Twitter was very busy last night resetting passwords and revoking cookies, following a serious security breach that may have leaked the account data of about 250,000 users.
"Last night, we detected some very unusual access patterns that led us to identify unauthorized access attempts to Twitter user data," said Bob Lord, Twitter's director of information security.
According to Lord, Twitter was able to fully shut down the breach attack within moments of discovering it, but not before the attackers were able to make off with what he calls "limited user information," including usernames, email addresses, session tokens, and encrypted passwords.
The encryption on such passwords is generally difficult to crack – but it's not impossible, particularly if the attacker is familiar with the algorithm used to encrypt them, suggesting that it may have been an inside job.
As a precaution, Lord says Twitter has reset the passwords of all 250,000 affected accounts – which, he observes, is just "a small percentage" of the more than 140 million Twitter users worldwide.
If yours is one of the accounts involved, you'll need to enter a new password the next time you login. Lord reminds all Twitter users to choose strong passwords – he recommends 10 or more characters, with a mix of letters, numbers, and symbols – because simpler passwords are easier to guess using brute-force methods.
In addition, he recommends against using the same password on multiple sites. Lord says Twitter's investigation is ongoing, and that it's taking the matter extremely seriously, particularly in light of recent attacks experienced by The New York Times and The Wall Street Journal.
"This attack wasn't the work of amateurs, and we do not believe it was an isolated incident. The attackers were extremely sophisticated, and we believe other companies and organizations have also been recently similarly attacked. For that reason we felt that it was important to publicize this attack while we still gather information, and we are helping government and federal law enforcement in their effort to find and prosecute these attackers to make the internet safer for all users," Lord added.
Although the attack took place last night, it seems to have no relationship to the outage that took Twitter offline for several hours on Thursday.
On the other hand however, Lord's revelations do make rather cryptic mention of the U.S. Department of Homeland Security's recent recommendation that users disable the Java plug-in in their browsers.
He mentions Java twice, in fact. While it's true that the Java plug-in contains multiple known vulnerabilities and that numerous security experts have warned that it should be considered unsafe, the connection between Java and the attack Twitter experienced isn't clear, and Twitter reps didn't respond to our request for clarification.
