Topic: After GMZ, Hacker Croll also Broke Into Twitter (with ScreenShots)

[Samker]

For the second time this year, a hacker claims to have gained administrative access to a Twitter employee's account.

On Wednesday, an anonymous hacker going by the name of Hacker Croll posted 13 screenshots to a French online discussion forum, apparently captured while logged into the Twitter account of Jason Goldman, a director of product management with Twitter.

According to the screenshots, Hacker Croll was able to access account information belonging to high-profile Twitter users such as Britney Spears and Ashton Kutcher. The hacker could also do things such as add or remove featured users, who are suggested to new Twitter members when they sign up.

ScreenShots (click to enlarge):

Twitter did not respond to messages seeking comment for this story.

Hacker Croll claimed to have accessed Goldman's Twitter password by first gaining access to his Yahoo account. "One of the admins has a yahoo account, i've reset the password by answering to the secret question. Then, in the mailbox, i have found her [sic] twitter password," Hacker Croll said Wednesday in a posting to an online discussion forum. "I've used social engineering only, no exploit, no xss vulnerability, no backdoor, np sql injection."

On Monday, Goldman sent a Twitter message saying that his Yahoo mail account had been hacked.

Twitter has had a rash of security problems this year.

In January, another hacker going by the name of GMZ said he was able to gain access to an administrative account by guessing the password of a Twitter support staffer. The password was reportedly an easy-to-guess word: happiness.

GMZ then used that access to take control of 33 high-profile accounts, including those for Spears, U.S. President Barack Obama and Fox News.

Twitter has also been hit with several fast-spreading worm attacks this year that preyed on Web programming flaws on the site.

Although Twitter CEO Biz Stone promised a "full security review of all access points to Twitter" after the January incident, the site's security is "very weak," according to Manuel Dorne, the French blogger and IT project manager who first published news of the most recent Twitter hack.

Anyone who tries to log into admin.twitter.com is given a login prompt, and since Twitter user names are already public, attackers have only to guess the password. That could have been what happened with Goldman's account, Dorne said. "Maybe the password was the name of his child or of his wife and the hacker knew it."

(PCW)