Burger King’s Twitter account was hacked and renamed McDonalds. Jeep’s Twitter account was hacked and Jeep was made part of the Cadillac line.
Devin Coldewey on nbcnews.com wrote, “The account was briefly rebadged, so to speak, to feature a brand new Cadillac ATS, and tweets are pouring out praising Cadillac in the same coarse and thuggish vernacular seen on Burger King’s account. The Jeep account also called out several users of Twitter as ‘da bad guys,’ one of which tweeted that it was the user @GUHTI_, or ITHUG, who had actually perpetrated the hack.”
Call it irony or plain old bad luck, but Coldewey noted that prior to the hack, Jeep “had only a few minutes earlier tweeted about online security, specifically in response to the Burger King hack.” What’s that old cliché about timing being everything? Anyway, Coldewey added, “The nature of the hack is unknown as yet — it could be a serious security hole on Twitter’s end, or the hacker could have compromised a computer with access to the Jeep account. Cadillac denied any involvement, much as McDonalds did yesterday.”
Fresh on the heels of the Jeep and Burger King hacks, MTV’s twitter account looked like it’d been hijacked changing MTV to BET.
No. It was just a publicity stunt by Viacom, which owns both properties. Great publicity – if your aim is for some reason to look like you just got hacked.
In any case, Michael Lee on zdnet.com wrote that Twitter appears to be looking into a way to implement two-factor authentication to shore up its security and prevent breaches that, in addition to Jeep’s and Burger King’s, recently put 250,000 other Twitter users’ information and reputations at risk.
However, OneID founder Steve Kirsch, among other security pros, is sure two-factor authentication is not the right solution for Twitter. And in Lee’s zdnet.com piece Kirsch explains why:
Two-factor authentication provides an additional effective step to thwart would-be attackers from taking over users’ accounts, but it is currently not an option for Twitter users. On the back of recent attacks on the site, many have been calling for Twitter to implement it, but, according to Kirsch, even if Twitter does roll out the security measure, it won’t prevent the attack from occurring.
While not dismissing two-factor authentication systems’ effectiveness at preventing existing phishing attacks from being successful, Kirsch said that the number of people signing up for it in existing services is abysmal, and doesn’t do much for improving overall security.
“From a practical point of view, it would be like offering a feature that no one used,” he said.
Given that many attacks are opportunistic, focusing on the number of accounts that attackers and scammers can hack, Kirsch said that it would barely make a difference. In fact, he said that introducing two-factor authentication would hurt the user experience.
“Even adding a single character to a password in Twitter — if you require nine characters versus eight characters — even just doing that requirement measurably affects sign-up rates and so forth. Twitter wants to do whatever it can to make it easier for customers, and adding two-factor authentication is moving in exactly the wrong direction,” he said.
“Even if they move to two-factor, and even if everyone adopted it, which they wouldn’t … it’ll make no difference.”
The reason for this is that the most recent attack on Twitter wasn’t conducted on users’ accounts; it was on Twitter’s own infrastructure. By directly attacking the servers containing the password hashes of Twitter users, two-factor authentication would make little difference.
Kirsch admitted that although user passwords might be salted and hashed, if attackers have compromised a server to the point where they can retrieve that information, it would be likely that they could do worse. This includes sniffing users’ passwords as they enter the server, and converting them into hashes to be compared. Such examples have been documented for some time, where sensitive information that’s sent to a web server is intercepted as it appears in plain text in the machine’s RAM prior to processing.
Kirsch said that at the centre of the attack is the fact that Twitter, along with many other organizations that already use two-factor authentication, relies on a “shared secret” — a user password, whether it is eventually converted into a hash, a keyfile, or similar.
He argued for a better system, where even if the server is completely compromised, it would still be impossible to gain access to users’ information. And he says that such a system has existed for years.
Kirsch is pushing for companies like Twitter and Google to use public key cryptography. In this case, if attackers wanted to retrieve passwords for accounts, they wouldn’t have a single point that they could break into, because the only thing they would obtain from centralized servers are public keys, which are useless by themselves. The private keys — the other part of the “secret” needed to secure communications — would be located on users’ machines, jointly opening the possibility to remove passwords altogether.
“We basically said, let’s take a clean sheet approach to the problem and design a solution that eliminated the use of shared secrets, used modern-day cryptography, and that made it user friendly. The result is a system that has the security that is far better than even using those hardware tokens and so forth, but yet has the ease of use of Facebook Connect.”
As for why it hasn’t been adopted in greater numbers yet, Kirsch said that the relative complexity of public key cryptography schemes has been user unfriendly, but that those days are numbered.
“It’s the advances in browser technology; things like having HTML5 local storage, things like JavaScript, which is powerful enough to run these cryptographic algorithms; things like the invention of elliptic curve cryptography, which makes the computation very fast.
“All of these factors have come together (and) we can finally make this public key-digital signature world a reality. (Users will) essentially have one username (and) one password, that they can use everywhere. (Even) if there’s a breach of any site, or multiple sites, (it won’t) matter. That will truly change usability for everyone.”
ThreatMetrix is the fastest-growing provider of integrated cybercrime prevention solutions.The TrustDefender™ Cybercrime Protection Platform helps companies protect customer data and secure transactions against payment fraud, malware, account takeover, fraudulent new registrations, data breaches, as well as man-in-the browser (MitB) and Trojan attacks. The platform consists of advanced cybersecurity technologies, including TrustDefender™ ID, which is cloud-based, real-time device identification, malware protection with TrustDefender™ Cloud and TrustDefender™ Client, as well as TrustDefender™ Mobile for smartphone applications. ThreatMetrix cybersecurity solutions protect more than 1,500 customers and 8,500 websites across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government, and insurance. For more information, visit www.threatmetrix.com or call 1-408-200-5755.
To join in the cybersecurity conversation, follow us on Twitter @ThreatMetrix.
