AP Twitter hack looks like a security tipping point
Two-step identity verification and analysis of user trends could prevent future attacks, experts say
IDG News Service - Getting hacked on Twitter is fast becoming a rite of passage for big corporations, but Tuesday's attack on the Associated Press could be a tipping point and shows that social networks must do more to keep their users safe, security experts said.
Wider use of two-factor authentication, which can involve an access code being sent to a user on a second device such as a smartphone, is one possible solution. Such a mechanism could be introduced selectively, some experts said, for high profile accounts such as celebrities and large corporations.
"Twitter needs to get on board and make two-factor authentication available ... as fast as possible," said Andrew Storms, director of security operations at nCircle Security.
The AP's Twitter account was hacked Tuesday morning, resulting in a bogus tweet reporting that there were "two explosions in the White House and Barack Obama is injured." A group calling itself the Syrian Electronic Army claimed responsibility, via their own Twitter account.
The tweet was only visible for a matter of minutes, but the Dow Jones industrial average took a nose dive immediately after it was posted before recovering several minutes later. Unlike some previous hacking incidents, "this one had a real-world impact on the markets," noted Steve Brunetto , director of product management at EdgeWave, a social media and email security company.
The AP joins a list of companies that have recently been hacked on Twitter. Three CBS brands -- 60 Minutes, 48 Hours and a Denver news affiliate -- were hijacked this past weekend. The New York Times, The Wall Street Journal and The Washington Post have also been hacked in recent months. In February, Twitter announced the site itself had been breached.
The Twitter accounts of Burger King and the Jeep car company have also been compromised. After those incidents, Twitter urged users to be smarter with their passwords and in how they use the site.
Twitter has remained largely quiet following Tuesday's AP attack. "We don't comment on individual accounts for privacy and security reasons," a spokesman said. But now may be the perfect time for the social network to employ stronger safeguards to prevent future account breaches, some experts said.
"Twitter needs to move faster in stepping up its cybersecurity efforts," EdgeWave's Brunetto said.
Mark Risher, CEO at Impermium, an Internet security firm based in Redwood City, California, said he thinks Twitter already takes security seriously, but Tuesday's attack does "elevate" concerns, he said.
One strategy would be for Twitter to implement a two-step authentication system. In one common implementation, when users log into the site from their laptop, Twitter would send them a passcode to a second device, such as their mobile phone. They would then need to enter that code as well as their login and password to access the site.
- Social Media in Technology: A Unified Strategy for Success Find out how social media is sparking a new era of customer and industry-understanding in technology enterprises and how industry leaders are overcoming...
- Big Data, Big Mess: Sound Risk Intelligence Through Complete Context This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Social Media White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!