Effortless computing

The details emerging from last week’s hack of Twitter’s corporate documents should worry anyone who uses web-based applications – GMail, Google Docs, Salesforce.com and so on.

TechCrunch has an in-depth account of the hack which is required reading if you’re using such services. Here’s their summary. ‘HC’ is Hacker Croll, a curious but not malicious – nor especially brilliant, worryingly – French geek:

1. HC accessed a Twitter employee’s personal Gmail account by using the Gmail password recovery feature that sends a reset link to a secondary email address. In this case the secondary email was an expired Hotmail account so he simply registered it, ran the password recovery, picked up the Gmail email in Hotmail, clicked the link in it and reset the Gmail password. Gmail was then owned.
2. HC then read the user’s emails in Gmail to find one confirming his registration with a new site and containing his email for that site; assuming correctly that the user used the same password for all his sites, HC now had his original Gmail password and reset it in Gmail so the user would not notice the account had changed.
3. HC then used the same password to access the employee’s corporate Google account, getting access to a gold mine of sensitive Twitter company information from emails and, particularly, email attachments.
4. HC then used this information along with additional password guesses and resets to take control of other Twitter employees’ personal and work emails.
5. HC then used the same username/password combinations and password reset features to access AT&T, MobileMe, Amazon and iTunes, among other services. A security hole in iTunes gave HC access to full credit card information in clear text. HC now also had control of Twitter’s domain names at GoDaddy.
6. Even at this point, Twitter had absolutely no idea they had been compromised.