Incident: Twitter Usernames and Passwords Hacked and Sold on Dark Web

Published Date: 2016-06-09

Postmortem Analysis
Timeline 1. The software failure incident of Twitter usernames and passwords being hacked and put up for sale on the dark web happened in June 2016. [Article 45025]
System 1. Twitter usernames and passwords were hacked due to malware attacks, leading to the compromise of 32,888,300 Twitter accounts [45025]. 2. Browsers like Google Chrome and Mozilla Firefox were exploited to retrieve passwords stored in them, contributing to the security breach [45025]. 3. The leaked passwords included weak and commonly used ones, such as '123456', 'password', 'qwerty', etc., indicating a failure in password security practices [45025]. 4. The incident highlighted the vulnerability of users who reused passwords across multiple sites, leading to potential account compromises [45025]. 5. The incident also revealed the failure of users to create strong and unique passwords, as many accounts had easily guessable passwords [45025].
Responsible Organization 1. Individual malware attackers were responsible for causing the software failure incident by hacking Twitter usernames and passwords [Article 45025].
Impacted Organization 1. Twitter users, with 32,888,300 usernames and passwords hacked and put up for sale on the dark web [45025] 2. Celebrities including Drake, Lana Del Ray, and Kylie Jenner who had their Twitter accounts hacked [45025] 3. Mark Zuckerberg, whose social media accounts were hacked by the Saudi-based group OurMine [45025] 4. The chief executive of tech support firm Zendesk, Mikkel Svane, who had his Twitter account hacked [45025]
Software Causes 1. Malware attacks targeting Twitter users' browsers, such as Google Chrome and Mozilla Firefox, to retrieve passwords stored in them [45025] 2. Use of weak and commonly used passwords by Twitter users, such as '123456', 'password', and 'qwerty', making it easier for hackers to access accounts [45025] 3. Leaked passwords from previous data breaches, like the LinkedIn password dump from 2012, being used to compromise accounts, including high-profile ones like Mark Zuckerberg's [45025]
Non-software Causes 1. Users falling victim to malware attacks that compromised their login credentials [45025] 2. Users having weak and easily guessable passwords, such as '123456', 'password', and 'qwerty' [45025] 3. Users reusing passwords across multiple sites, leading to security vulnerabilities [45025]
Impacts 1. 32,888,300 Twitter usernames and passwords were hacked and put up for sale on the dark web, potentially leading to compromised accounts and unauthorized access to personal information [Article 45025]. 2. The majority of hacked Twitter users seemed to be based in Russia, with a significant number of email addresses ending in '@mail.ru', indicating a widespread impact on users globally [Article 45025]. 3. Even users with long and seemingly secure passwords were affected, as 148,551 visible passwords were over 30 characters in length, highlighting the vulnerability of various types of passwords [Article 45025]. 4. High-profile figures and celebrities, including Mark Zuckerberg, Drake, Lana Del Ray, and Kylie Jenner, had their Twitter accounts hacked, leading to potential reputational damage and unauthorized use of their accounts [Article 45025]. 5. The incident prompted a reminder for users to be cautious about their online security, including changing passwords, avoiding common passwords, and using different passwords for different sites to enhance security measures [Article 45025].
Preventions 1. Implementing multi-factor authentication for user accounts could have prevented the software failure incident by adding an extra layer of security beyond just passwords [45025]. 2. Regularly updating and maintaining quality antivirus programs on devices could have helped prevent malware attacks that led to the leak of Twitter usernames and passwords [45025]. 3. Educating users on safe internet practices, such as being cautious with email attachments, avoiding suspicious websites, and using strong, unique passwords, could have reduced the risk of malware infections and unauthorized access to accounts [45025].
Fixes 1. Encouraging users to change their passwords regularly and use strong, unique passwords to prevent malware attacks like the one on Twitter [45025]. 2. Implementing multi-factor authentication to add an extra layer of security to user accounts [45025]. 3. Conducting regular security audits and checks to identify and address vulnerabilities in the system that could lead to data breaches [45025]. 4. Educating users on safe internet practices, such as avoiding suspicious websites and being cautious with email attachments, to prevent malware infections [45025]. 5. Collaborating with cybersecurity experts to enhance the overall security infrastructure and response mechanisms to potential threats [45025].
References 1. LeakedSource [Article 45025] 2. Twitter spokesperson [Article 45025] 3. Blog post by LeakedSource [Article 45025] 4. Twitter's security officer Michael Coates [Article 45025] 5. Facebook [Article 45025] 6. Netflix [Article 45025] 7. LinkedIn [Article 45025]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the hacking of Twitter usernames and passwords has happened again at one_organization. Mark Zuckerberg, the CEO of Facebook, had his Twitter account hacked by a Saudi-based group, OurMine, using the password 'dadada' which was found in a previous leak of LinkedIn passwords [Article 45025]. (b) The software failure incident related to the hacking of Twitter usernames and passwords has also happened at multiple_organization. Celebrities like Drake, Lana Del Ray, and Kylie Jenner had their Twitter accounts hacked, although it is not confirmed if their profiles were included in the 32 million leaked database. Additionally, the chief executive of tech support firm Zendesk had his Twitter account hacked as well [Article 45025].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the incident where Twitter usernames and passwords were hacked and put up for sale on the dark web. The details were obtained through individual malware attacks, likely through retrieving passwords stored in people's browsers like Google Chrome or Mozilla Firefox [45025]. (b) The software failure incident related to the operation phase can be observed in the same incident where Twitter usernames and passwords were compromised. The attacks were probably done through retrieving passwords stored in people's browsers, indicating a failure in the operation or misuse of the system by users who had their passwords saved in browsers [45025].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the Twitter hack was primarily due to factors originating from within the system. The incident involved individual malware attacks targeting users' browsers to retrieve saved usernames and passwords, which were then used to compromise Twitter accounts [45025]. (b) outside_system: On the other hand, the software failure incident was also influenced by factors originating from outside the system. The leaked login credentials, including 32,888,300 Twitter usernames and passwords, were put up for sale on the dark web, indicating an external breach that impacted the system [45025].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The Twitter usernames and passwords were hacked and put up for sale on the dark web, most likely obtained through individual malware attacks [45025]. - The attacks were probably done through retrieving passwords stored in people's browsers like Google Chrome or Mozilla Firefox, where malware sent every saved username and password back to the hackers from all websites including Twitter [45025]. (b) The software failure incident occurring due to human actions: - Users had weak passwords such as '123456', 'password', 'qwerty', etc., making it easier for hackers to access their accounts [45025]. - The leaked passwords were found to be in plaintext, a format that Twitter would be unlikely to store passwords in for security reasons, indicating potential human error in handling password security [45025].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The incident of Twitter usernames and passwords being hacked and put up for sale on the dark web was not due to a hardware failure but rather due to individual malware attacks targeting users' browsers to retrieve passwords stored there [45025]. (b) The software failure incident occurring due to software: - The software failure incident of Twitter usernames and passwords being hacked and put up for sale on the dark web was primarily due to malware attacks, which are a type of malicious software designed to gain access or damage a computer without the owner's knowledge [45025].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident related to the Twitter hack can be categorized as malicious. The incident involved a large-scale hack where 32,888,300 Twitter usernames and passwords were obtained through individual malware attacks, with the data being put up for sale on the dark web [45025]. The attack was not on the social media site itself but was likely done through retrieving passwords stored in people's browsers like Google Chrome or Mozilla Firefox [45025]. The hackers obtained sensitive information through malware, which is software specifically designed to gain access or damage a computer without the knowledge of the owner [45025]. (b) In addition to the malicious aspect, there were also non-malicious contributing factors to the software failure incident. For example, the incident revealed that some of the passwords stored in browsers were in plaintext, a format that Twitter would be unlikely to store passwords in for security reasons [45025]. Additionally, a significant number of users had passwords like '<blank>' and 'null,' which are often what browsers save if no password is entered [45025]. These non-malicious factors, such as weak password choices and storage practices, also contributed to the vulnerability exploited by the hackers.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The incident of Twitter usernames and passwords being hacked and put up for sale on the dark web was primarily due to poor decisions made by users in choosing weak and easily guessable passwords. The article highlighted that common passwords like '123456', 'password', and 'qwerty' were among the most frequently used passwords, making it easier for hackers to gain unauthorized access to accounts [45025]. Additionally, the incident involved the retrieval of passwords stored in people's browsers like Google Chrome or Mozilla Firefox, indicating a lack of proper password management practices by users [45025].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The incident of 32,888,300 Twitter usernames and passwords being hacked and put up for sale on the dark web was likely due to individual malware attacks rather than an attack on the social media site itself [45025]. - The passwords were probably obtained through retrieving passwords stored in people's browsers like Google Chrome or Mozilla Firefox, indicating a vulnerability in how passwords were stored and handled [45025]. - Some of the passwords found in the leaked database were in plaintext, a format that Twitter would be unlikely to store passwords in for security reasons, suggesting a lack of proper encryption or security measures in place [45025]. (b) The software failure incident occurring accidentally: - The incident of Twitter usernames and passwords being hacked was not a result of a direct breach of Twitter's systems but rather through malware attacks on users' browsers, indicating an accidental exposure of credentials due to users' actions [45025]. - The leaked passwords included common and weak choices like '123456' and 'password,' which could have been accidentally chosen by users without considering the security implications [45025]. - The incident highlights the need for users to be cautious and for companies like Twitter to educate users on password security practices to prevent accidental compromises [45025].
Duration permanent (a) The software failure incident in the articles is considered permanent. The incident involved a massive hack where 32,888,300 Twitter usernames and passwords were compromised and put up for sale on the dark web [45025]. The compromised data was obtained through individual malware attacks, likely targeting passwords stored in users' browsers like Google Chrome and Mozilla Firefox. The incident was not a result of a breach in Twitter's systems but rather due to malware infiltrating users' devices and stealing their login credentials. The compromised passwords included common and weak choices like '123456', 'password', and 'qwerty', indicating poor password security practices among users. Additionally, the incident affected a significant number of users, including high-profile individuals and celebrities, leading to the conclusion that the software failure was permanent and had lasting consequences.
Behaviour crash, omission, value, other (a) crash: The software failure incident related to the Twitter hack can be categorized as a crash. This is because the incident involved a large number of Twitter usernames and passwords being hacked and put up for sale on the dark web, leading to a loss of system state and the system not performing its intended functions [45025]. (b) omission: The software failure incident can also be categorized as an omission. This is because the incident involved the system omitting to perform its intended functions of protecting user credentials and preventing unauthorized access, resulting in the compromise of 32,888,300 Twitter usernames and passwords [45025]. (c) timing: The software failure incident is not related to timing issues. (d) value: The software failure incident can be categorized as a value failure. This is because the incident involved the system performing its intended functions incorrectly by allowing malware to retrieve passwords stored in users' browsers, leading to the compromise of user credentials [45025]. (e) byzantine: The software failure incident is not related to byzantine behavior. (f) other: The software failure incident can be categorized as a failure due to a security breach. This is because the incident involved a breach of user credentials, leading to unauthorized access and potential misuse of personal information [45025].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident involving the hacking of 32,888,300 Twitter usernames and passwords resulted in the compromise of users' personal information, including their login credentials [45025]. - The leaked Twitter usernames and passwords were put up for sale on the dark web, indicating a potential financial impact on the affected individuals [45025]. - The incident also highlighted the importance of using strong and unique passwords to protect personal data from being compromised [45025]. - Companies like Facebook and Netflix took proactive measures to scan through leaked login details to ensure their users' credentials were not at risk, indicating a concern for protecting users' data and accounts [45025].
Domain information, finance, other (a) The software failure incident reported in the articles is related to the information industry, specifically social media platforms like Twitter. The incident involved the hacking of 32,888,300 Twitter usernames and passwords, which were put up for sale on the dark web [Article 45025]. The compromised accounts included those of high-profile individuals and celebrities, indicating the impact on the information industry. (h) The incident also has implications for the finance industry, as it involves the security of user credentials that could potentially be linked to financial accounts. While the primary focus was on Twitter accounts, the compromised passwords could have broader implications for users who may reuse passwords across multiple platforms, including financial services [Article 45025]. (m) Additionally, the software failure incident can be categorized under the "other" industry, as it highlights the broader issue of cybersecurity and data breaches that transcend specific industry boundaries. The incident serves as a reminder of the importance of strong password practices and the risks associated with malware attacks targeting personal information across various sectors [Article 45025].

Sources

Back to List