For quite awhile now, we have been following several stories related to the hacking of Twitter accounts. And this week, the newsfeed is inundated with information that the hackers have indeed struck again. And yet again, it’s the Syrian Electronic Army causing social media mischief.
While the Associated Press was a major victim of social media hacking a few months ago, this week the news is centered around Thomson Reuters, a multinational media company whose Twitter account was taken over Monday by the Syrian Electronic Army. This is the same group that has, in the past, been responsible for the hacking of high-profile websites such as CBS, NPR and Financial Times.
During the hack, tweets ranged from musings about the war in Syria to political cartoons. While the account has since been re-activated, it was suspended on Monday as a result of the incident. Currently, it remains unclear as to how the account was breached.
In May, Twitter unveiled a new two-factor authentication system designed to verify the identities of those who enter a password are actually authorized users; the authentication process was a specific measure taken by the social media giant to combat hacking and security breaches. Twitter declined, however, to say whether this extra method of protection was enabled at the time of the Thomson Reuter attack.
And while this authentication system was designed to help reduce the amount of accounts that are commandeered, the authentication system is merely an SMS-based system that can still be compromised.
Therefore, even if the system was enabled on Monday, the Thomson Reuters account might not have been secure enough to stop a group of well-equipped hackers. Criminals use multiple avenues to gain illegal access to an account — such as SQL injection and fake email portals that do not even contain malware, but can still be used to steal a user’s credentials, in addition to basic hacking.
While it remains unclear how the Thomson Reuters account was compromised, this type of problem typically arises from a lack of cohesive IP security on the part of independent companies. As long as sites continue to utilize basic username encryption and passwords, this type of attack is expected to continue. Companies should look to the seemingly endless string of account hacks as an indicator that the time has never been more important to focus on security as a whole — from mobile security to high stakes critical infrastructure protection solutions.