Change your e-mail passwords, and use a password different from your Twitter account password.
    * Review your authorized applications. Log in to Twitter and review the applications authorized to access your accounts. If you don’t recognize any of the applications, contact us immediately by emailing [Mailadresse entfernt].
    * Help us protect you. We’re working to make sure we have the most updated information on our partners’ accounts. Please send us a complete list of all accounts affiliated with your organization, so that we can help keep them protected.
    * Build a plan. Create a formal incident response plan. If you suspect your organization is being targeted by a phishing campaign or has been compromised by a phishing attack, enact the plan.

    * Contact us immediately at journo@twitter.com with the word “Hacking” in the subject. Include copies of suspected phishing emails.
    * If you lose access to an account, file a Support ticket and email the ticket number to journo@twitter.com.

    Moving Forward:

    * Review our security guidelines to help make sure your accounts are as secure as possible.
    * Talk with your security team about ensuring that your corporate email system is as safe as possible. A third-party provider that allows for two-factor authentication might be a safer solution.
    * Strong security practices will reduce your vulnerability to phishing. Consider the following suggestions:

    * Designate one computer to use for Twitter. This helps keep your Twitter password from being spread around. Don’t use this computer to read email or surf the web, to reduce the chances of malware infection.
    * Minimize the number of people that have access. Even if you use a third-party platform to avoid sharing the actual Twitter account password, each of these people is a possible avenue for phishing or other compromise.
    * Check for signs of compromise. Checking your email address and authorized apps weekly or monthly can help detect unauthorized access and address the problem before access is abused.
    * Double-check the email address associated with your Twitter accounts: https://twitter.com/settings/account
    * Review the apps authorized to access your accounts: https://twitter.com/settings/applications
    * Change your password regularly. Changing your Twitter password quarterly or yearly can reset the clock if a password has leaked.

    * Using a Password Manager integrated into your browser can help prevent successful phishing attacks.

    * Third-party solutions such as 1Password or LastPass, as well as the browser’s built-in password manager, will only auto-fill passwords on the correct website. If the password manager does not auto-fill, this might indicate a phishing attempt.
    * Password managers make it much easier to use a very strong password. Very difficult passwords will discourage memorization, which will greatly reduce the chances of being phished.
    * Be certain to set a master password, since otherwise passwords may be stored unprotected.

    […]

Kommentare sind geschlossen.