Twitter Tells News Organizations to Expect Even More Hacks in the Future
A little less than a week after a hacked Associated Press account reported a non-existent bombing at the White House, Twitter decided it was time to comfort journalists by warning them that they should expect to get hacked. "We believe that these attacks will continue, and that news and media organizations will continue to be high value targets to hackers," the company said in a memo sent to several news organzations on Monday evening and published by BuzzFeed. In the memo, Twitter offered up a whole host of anti-hacking techniques, including but not limited to not restricting access to the account, changing the password and designating a no-Internet, no-email computer as the go-to Twitter machine, so that employees don't unwittingly fall for a phishing attack. Because that makes sense.
RELATED: Twitter's Hashtag-Powered Comedy Festival Sounds Confusing
The dedicated computer trick actually does make sense — it just doesn't make good sense. Twitter's suggesting every news organization on the planet set up a special Twitter computer is a little bit bonkers. The rest of the suggestions are pretty standard things that all Internet users should be doing to protect their account, and even the somewhat salacious-sounding warning that hacks will happen is common sense for anybody who knows anything about cybersecurity. What it is not, however, is a display of confidence on Twitter's part that it has its ducks in a row when it comes to security.
RELATED: Lyme Disease, Bubonic Plague, and Chris Rock's Hat
This is not a new problem. Twitter's been failing to keep individual accounts secure for years. On September 13, 2011 — that exact date is significant for obvious reasons — hackers broke into NBC News's website and reported a terrorist attack in downtown Manhattan. It took longer to take down that tweet than it did the most recent instance of fake tweeted terrorism, but even then, Twitter pointed its finger at NBC News for not securing their account adequately, which is exactly what Twitter preemptively did to every news organization that received this latest memo. "Hacked?" the microblogging site might say. "You should've read that memo!"
RELATED: Baseball, Turkeys, and KillerThin Mints
Luckily, Twitter is actually doing something about its security problem. The company recently announced the imminent and long-awaited arrival of two-step verification, a common way to beef up security for web accounts. The company announced the new feature the same day as the AP hack. Good timing, right?
RELATED: Tornados, Perverts, and Time Travel
Read the full memo from Twitter:
RELATED: Russell Crowe Tweets His Way Into the Circumcision Debate
Please help us keep your accounts secure. There have been severalrecent incidents of high-profile news and media Twitter handles being compromised. We believe that these attacks will continue, and that news and media organizations will continue to be high value targets to hackers.
What to be aware of:
These incidents appear to be spear phishing attacks that target your corporate email. Promoting individual awareness of these attacks within your organization and following the security guidelines below is vital to preventing abuse of your Twitter accounts.
Take these steps right now:
Change your Twitter account passwords. Never send passwords via e-mail, even internally. Ensure that passwords are strong- at least 20 characters long. Use either randomly-generated passwords (like "LauH6maicaza1Neez3zi") or a random string of words (like "hewn cloths titles yachts refine").
Keep your email accounts secure. Twitter uses email for password resets and official communication. If your email provider supports two-factor authentication, enable it. Change your e-mail passwords, and use a password different from your Twitter account password.
Review your authorized applications. Log in to Twitter and review the applications authorized to access your accounts. If you don't recognize any of the applications, contact us immediately by emailing ______@twitter.com.
Help us protect you. We're working to make sure we have the most updated information on our partners' accounts. Please send us a complete list of all accounts affiliated with your organization, so that we can help keep them protected.
Build a plan. Create a formal incident response plan. If you suspect your organization is being targeted by a phishing campaign or has been compromised by a phishing attack, enact the plan.
Contact us immediately at ______@twitter.com with the word "Hacking" in the subject. Include copies of suspected phishing emails.
If you lose access to an account, file a Support ticket and email the ticket number to ______@twitter.com.
Moving Forward:
Review our security guidelines to help make sure your accounts are as secure as possible.
Talk with your security team about ensuring that your corporate email system is as safe as possible. A third-party provider that allows for two-factor authentication might be a safer solution.
Strong security practices will reduce your vulnerability to phishing. Consider the following suggestions:
Designate one computer to use for Twitter. This helps keep your Twitter password from being spread around. Don't use this computer to read email or surf the web, to reduce the chances of malware infection.
Minimize the number of people that have access. Even if you use a third-party platform to avoid sharing the actual Twitter account password, each of these people is a possible avenue for phishing or other compromise.
Check for signs of compromise. Checking your email address and authorized apps weekly or monthly can help detect unauthorized access and address the problem before access is abused.
Double-check the email address associated with your Twitter accounts: https://twitter.com/settings/account
Review the apps authorized to access your accounts: https://twitter.com/settings/applications
Change your password regularly. Changing your Twitter password quarterly or yearly can reset the clock if a password has leaked.
Using a Password Manager integrated into your browser can help prevent successful phishing attacks.
Third-party solutions such as 1Password or LastPass, as well as the browser's built-in password manager, will only auto-fill passwords on the correct website. If the password manager does not auto-fill, this might indicate a phishing attempt.
Password managers make it much easier to use a very strong password. Very difficult passwords will discourage memorization, which will greatly reduce the chances of being phished.
Be certain to set a master password, since otherwise passwords may be stored unprotected.
Don't hesitate to email us if you need assistance.
