Twitter Hacker Says Admin Password Was 'Happiness'
blog.wired.com
Twitter Hacker Says Admin Password Was 'Happiness'
1–10 of 44 posts
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#2He also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines.
I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#3This is again a reason why you shouldn't make accessing internal company services too easy. Yeah, it can be a pain but once someone figures out a little piece of the puzzle, they can run amok in your network. In hindsight, tying customer service methods to employee Twitter accounts was the big mistake.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#4He also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines. I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.
He didn't hijack those accounts; he gave out the credentials in a forum thread and others jumped on it.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#5This is again a reason why you shouldn't make accessing internal company services too easy. Yeah, it can be a pain but once someone figures out a little piece of the puzzle, they can run amok in your network. In hindsight, tying customer service methods to employee Twitter accounts was the big mistake.
Sure was a heck of a guess to end up with a staffer.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#6Again, it brings up the case of why passwords are bad at this level.
Maybe staffers should have used a secondary password to get administrative rights.
Or maybe they should have been using an entirely different account.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#7This does bring up a good tech question -- how do you prevent people from doing a rapid password attack?
Anyone have an article or some ideas on how this could be done? Is limiting attempts the simplest way?
Even if you do limits, aren't these session-based? I'm guessing a cracker isn't going to respect sessions.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#8He also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines. I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.
He didn't hijack those accounts; he gave out the credentials in a forum thread and others jumped on it.
Technically you're correct, but by giving out the credentials in a public forum he should have known better.
Re: Twitter Hacker Says Admin Password Was 'Happiness'
#9This is why ideally you only make your admin tools available on your private network, accessible only via VPN. The very minimum is restricting access to admin functionality to specific IP addresses.
Limiting password check attempts is important too, but if all a bad guy could get access to is user accounts the damage is significantly less.