digg

Facebook Connect Join Digg About

Report: Hacker broke into Twitter with help from Hotmail

computerworld.com — The hacker who stole confidential Twitter documents used a feature of Microsoft's Hotmail to hijack an employee's work e-mail account.

Who dugg this? Made popular Jul 20, 2009

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

54 Comments

show profanity settings
expand all
  • inactive, on 07/20/2009, -0/+33Wow using lameness to attack lameness, they just need some AOL in there somewhere.
  • thelastcivilian, on 07/20/2009, -2/+29Nice job Digg-baiting by blaming this fiasco on Microsoft/Hotmail. Sure, it played a part, but that part isn't headline-worthy. It's the user's fault for letting the account expire.
  • philosophiste, on 07/20/2009, -0/+26In other news, there are confidential Twitter documents.
  • waydee, on 07/20/2009, -3/+20***** Twitter.
  • Nitrodist88, on 07/20/2009, -0/+15Hacker Croll first jacked the personal Gmail account of a Twitter employee -- last week Stone identified the person as an administrative assistant with the company -- by resetting the account's password. To do that, Hacker Croll had to answer one or more personal questions used to authenticate the user.

    Pretty obvious if you ask me.
  • t0x2c, on 07/20/2009, -0/+10Also the main attack was through the gmail and the stupidity of answering personal questions for a password reset.
  • kanabiis, on 07/20/2009, -1/+10Twitter has worthless security. Anyone with a little time on their hands and the desire to do a little 'hacking' has found success.

    Yet many of you Diggers somehow defend Twitter like its your family. Its a ***** online service that can't seem to keep its doors locked, is financially in the dark without any real clue how to make any money. The 'stolen documents' that have been published read like a 10th grade brainstorming session at band camp. These 'executives' have college educations? They write like 10th grade drop outs.

    Twitter is the new Geocities........ it will be long forgotten in 5 years......
  • jkirk7msa, on 07/20/2009, -5/+14I don't consider this a hack...
  • iPwnN00bs, on 07/20/2009, -2/+11Social engineering != hacking.
  • NathanMahdavi, on 07/20/2009, -3/+11I love reading about social engineered hacks.
  • mizike, on 07/20/2009, -2/+10When in doubt, blame Microsoft.
  • Thorpe, on 07/20/2009, -1/+8Buried. Use better passwords and harder-to-guess secret questions.
  • psychotron, on 07/20/2009, -0/+7How can the attack be blamed on Hotmail by the headline when it all got started on a Gmail account?
  • inactive, on 07/20/2009, -0/+6I'm not so sure I'm willing to consider this 'hacking.' It's more like "they reset the account password using some informed guesses and dumb luck"
  • Hillsfar, on 07/20/2009, -0/+6These confidential Twitter documents have a limit of 140 characters. Because that's all a business needs, really.
  • noboot, on 07/20/2009, -0/+5I think most people will miss that Gmail was "broken" into as well.

    Hacker Croll first jacked the personal Gmail account of a Twitter employee -- last week ....

    Private email systems can be tweaked to not have a challenge question reset ... screw hosted solutions.
  • LANjackal, on 07/20/2009, -0/+5Buried for a stupid headline. It was actually *Gmail* that tipped the hacker about the Hotmail address. I wouldn't necessarily lay the blame on either email service though - the hacker was smart enough to use the system against itself.
  • DarkCloud515, on 07/20/2009, -0/+5You're all probably thinking of cracking as hacking. Go movies!
  • Hillsfar, on 07/20/2009, -0/+5The law typically comes down on the side of newspapers to be allowed to reveal secret information so long as they themselves did not do the dirty deed or pay someone to do the dirty deed.
  • SquareWheel, on 07/20/2009, -0/+4Keep us updated.
  • t0x2c, on 07/20/2009, -0/+4We can't let facebook find out our secret plan to limit status updates to 130 characters! A whole 10 characters less!
  • inactive, on 07/20/2009, -0/+4Because Google is the golden star child who can do no wrong and Microsoft is the wicked witch of the west who commits major atrocities merely by their continued existence.
  • eviljolly, on 07/20/2009, -3/+6Yeah this is far from a real hack.

    Article could be retitled "Dumbass Twitter employee with weak password gets owned by script kiddie"
  • adosoftinc, on 07/20/2009, -1/+4From article:
    [Last week, Masiello urged users to create stronger passwords -- a blend of alphanumeric and special characters, such as "#" and "&," for instance -- and use different passwords for each service or site. But he wasn't optimistic that his advice would hit home. "I think it's going to take a lot more than this incident to convince people," he said. "It just goes to show that even though we've been talking about strong and multiple passwords for years, people still haven't caught on."]

    Are you kidding me? Do they really think stronger password would have helped this case? lol
  • NathanMahdavi, on 07/20/2009, -0/+3Nice writing. You should have a blog.
  • FutureGuy, on 07/20/2009, -1/+4Someone somewhere got hacked? Digg: Lets just blame it on MS and move on.

    Read this if you really care to know what happened http://digg.com/tech_news/The_Anatomy_Of_The_Twitt ...
  • DaClub, on 07/20/2009, -2/+5Resetting a user's password and re-registering an expired hotmail account is not exactly "Hacking".
  • Rotzooi, on 07/20/2009, -0/+2In addition to Nitrodist88's comment; I read some articles that tell a slightly different story: apparently he found out that personal information by befriending this Crystal (?) on Twitter, Facebook etc to find out that personal information. Heh.
  • dingleberry, on 07/20/2009, -0/+2Obviously not since the account was expired.
  • cawble, on 07/20/2009, -2/+4People still use hotmail?
  • NathanMahdavi, on 07/20/2009, -1/+3Quite clearly it is.




    Just in case you don't believe me:
    Hacking: (computing) Unauthorized attempts to bypass the security mechanisms of an information system or network.




    Still don't believe me? http://en.wikipedia.org/wiki/Hacking_(computers)#S ...





    Yeah, thats what I thought.
  • FKnight, on 07/20/2009, -1/+3This is why I answer security questions like this:

    1. What was the name of your first pet? Bob Evans
    2. What street did you grow up on? The Thunder Road
    3. What is your father's middle name? James T. Kirk
  • NeoTechni, on 07/20/2009, -1/+2Social engineering != hacking.
  • NeoTechni, on 07/20/2009, -0/+1Social engineering != hacking.
  • t0x2c, on 07/20/2009, -2/+3Because they would only be protected under trade secret law, and by releasing them to the public, Hacker Croll made them not so secret. Basically, Tech Crunch is (or may be) in the clear because they weren't the one who violated the trade secrets act.

    He didn't steal physical documents, and Tech Crunch posted a -copy- of those documents, so normal property theft doesn't apply here. Christ, what are you the RIAA? Going to charge me with petty theft for downloading music? Sorry, nerd rage, I don't mean to take anything out on you.
  • themastersb, on 07/20/2009, -0/+1Did he died?
  • LiquidSpark, on 07/20/2009, -0/+1Exactly. I've learned not to expect anything other than drivel from computerworld.com. I dunno why I even clicked on the article.
  • NathanMahdavi, on 07/20/2009, -0/+1I thought that when reading peoples comments about how twitter "know what they're doing!", "who said they didn't have a clue?! here's proof they do" etc.

    They seem like they go to work and have nothing better to do that note down obvious things onto a piece of paper. Theres no business plan, just them saying "we will have 1 trillion users and we'll own the Internet". I hope the other documents that weren't released actually contain stuff worth going to work for.

    Shesh.
  • armageddonsavio, on 10/05/2009, -0/+1And When will twitter start using https (SSL)?
  • drewg203, on 07/20/2009, -0/+1Does Twitter realize they can set rules on their servers to force employees to have stronger passwords?
  • SquareWheel, on 07/20/2009, -0/+1Mine is:

    What is your password? shar...nevermind.
  • SquareWheel, on 07/20/2009, -0/+1Oh god, I hope that wasn't too soon.
  • SquareWheel, on 07/20/2009, -0/+1Now that Michael Jackson's gone.
  • rigotech, on 07/22/2009, -0/+1never use it

    http://www.rigotech.net/blog
  • FallenTurtles, on 07/20/2009, -0/+1It's a Unix system... I know this.
  • rigotech, on 07/22/2009, -0/+1yep

    http://www.rigotech.net/blog
  • Trader76, on 07/22/2009, -0/+1www.bluepointsecurity.com would not allow the hackers in..... very easy.
  • llbbl, on 07/20/2009, -2/+2Gmail > yahoo > live/hotmail
  • Fetching more discussions...
    Show 51 - 57 of 57 discussions

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...


© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.