The micro-blogging site – Twitter, has released an update on the security breach that lead to the hacking of the Twitter accounts of notable personalities in the world.
According to a blog post made by Twitter on the steps Twitter is taking, the internet company believes the hackers had a targeted attack on certain Twitter employees, using a social engineering scheme. Twitter further explains social engineering to mean “the intentional manipulation of people into performing certain action, and divulging confidential information”.
The internet company said the hackers were able to download user data by going through their private messages. The downloaded data, according to Twitter, belongs to 8 accounts, and those accounts are not verified accounts. This means that the data belonging to the high-profile figures involved in the hack, were found to have not been downloaded.
The attackers, according to Twitter, were able to use the credentials of the targeted employees to access Twitter’s internal systems, and get through the two-factor protection feature.
The hackers were able to use the tools available to Twitter support teams to launch an attack on 130 Twitter accounts, and subsequently, gaining required access to initiate a password reset, login, and send out tweets through 45 of those 130 accounts.
While twitter continues to carry out further forensic analysis on the events that took place, it believes that some of the usernames that have been affected may be on their way to the market, for sale. In addition to this, the account information, and tweet history of the 8 unverified accounts that have been compromised, is believed to have been accessed and downloaded through the “Your Twitter Data”.
“Your Twitter Data” is a tool on twitter that give users a summary of their Twitter account details, and activities.
As soon as the security breach was detected, Twitter moved to lock down, and regain control of the accounts involved, and also revoked access to the internal security system, preventing the hackers from further accessing tools to push the hack.
The restrictions placed on the accounts prevented them from tweeting or changing passwords. The password of those accounts has then been changed under abundant caution, Twitter says.
Twitter claimed that for the 130 accounts that were targeted, the hackers were not able to view previous passwords, but were able to view user information – including email addresses, and phone numbers.
Twitter has taken steps to communicate directly with the holders of the compromised accounts, and claims that they are taking further steps to restore the all accounts that have been locked. This step is one of the many steps the micro-blogging site is taking, while ensuring that its security is heightened to prevent future attacks.