How To Hack Twitter's Two-Factor Authentication 58
An anonymous reader writes with this excerpt from PC Mag's SecurityWatch: "We've pointed out some problems with Twitter's new two-factor authentication. For example, since just one phone number can be associated with an account, Twitter's two-factor authentication won't work for organizations like the Associated Press, The Onion, or The Guardian. They were hacked; they could still be hacked again in the same way. However, security experts indicate that the problem is worse than that, a lot worse."
Re: (Score:1)
Your comment has nothing to do with the person you're responding to. Did you just post that there hoping it would be seen so that you can score points? If so then why not just get an account?
worse problem? (Score:5, Insightful)
the problem is worse than that, a lot worse
Problem? Worse? This is twitter we're talking about right?
If sending an unencrypted email is like sending a postcard (kids, ask your parents) in pencil, twitter is like a sign you stick in your lawn.
Anyone can drive by and stick a sign in your lawn, make it look like you support any cause, or take any sign you've put out.
Now if people put undue weight to those signs, it they swing the markets, then the issue--the problem--is people who don't know the difference between reliable and unreliable sources.
The problem isn't twitter, it's employees in the media and so-called journalists who'd rather sit on their bum checking their cell phone than go out and do their job.
Thank you (Score:1)
Seriously who gives a fuck about twitter and who puts so much weight into what is said?
Re:Thank you (Score:5, Insightful)
As long as stock market bots and day traders use twitter activity to guide their behavior, I care.
Re: (Score:1)
or for there bots to be playing the market in the first place.
Re:Thank you (Score:5, Informative)
The U.S. stock market crashed momentarily on Tuesday afternoon after the Associated Press' Twitter account was hacked and a hoax tweet was sent out that suggested explosions at the White House had injured President Barack Obama. The Dow Jones Industrial Average dropped about 150 points in a matter of seconds
Re: (Score:1)
A greedy STUPID cocksucker
Re: (Score:1)
The same kind of fucking moron who has always done that kind of shit with the markets. A greedy cocksucker. The kind that cannot profit fast enough.
Well actually, the bots trading on the false twitter post could not lose money fast enough. They were the only ones quick enough to sell during the brief crash they created for themselves. The other bots that bought at the reduced rates where likely not following the twitter feeds.
Re: (Score:2)
Somebody who's making a hundred times your annual salary, most likely.
There are two ways to get rich in the stock market:
1) Invest in stocks that are undervalued, then wait ten years until everybody else has figured out they were undervalued, and hope that nothing bad happens in the mean time.
2) Make the same (often stupid) move that everybody else is going to make, but faster.
The twitter-following trading bots are using the second strategy.
Re: (Score:1)
And what fucking moron decided it would be good for their stock market bot to monitor twitter?
Its really very brilliant. If you know other bots are using twitter to make market bidding decisions, then your bot can use this knowledge to trick the other bots into doing your bidding. Its a bot eat bot world out there
Twitter + Gmail two-factor authentication (Score:2)
I don't know if this makes it more difficult or if i should hold out.
Re: (Score:3)
... or perhaps has a business, or works in an industry that uses Twitter frequently, or perhaps even friends.
Re: (Score:3)
Jobless AC wisdom.
Awesome.
Re: (Score:3)
Re: (Score:2)
Plus the smell of a musty basement and mom screaming down the stairs that dinner is ready.
It actually is a big deal (Score:5, Interesting)
The two-factor authentication is supposed to protect against a man-in-the-middle attack. The problem is that the verification response from the second factor goes back through the same already-compromised channel.
Imagine you're a sophisticated vilain in some backwater part of the world. You notice there's an AP reporter there doing some long-term investigative journalism, and said reporter likes to file his reports from a particular internet cafe.
You hack the cafe's wifi and somehow convince the reporter that his Twitter account has already been hacked -- say, by showing him a tweet in his name of something outrageous. The reporter, panicked, resets his account -- but does so through your fake Twitter authentication. You now capture both his password and the second factor sent through his text message; you now own his Twitter account.
And you now go ahead and actually send out some outrageous tweet as this particular reporter. Perhaps you pull off your attack while some very important person is visiting, and you report said person's assassination. You know this will crash the markets, and so you short all the proper stocks and make a killing...on the market.
Is it wise for people to have the trust they do in Twitter? Hell no. Do they have such trust anyway? Yes.
Which is why this is a big deal.
Cheers,
b&
Re: (Score:1)
Re: (Score:1)
The two-factor authentication is supposed to protect against a man-in-the-middle attack.
This is a fundamental misunderstanding of the security model. The attack you describe should be obvious to anyone who took any time to think about it. Two-factor authentication does nothing against man-in-the-middle attacks or phishing attacks, it prevents replay attacks. That is, to attack 2FA, you need to do the attack in real time and don't get another chance to use the credentials latter (unless, as you describe, the attacker is able to change the password, but I've never encountered a system attempting
Re: (Score:1)
Mod parent down, for not having a clue what s/he's talking about.
No, 2FA is not supposed to protect against MitM. Some versions of it might, but 2FA in and of itself isn't required to do that. It is only required that two factors of authentication be used:
* something you have
* something you know
* something you are
What 2FA *is* supposed to do is (a) provide greater assurance that a person is who they say they are, (b) make it harder to steal credentials, (c) make it easier to detect that credentials are st
Let's ask the IT guy on the movie "Hackers" (Score:1)
This cant be stopped. (Score:5, Insightful)
A similar solution works very well, no GPS (Score:4, Insightful)
I always post on Slashdot using a small Android phone in Bryan, TX, and my ISP is Suddenlink. I've posted on Slashdot hundreds, if not thousands of times. 20 minutes after I make this post from here in Bryan, if someone claiming to me tries to log in using an iphone in Canada, that's guaranteed to be bogus. That's a simple, obvious, and common example.
Now take that same general idea and apply fifteen years of R&D and real world experience. You can catch most unauthorized login attempts. If you do any late night surfing, on sites like GirlsGoneWild.com, you may have noticed half of those sites say "protected by Strongbox". They do that because it works.
Re: (Score:3)
> There's GPS and location by wif works well for desktops. IP address is
> the obvious solution. I believe google us also fingerprinting. IP address and fingerprinting
> would be just as effective without the location information.
IP without location isn't nearly as effective, especially with mobiles, but also with desktops. IPs change.
When you power cycle your cable modem
Re: (Score:1)
Single Factor is Best (Score:5, Funny)
Re: (Score:2)
3 factors are better!
Idiot proof security (Score:1)
"You can't make anything idiot proof because idiots are so ingenious"
TOTP would solve the parallel access problem (Score:5, Informative)
Instead of using some custom two-factor authentication which is bound to a specific phone, they should use TOTP (http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm). Then the same shared secret could be configured into several token generators (e.g. Google Authenticator on Android).
TOTP seems to become the standard for two-factor authentication, given that both Facebook and Google use this (Facebook provides its own limited code generator with their App) and also quite a few other significant services (e.g. Dropbox, Amazon AWS).
Google also provides a pam module for TOTP which allows one to setup TOTP for own services. I tried that yesterday: Installed the PAM module and added a key into Google Authenticator. Result: TOTP secured SSH login (by using normal account password with the token appended). TOTP support can also be added to non-PAM capable applications, for example a TOTP extension for Mediawiki exists. I tried that one as well and it is working great.
Google Authenticator App allows one to configure more than one account, so you can secure different services with TOTP and still have one central token generator App.
Hack fail. (Score:2)
It's the users fault for entering their credentials in a fake site. There should be SSL when you enter your password on twitter. That means there should be a verification icon in the URL bar with "Twitter, Inc [US]" on it.
Re: (Score:3)
these password stories again (Score:1)
No DID? (Score:2)
None of these organizations have direct inward dialing?
How far behind the times are they?