55,000 Twitter Accounts Hacked, Passwords Leaked 66
MojoKid writes "Tens of thousands of Twitter accounts have been compromised in a recent hack attack in which more than 55,000 passwords were leaked and posted to Pastebin by anonymous hackers. Most of the accounts supposedly belonged to spammers, and there were many duplicate entries, Twitter officials pointed out. However, to play it safe, you should probably change your Twitter password ASAP."
Re:Bad Systems Design? (Score:5, Funny)
I think they saw it in a movie once.
Re: (Score:1)
Not just Twitter (Score:4, Insightful)
How many people use the same password on several services?
Welp (Score:1)
Why am I not surprised? (Score:1)
>55,000 passwords were leaked
Why am I not surprised?
Re: (Score:2, Funny)
I certainly am surprised. I thought they had more than 55,000 users. Maybe there are only 55,000 unique passwords amongst their users?
Update: No recent hack, just repackaged old data (Score:5, Informative)
From CNet's article [cnet.com]:
After Lamo and others found that at least some of the alleged account data had been posted on the Web last year and speculated that the list appeared to be compiled from various sources, including spam accounts, Twitter provided CNET this statement when asked for comment: "We've looked into this and can confirm that Twitter was not compromised. For extra precaution, yesterday, we pushed out password resets to accounts that may have been affected."
Re: (Score:3, Interesting)
Oh dear, is this the same Adrian Lamo who turned in Bradley Manning over the Wikileaks incident?
http://www.wired.com/threatlevel/2011/07/manning-lamo-logs/ [wired.com]
I don't know why anyone would ever talk to this guy again for the rest of his life.
Re: (Score:2, Insightful)
Oh dear, is this the same Adrian Lamo who turned in Bradley Manning over the Wikileaks incident?
http://www.wired.com/threatlevel/2011/07/manning-lamo-logs/ [wired.com]
I don't know why anyone would ever talk to this guy again for the rest of his life.
I'd talk to him. He reported an Intelligence officer with access to sensitive information who was planning on leaking it because he was pissed off about the military's policy towards homosexuals. If you bother to read the conversations it's pretty fucking obvious that Manning had an axe to grind, went into the systems and dug up any and all information he thought might make the military look bad, and then leaked it. After the fact, he tried to claim that he was "blowing the whistle" on supposed war crimes w
Re: (Score:2)
Whatever else you may think of Lamo one thing is abundantly clear: he's untrustworthy.
As pointed out in several other places... (Score:5, Informative)
There is no evidence Twitter themselves were "hacked".
This is likely the password file from a spambot c&c network.
All* the twitter accounts shown follow the same naming and password rules. This is not typical of how a random selection of users would set up their account.
In addition all/most of these accounts are or were suspended (typically this is for spam).
* I may have missed one, but given several others point out the same...
Ref: Reddit: 55.000+ Twitter usernames and passwords leaked [reddit.com]
Re: (Score:2)
Re: (Score:2)
You're reaching. A lot of the accounts/passwords are things like:
andre@someplace.com:andre
somebraindeaduser@somewhere:123456789
Once you get past the spam accounts, there's a lot of what looks like valid user accounts with weak passwords.
looks like pretty low-value accounts (Score:5, Informative)
A huge number of the account names and passwords look clearly auto-generated. I would guess it's not a "real" leak of actual users' data, but a compromise of some spammer's twitter-bot farm.
I mean, this is not what a leak of regular Twitter-user u/p would look like:
Re:looks like pretty low-value accounts (Score:5, Funny)
I agree, clearly not real people. Those passwords are way too strong.
Re: (Score:1)
Re: (Score:2)
Well, looks like people have a list of 55,000 strong passwords to choose from now.
People who have memorization issues should start with perhaps a weaker password, then make it longer over time. I don't think password aging is a good idea as people will just choose weak passwords slightly modifying them each time.
A six digit, easy-to-read captcha seems like it should be easy for spammers to crack. Maybe twitter should require account verification using a mobile phone number? With no more than one account cre
Re:looks like pretty low-value accounts (Score:5, Informative)
The list starts off strong with roughly 5000 script generated accounts. The usernames and passwords are just too obviously random to be real.
It looks like it then goes on to some phished accounts.
Also looks like a large amount are duplicates.
Re: (Score:1)
http://www.airdemon.net/hacker107.html [airdemon.net]
Re: (Score:2)
Yes, you should change your password. 55k passwords posted, unknown amount compromised but unposted until (if) they figure out where they came from.
Re: (Score:2)
Send your username and password to me and I'll check for you.
Wait. (Score:1, Offtopic)
Think I was hit (Score:2)
Maybe it's just a coincidence but I checked my twitter account and couldn't log in, had to reset my password. Damn now I need to find a password other than 12345, BTW could you pass the Peri-Air?
Re: (Score:3)
Damn now I need to find a password other than 12345,
You could try Password1
Re: (Score:2)
I prefer to use hunter2 for all my critical accounts.
Re:Think I was hit (Score:4, Funny)
Thanks for the suggestion, but that just showed up as a bunch of asterisks for me. (Maybe that would be a good password?)
Re: (Score:1)
TLDR
Why the hell would twitter even KNOW my password? (Score:3, Interesting)
Well managed sites do not store your password. They store an encryption HASH of your password. When you type in your password, they use the same routine to HASH what you type in and compare the hashes. You cannot go backward from a hash to a password (well, not a modern hash, and not with a password that isn't a simple common word). There is no excuse for a web site to actually have a stored copy of your actual password anywhere in their systems.
Re:Why the hell would twitter even KNOW my passwor (Score:4, Insightful)
Good thing these passwords weren't obtained by attacking Twitter's servers directly then.
Re: (Score:1)
I wish i had some mod points for you
Re:Why the hell would twitter even KNOW my passwor (Score:4, Interesting)
Salted and hashed. Without salt you can use rainbow tables to reverse the hash. But you're right, they shouldn't be storing it anywhere or using reversible encryption.
Re: (Score:3)
If only the world was so simple. Passwords sometimes need to be stored un-hashed. For example, your ISP may have your password unhashed or stored in a reversable encryption to facilitate secureish un-encrypted authentication such as CHAP.
And even if said well managed site stores salted hashes, it is often trivial for someone with access to a compromised server to log the username/password pairs before the salted hash is compared... and sure the client can send a salted hash which is salted based off a chall
Re: (Score:2)
It's good advice (your golden rule). There are only two levels of paranoia, to a computer security person. Absolute, and insufficient.
And... (Score:1)
Not to be a curmudgeon, but does twitter really contribute anything to the world?
Re: (Score:3)
Not to be a curmudgeon, but does twitter really contribute anything to the world?
Where else ya gonna go to get your password hacked?
Re: (Score:2)
Yes, there's a lot of noise (just try reading the "raw" feed if you want
Re: (Score:1)
Re: (Score:2)
Those are the people without tin-foil hats. ;-)
But honestly, if you think someone is watching you, someone probably is.
Caring about it (Score:3, Funny)
Re: (Score:2)
Do or do not, there is no "try". And when it comes to caring about Twitter, there is no "do" either.
And nothing of value was lost (Score:4, Interesting)
Seems to me it's more likely that somebody now owns the Twitter password server and is now trying to get everyone to change their password so he'll have all the twitter user passwords.
Hello, FBI, is that you??
The DA gets what he wants (Score:2)
"Fight us over our subpoenas? Fine, you have 'Chinese' hackers eating you now."
Keylogged, not hacked. (Score:2)
Or at least not directly hacked from Twitter.
If you look at the logins [airdemon.net] there is a mix of usernames and email addresses. Since Twitter lets you login using either your twitter handle or email address, it looks as if these were somehow keylogged or otherwise hijacked, as opposed to Twitter being hacked.
Re: (Score:2)
About 1/2 (15834) are @hotmail
(Yahoo and GMail each had about 2000-2200 occurences.)
So possibly phished or keylogged.
Or hotmail is a lot more popular then we realize.
proposal (Score:2)
Wouldn't it be simpler to just post a story on the days when skateboardface & his lackeys don't fuck something up?