Twitter compromised by French hacker calling himself 'Hacker Croll'

News.com.au ^ | May 4, 2009

[Schnucki]

A FRENCH computer hacker is thought to have tapped into Twitter's internal system, gaining access to millions of accounts including that of US President Barack Obama.

The hacker, under the name "Hacker Croll", posted a series of screenshots showing him viewing internal website settings and the private details of user accounts.

The screenshots show Croll looking at the behind-the-scenes details for the account of US President Barack Obama, including the IP address of the last person to use it.

Twitter co-founder Biz Stone confirmed unauthorised access was gained by an outside party during the week, but said only 10 individual accounts were viewed.

Mr Stone did not reveal whose Twitter accounts had been hacked, but he assured Twitter users no account information was altered or removed.

All affected parties had been contacted and Twitter was conducting a independent security audit of its internal systems, he said.

According to a report on PC World, Croll gained access to the system by finding the password of a Twitter employee.

He allegedly boasted on an online forum of breaking into the Yahoo! email account of an employee and then finding the employee's Twitter password in an old email.

It is the second time Twitter has suffered a security breach this year.

In January another hacker gained access to a staff account by guessing the password.

The hacker then posted fake updates to a number of high-profile accounts including Britney Spears and Mr Obama.

[MAD-AS-HELL]

French Hacker? Looks like a crime to be solved by Inspector Clouseau!

[rarestia]

I can’t figure out the draw of social networking. I understand the purpose, but I can’t figure it out. I spent my younger days climbing trees, riding bikes, and playing hide-and-seek. I admit, I even dabbled in the MySpace thing prior to college graduation in 02, but this viral nature of the Internet’s latest powerhouses is mind-boggling.

I can’t understand how parents would let their pre-teens and teens post intimate details of their lives on the internet only to have them be hacked by some Chi-comm or, in this case, Frog, to lose their privacy.

It’s no wonder Obama wants to take our freedom: we’ve already given it up on the Internet!

[anymouse]

So some Twitter employee was stupid enough to send their Twitter password over Yahoo Webmail. That ain’t a hack of Twitter, it’s sloppy personal password security. That Twitter employee needs to be fired. Also Twitter needs to use some stronger internal account security requiring IP address and/or MAC checking, so an outside hacker can’t even login. Dongle or biometric keys might help too.

But then again Twitter doesn’t seem to be a serious enterprise, so not surprising that their employees are lazy on security.