Phishers hit Twitter

by billso on Monday, 5 January 2009

Over the past weekend, phishers have been targeting Twitter users with direct messages or DMs that include a link. Twitter management has acknowledged the problem, and revealed in this morning’s blog post that 33 accounts were affected — see Monday Morning Madness for details.

The link that is sent in these phishing messages usually opens up a page that asks the targeted user to enter their Twitter username and password. Once the phisher captures the credentials, they login to the victim’s account, change the password and email address, and start sending out DMs to everyone on the victim’s contact list. The direct messages usually include a link that promises something valuable like a gas card or a gift card.

Twitter’s profile management system allows users to log in and change their email address without any confirmation step. So as long as someone has another user’s Twitter credentials, it’s very easy to hijack a twitter account. SO far, it appears that the following Twitter accounts are among those that were hijacked over the weekend:

Barack Obama
Britney Spears
CNN
Fox News Network
Facebook

Dozens of web sites have set up legitimate services that provide statistics, filters, photo sharing and other features for Twitter users. My tweets show up in my Facebook status message, and in my pages on FriendFeed. I didn’t have to give my Twitter password to FriendFeed, as that site is just reading the RSS feed of my Twitter posts. Twitter’s Facebook app needs my twitter username and password, however.

Almost all of these sites ask users to provide the Twitter username. Any 3rd party site that wants to post a message or tweet on the user’s behalf also asks for the user’s Twitter password, as that credential is required to post these tweets. There are plenty of examples, including

Tweetake.com, which lets users download and backup their messages and contact list.
Twitpics.com, which lets users post, tag and comment on pictures.
TwitTangle.com, which lets users rate and tag their Twitter contacts
PeopleBrowsr.com, which lets users view their Twitter messages and friends’ profiles.
TwitOrFit.com, which lets users vote on Twitter profile pictures.

I’m not surprised that this kind of attack has been so successful. Twitter users have been conditioned to provide to their twitter credentials to sites 3rd party sites. As Michael Arrington of TechCrunch pointed out today in his article called Twitter Gets Hacked, Badly, Twitter needs to do more work on its APIs and authentication systems.

Twitter is a tempting target, as users can only receive DMs from other Twitter users who have included them as a contact. Users tend to assume that a DM comes from a trusted user.

The simplest solution is for Twitter to send an email message to a user whenever their account information has been changed. The email message should include a link to review and confirm the changes. This would give the user an opportunity to stop an unauthorized email address change.

Twitter might consider using a multifactor authentication that requires the user to enter a PIN number received sent by Twitter through a text or email message. This kind of system has been used by OpenID providers like JanRain, as I mentioned on 13 May 2008 in my billso.com article called JanRain launches CallVerifID multifactor phone service for OpenID.

Twitter could also consider a security key like financial institutions use, to give Twitter users an additional password. See my billso.com article from 2 June 2008 called Paypal’s security key still needs work for more details.

Of course, multifactor authentication could get expensive for Twitter. The company is still privately funded, and a mutlifactor system would require changes to Twitter’s API, as well as changes to any third-party site that integrates with Twitter.

Last month, Pete Cashmore of Mashable suggested that Twitter add Facebook Connect as an authentication system. I added Facebook Connect as an authentication system for billso.com on Christmas Day 2008, by moving my comment management system to Disqus. billso.com still supports OpenID as an authentication method, too. See the article called Twitter, We Are Poking You To Fix Your Facebook App for more details.

There’s been little comment from Twitter’s founders on this issues, and only a few official blog posts that advise users to be cautious. Twitter also has a short message on its own web site reminding users to be careful. As Marshall Kirkpatrick of ReadWriteWeb points out in his article called Twitter security collapses, Twitter needs to solve these security problems quickly.