منتديات احباب عرب  

العودة   منتديات احباب عرب > منتديات عربية > منتديات الجزائر > nigeria

Twitter Account Hijack Reveals Security Flaw

Twitter's defense against password crackers apparently needs some beefing up: a password cracker circumvented the site's CAPTCHA and timeout mechanisms simply by spoofing IP addresses. The cracker used a basic

إضافة رد
 
LinkBack أدوات الموضوع انواع عرض الموضوع
  #1  
قديم 10-04-2012, 03:01 AM
nigery غير متواجد حالياً
 
تاريخ التسجيل: Apr 2012
المشاركات: 4,567
معدل تقييم المستوى: 10
nigery is on a distinguished road
افتراضي Twitter Account Hijack Reveals Security Flaw

Twitter's defense against password crackers apparently needs some beefing up: a password cracker circumvented the site's CAPTCHA and timeout mechanisms simply by spoofing IP addresses.

The cracker used a basic program to repeatedly guess common passwords and broke into one user's account, changed his username and put his old handle up for auction on a username-trading site.

Daniel Dennis Jones, the victim of the attack, is a digital media guy with almost 800 followers. Jones said he got his desirable username, @blanket, when he signed up for the micro-blogging service early on. When he received an email saying his password had been reset, Jones became alarmed. Although he was still logged in on his phone, his tweet and follow counts had been reset. When he finally got back into his account, BuzzFeed reported, he discovered that his handle had been substituted with a rude obscenity and that @blanket was being controlled by someone else.

With a little bit of digging, Jones found that not only had his Account been hacked, but his username was for sale on ForumKorner, a site popular among online gamers who buy and sell handles. "I cracked these this morning," a member named Korea said in a post he called "Selling Twitters @Captain and @Blanket." Korea said someone had offered them $100 for the @captain username on another site and linked to both of the compromised accounts to prove he controlled them. The proof was in the form of matching avatars on the Twitter and ForumKorner profiles.

An unauthorized tweet to @hah led Jones to the discovery that a lot of the cracker's associates had single-word usernames, which raised the possibility that this group had found a crucial Flaw in Twitter's authentication system and was using it to steal desirable and short handles.

The design Flaw is a simple one: instead of locking out an Account after a number of failed login attempts, as Google does, Twitter locks out the IP address. This means all a user has to do to continue to attempt to log in is change computers – or, in this case, spoof an IP address.

Jones, who eventually had his Account reinstated, chronicled his misadventure on Storify. He admitted that his password was short and not particularly strong -- which was part of the problem -- but an easy-to-work-around defense against brute force attacks is also a great cause for concern. Jones said his conversations with Twitter and acquaintances of Twitter employees have not been encouraging. He described Twitter's support team as "intentionally opaque."

المواضيع المتشابهه:

رد مع اقتباس
إضافة رد


الذين يشاهدون محتوى الموضوع الآن : 1 ( الأعضاء 0 والزوار 1)
 
أدوات الموضوع
انواع عرض الموضوع

تعليمات المشاركة
لا تستطيع إضافة مواضيع جديدة
لا تستطيع الرد على المواضيع
لا تستطيع إرفاق ملفات
لا تستطيع تعديل مشاركاتك

BB code is متاحة
كود [IMG] متاحة
كود HTML معطلة
Trackbacks are متاحة
Pingbacks are متاحة
Refbacks are متاحة


Privacy Policy سياسة الخصوصية |

Sitemap

الساعة الآن 04:30 PM.


Powered by vBulletin™ Version 3.8.7
Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.
SEO by vBSEO