jun 5, 2016 - Twitter: 32 Million users info leaked
Description:
http://www.zdnet.com/article/twitter-32-million-credentials-accounts-selling-online/
A hacker, who has links to the recent MySpace, LinkedIn, and Tumblr data breaches, is claiming another major tech scalp -- this time, it's said to be millions of Twitter accounts.
A Russian seller, who goes by the name Tessa88, claimed in an encrypted chat on Tuesday to have obtained the database, which includes email addresses (and sometimes two per person), usernames, and plain-text passwords.
Tessa88 is selling the cache for 10 bitcoins, or about $5,820 at the time of writing.
MORE SECURITY NEWS
Apple reported a spike in secret national security orders this year
Google warns that govt is demanding more of your private data than ever
Flawed Apple Mac firmware updates may leave them vulnerable to attack
EU ratchets up pressure on tech companies to curb 'illegal content'
The seller said they obtained 379 million accounts as early as 2015. That would be far more than its 310 million monthly active users, but could account for cumulative accounts, such as inactive users.
An analysis of the database by LeakedSource, a breach notification site which received the database from the seller on Wednesday, showed there are in fact over 32 million purported accounts in the database, after duplicates were removed.
LeakedSource said in a blog post that it was unlikely that Twitter was breached, and pointed to malware as the culprit.
"The explanation for this is that tens of millions of people have become infected by malware, and the malware sent every saved username and password from browsers like Chrome and Firefox back to the hackers from all websites including Twitter," the blog post said.
The group said it was able to verify the passwords associated with 15 users. LeakedSource shared a portion of the database with me. Two colleagues whose email addresses were in the database were able to verify their password. A third colleague said they had not used the email address found in the database to join Twitter.
LeakedSource said that the passwords were likely "stolen directly from consumers, therefore they are in plaintext with no encryption or hashing." The groups said it did not believe that Twitter stored data in plain-text at the time the data was taken, thought to be around 2014.
"These credentials however are real and valid," said the group. "The lesson here? It's not just companies that can be hacked, users need to be careful too."
As we've seen in recent data breaches, the most common password was "123456," with the third and fourth password being "qwerty" and "password" respectively.
A Twitter spokesperson said in prepared statement: "We are confident that these usernames and credentials were not obtained by a Twitter data breach -- our systems have not been breached. In fact, we've been working to help keep accounts protected by checking our data against what's been shared from recent other password leaks."
In a recent tweet, the company also said that it periodically checks its data against recent password leaks to ensure that accounts stay secure.
Given the high-profile Twitter account takeovers in recent days -- which included Facebook co-founder Mark Zuckerberg -- it would be an easy assumption to make that Twitter had been hacked.
But Zuckerberg's account was not in the database obtained by LeakedSource, the blog post said.
The hackers who took over Zuckerberg's account said at the time they acquired his "dadada" password from the LinkedIn breach.
When asked, a LinkedIn spokesperson declined to comment, pointed to a recently-updated company blog post, but ruled out any new breach, and advised users to change any re-used passwords on other sites.
Added to timeline:
Timeline of Cyber Security Incidents
Prepared by https://cybersecurity.wtf/
Date:
