Twitter Too . . . For Hackers

Hackers are getting more creative in targeting certain companies and Twitter has recently discovered the consequences of such an attack. About a month ago, an administrative employee at twitter was targeted and her personal e-mail was hacked, according to a blog post today by Twitter co-founder Biz Stone. The hacker used information in the e-mail account to access this employee’s Google Apps account, which contained a wide variety of Twitter documents from ideas to financial details. Today TechCrunch said it had received 310 confidential Twitter documents in a zip file from the hacker who calls himself Hacker Croll.

In the last few years, security experts have seen an increase in the amount of highly-targeted attacks. Unlike, say, massive spam campaigns designed to get employees to divulge personal information like bank accounts, these types of attacks involve hackers targeting anywhere from one to five employees within a company. The motive is to steal confidential information that the hacker will use to make a profit, says Patrik Runald, chief security advisor at F-Secure, a security firm. The types of organizations frequently targeted in these attacks are defense contractors, governments and non-profits with ties to Tibet, he says.

Many times, as in the Twitter incident, the target of the attack involves employees who are not in the executive suite because those employees often have access to information hackers can use, whether it’s blueprints or large databases of customer information. For example, at defense contractor Northrop Grumman, hackers often try to target the computers of employees in the contracts department because of their knowledge of the marketplace, said Tim McKnight, chief information security officer at the company in a recent interview with BusinessWeek.

After the Twitter incident first became public, some speculated about the quality of Google’s security but Biz Stone absolved Google Apps in his blog post. “This attack had nothing to do with any vulnerability in Google Apps which we continue to use,” he wrote. Instead, he wrote, the incident underscored the need for choosing strong passwords.

The best passwords have more than 8 or 9 characters and are comprised of alphanumeric characters, a combination of letters and numbers, says John Pirc, a former cybersecurity specialist for the CIA and current executive with IBM Internet Security Systems. But really, he says, this is a people issue in that employees often don’t practice good password safety and may use the same password for many different applications.

Yet, the incident does underscore some risks involved with cloud computing in the enterprise. Some have called for better security mechanisms. “With the Twitter data, hackers were able to take a password and log on anonymously from anywhere,” says Rich Marcello, president of the systems and technology business at Unisys. Now Unisys is working on a higher level of security that would essentially cloak the data that comes into its cloud and only users within certain communities logging in from certain locations would be able to see the information. It’s akin to how only certain characters who are members of a specific group in Harry Potter are able to physically see the headquarters of the Order of the Phoenix. “If you can do that, even if there’s a password issue, there’s no way hackers can make any sense of the data,” says Marcello.

Companies also need to think about the kinds of information they’re putting in the cloud. While e-mail collaboration may be available over the Internet from reputable service providers with good track records in security, some applications are better left behind the firewall, says Dennis Quan, director of autonomic computing at IBM, who suggests private clouds for applications dealing with classified or confidential information.

“Part of the beauty of cloud computing is that users don’t need to understand the ins and outs of the technology they are using,” says Quan, adding, “This simplicity is great for consumers but can be dangerous for enterprises and governments.”

- From http://bit.ly/fFZ9i

---

---