Another Social Media Day, Another Twitter Hack

There’s a saying in journalism: report the news, don’t be the news.

Unfortunately today the Associated Press (AP) ran afoul of that rule by having their Twitter account hijacked.

In good journalistic fashion, they’re telling their own story quickly and with as much facts as possible. It sounds that they saw a phishing attack against their network just before the account was hijacked. While they don’t connect the two, it’s certainly a possibility that this is how the attackers got control of AP’s credentials.

Once the attackers had control, they used it to send a bogus tweet out claiming there had been explosions at the White House that injured President Barack Obama. Proving that social media and twitter hacking has real-world consequences, the Dow Jones average dropped 143 points on the news (but later recovered). The account and other AP accounts have been suspended while AP works with Twitter to verify they have control of the accounts.

This isn’t the first time we’ve seen news organizations’ online presences hijacked. And this certainly isn’t the first time that we’ve seen a Twitter handle hijacked. Unfortunately, unlike other platforms like Facebook and Google, Twitter still hasn’t implemented two factor authentication. Until Twitter implements that, you can continue to expect to see high profile accounts be hijacked with some regularity.

In the meantime, if you manage a Twitter handle, this underscores the importance of using a strong password, running up-to-date security software, not clicking on links, and being very, very cautious when working with Twitter credentials. To know more about password security, we have posted several blog entries about the difficulty and importance of the password here and here.

And as always, we’ll update if any new information becomes available.

We’re trying to make the Security Intelligence Blog better. Please click here to take a survey and give us your feedback on how we can make things better.