At lunch time I read a fantastic article on techcrunch written by Nik Cubrilovic titled The Anatomy of the Twitter Attack.
It outlines the steps taken by “Hacker Croll” to gain access to a whole lot of private information from Twitter including access to employees email and control over the Twitter.com domain name at godaddy.
The basis of the attack was gaining control over an employees gmail account using the password reset feature, the alternative email was a hotmail account that had expired so the hacker was able to recreate the hotmail account and reset the gmail password with it.
With access to the gmail account he was able to search emails to search for more passwords in the emails, he soon discovered that his victim used the same password across multiple sites and figured that was the original gmail password and changed it back. Now the attacker has access to the gmail and the victim is no wiser to it. He then used the same password again to access the victims twitter email account where he collected a goldmine of information.
The article is a great read and once again we learn from others mistakes, do not use the same password across multiple sites.comments powered by Disqus