Twitter: Backdoor From Torrent Websites Used To Gain User Credentials

We now have word from Twitter as to what those phishing rumors were about that sprung up earlier today.

The company has just announced that the reason for the recent password shuffling stems from torrent related websites. The scammers are “creating torrent sites that require a login and password as well as creating forums set up for torrent site usage and then selling these purportedly well-crafted sites and forums to other people innocently looking to start a download site of their very own.”

Twitter goes on to say that despite appearances, “these sites came with a little extra — security exploits and backdoors throughout the system.”

That began the problem, with hundreds of people being asked to reset their password after their accounts were possibly compromised. Although I am not a member at any torrent related website, I was asked to reset my password.

A number of methods were employed across a variety of websites, including forums, to gain credentials to third-party websites such as Twitter. Twitter has yet to discover which websites are being utilized.

Every Twitter user should refresh their password tonight, something that we should do every few months anyway. Twitter is a large and growing social network, meaning that it will be under increasing fire from scammers and hackers. Go, change your password.

Any user of a website, such as a torrent forum, should take extra precaution. Websites that are on the edge of legality often attract seedy web characters — in a Wild West film these guys would be mean drunks with revolvers. It’s best to be extra cautious.

For now, Twitter will return to monitoring its ecosystem, prowling for the next spammer attack.

The full report from Twitter:

As part of our ongoing efforts to monitor our user base for odd activity, we noticed a sudden surge in followers for a couple accounts in the last five days. Given the circumstances surrounding this, we felt it was best to push out a password reset to accounts that were following these suspicious users.

Then we started doing some digging and, given what we found today, we felt it important to share this information. An outline of what appears to have happened follows …

Torrent sites aren’t exactly “new”; however, this is one of the first times that we’ve seen an attack that came from this vector. It appears that for a number of years, a person has been creating torrent sites that require a login and password as well as creating forums set up for torrent site usage and then selling these purportedly well-crafted sites and forums to other people innocently looking to start a download site of their very own. However, these sites came with a little extra — security exploits and backdoors throughout the system. This person then waited for the forums and sites to get popular and then used those exploits to get access to the username, email address, and password of every person who had signed up. Additional exploits to gain admin root on forums that weren’t created by this person also appear to have been utilized; in some instances, the exploit involved redirecting attempts to access the forums to another site that would request log-in information. This information was then used to attempt to gain access to third party sites like Twitter. We haven’t identified all of the forums involved (nor is it likely that we’ll be able to, since we don’t have any connection with them), but as a general rule, if you’ve signed up for a torrent forum or torrent site built by a third party, you should probably change your password there.

The takeaway from this is that people are continuing to use the same email address and password (or a variant) on multiple sites. Through our discussions with affected users, we’ve discovered a high correlation between folks who have used third party forums and download sites and folks who were on our list of possibly affected accounts. While not all users who were sent a password reset request fall into this category, we felt that it was important to put this knowledge out there so that users would know of the possibility of compromise of their data by a third party unrelated to their Twitter account. We strongly suggest that you use different passwords for each service you sign up for; more information on how to keep your Twitter account safe can be found here: http://twitter.zendesk.com/forums/10711/entries/76036.

Del Harvey
Director, Trust and Safety