Twitter Hacked, 250,000 User Accounts Potentially Compromised

Twitter disclosed on Friday evening that its systems had been attacked in the past week by an unidentified group of hackers. As a result of the the attack, the hackers may have had access to the usernames, email addresses and other sensitive information of nearly a quarter of a million twitter users.

“This week, we detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data. We discovered one live attack and were able to shut it down in process moments later,” the company said in a blog post. “However, our investigation has thus far indicated that the attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.”

On Friday evening, Twitter sent out emails to those users whose accounts may have been compromised, notifying them that the company had automatically reset their user passwords, and that they would need to create a new password in order to access the service again.

The hack comes on the heels of a week of major, nationally publicized security issues with a number of major publications, including The New York Times and The Wall Street Journal(which, disclosure, is owned by News Corp., ATD’s parent company). In their stories on the hacks, both publications made allegations that the attacks stemmed from their investigative reporting efforts covering Chinese officials, and that the Chinese government may be involved in some capacity.

But in Director of Security Bob Lord’s company blog post, Twitter makes no indication as to who was responsible for Twitter’s security breach, nor does Lord connect the hack directly to either the Journal’s or the Times’ incidents.

“The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked,” Lord wrote in his post.

As of Friday evening, Twitter has not disclosed, nor does not seem to know, who the group of hackers are.

Whether or not the attacks on the two media companies and Twitter are related, there is a major difference in the incidences: The disparate levels of in-house security each company has. The New York Times reported that the Symantec software it had installed on its systems had only detected one of the 45 major security intrusions over the last few months. And both the Times and the Journal went outside to third-party security consultants to assess the extent of their system breaches.

Twitter, however, employs a world-class in-house team of security researchers,well-versed in their ability to detect system vulnerabilities.

And Twitter has made no bones about carting out some of their highest profile hires in the operational security (OpSec) sector: Moxie Marlinspike, Bob Lord and Charlie White are highly respected in the OpSec community, all of whom head up the company’s security efforts. And in January of 2012, Twitter acquired Dasient, a security firm focused on Malware.

Jim Prosser, a Twitter spokesman, did not answer questions related to how the attack occurred, nor why only a set of 250,000 users were affected in the attack.

“We’re limited on the amount of information we can share at this time, given the nature of the attack and its potential scope in the genral internet community,” Prosser said.

But Ashkan Soltani, an independent security researcher, speculated that because Twitter was able to identify the users whose accounts may have been compromised, the scope of the breach may be somewhat limited.

EARTHQUAKE ALERT FORWARD PLZ

Plz forward this

An 8.7 magnitude earthquake struck off the coast of Indonesia on Wednesday, sending residents around the region dashing out of their homes and offices in fear.

A tsunami watch was issued for the whole Indian Ocean. The quake struck 308 miles (500 km) southwest of the city of Banda Aceh, on the northern tip of Indonesia's Sumatra island, at a depth of 20.5 miles (33 km), the U.S. Geological survey said.

Indonesia's disaster management agency said power was down in Aceh province and people were gathering on high ground as sirens warned of the danger.

"The electricity is down, there are traffic jams to access higher ground. Sirens and Koran recitals from mosques are everywhere," said Sutopo, spokesman for the agency.

The Pacific Tsunami Warning Center said a tsunami watch was in effect for the entire Indian Ocean.

The quake was felt as far away as the Thai capital, Bangkok, and in southern India, residents said. Hundreds of office workers in Bangalore left their buildings, workers there said.

The tremors were felt in Chennai and several other cities on the eastern coast. 

yours friendly

sundaravel.m

The quake was in roughly in the same area as a Dec 26, 2004, quake of 9.1 magnitude, which sent huge tsunami waves crashing into Sumatra, where 170,000 people were killed, and across the Indian Ocean.

In all, the 2004 tsunami killed about 230,000 people in 13 Indian Ocean countries, includingThailand, Sri Lanka and India.

The 2004 quake was at a depth of 18 miles (30 km) along a fault line running under the Indian Ocean, off western Indonesia and up into the Bay of Bengal.

Wednesday's quake was also felt in Sri Lanka, where office workers in the capital, Colombo, fled their offices, and the southern Thai holiday island of Phuket, both of which were hit hard by the 2004 tsunami.

Thai Meteorological Department deputy chief Somchai Baimoung said there was no tsunami warning yet in Thailand. Provincial officials along the Andaman Sea coast were preparing for evacuation if necessary.

In Bangladesh, where two tremors were felt, authorities also said there appeared to be no threat of a tsunami.

Hackers threaten to shut down Net

                     AP People use computers at an Internet cafe in Sydney.

 On Saturday, there is a strong possibility of Internet activities such as shopping and surfing coming to a halt as a hacking group has threatened to shut down the Net. 

“Operation Global Blackout 2012 looks to shut down the Internet for a whole day tomorrow (Saturday) by disabling its core DNS servers, making websites inaccessible,” said Interpol’s Secretary-General, Ronald K. Noble.

Mr. Noble was speaking at the thirteenth D.P. Kohli memorial lecture on “Multijurisdictional Investigation: Operation Unmask” in New Delhi.

According to Mr. Noble, the hacking group, Anonymous, is protesting against several reasons including the crash of Wall Street and irresponsible leaders.

first experimental proof of a quantum decoy technique to encrypt data

For governments and corporations in the business of transmitting sensitive data such as banking records or personal information over fibre optic cables, a new system demonstrated by University of Toronto scientists offers the protective equivalent of a fire-breathing dragon.

"Quantum cryptography is trying to make all transmissions secure, so this could be very useful for online banking, for example," says Professor Hoi-Kwong Lo, an expert in physics and electrical and computer engineering at U of T's Centre for Quantum Information and Quantum Control and the senior author of a new study about the technique. "The idea can be implemented now, because we actually did the experiment with a commercial device".

The study describes the first experimental proof of a quantum decoy technique to encrypt data over fibre optic cable. In quantum cryptography, laser light particles (photons) carry complex encryption keys through fibre optic cables, dramatically increasing the security of transmitted data. Conventional encryption is based on the assumed complexity of mathematical problems that traditional computers can solve. But quantum cryptography is based on fundamental laws of physics - specifically, Heisenberg's Uncertainty Principle, which tells us that merely observing a quantum object alters it.

The technique varies the intensity of photons and introduces photonic "decoys," which were transmitted over a 15-kilometre telecommunication fibre. After the signals are sent, a second broadcast tells the receiving computer which photons carried the signal and which were decoys. If a hacker tries to "eavesdrop" on the data stream to figure out the encryption key, the mere act of eavesdropping changes the decoys - a clear sign to the receiving computer that the data has been tampered with.