Torrent site users left vulnerable to Twitter attacks

Twitter users are once again under attack

Twitter has pushed out a password reset to a selection of users after two accounts experienced a suspicious surge in followers in the past five days.

Those forced to update their passwords are users who began following the suddenly very popular accounts.

Del Harvey, trust and safety director at Twitter, explained in a post on the Twitter Status blog that hackers had gained the password details to the affected accounts through torrent sites.

"Torrent sites are not exactly new, but this is one of the first times that we've seen an attack that came from this vector," he wrote.

Harvey mostly laid the blame on one individual, who he said had built a number of torrent sites and related forums that required a log-in and password. The individual had then sold the sites to unsuspecting buyers wanting to start download sites of their own.

When the sites began to get popular, Harvey said that the person had started using security exploits created before he sold the sites to get hold of their password details.

The person was then able to use the details to gain access to third-party sites like Twitter, because people often use the same passwords for multiple sites.

"We haven't identified all of the forums involved (nor is it likely that we'll be able to since we don't have any connection with them), but as a general rule, if you've signed up for a torrent forum or torrent site built by a third party, you should probably change your password there," Harvey said.

"The takeaway from this is that people are continuing to use the same email address and password (or a variant) on multiple sites. Through our discussions with affected users, we've discovered a high correlation between folks who have used third-party forums and download sites and folks who were on our list of possibly affected accounts."

Harvey's warning follows recent research by online security firm Trusteer which said that internet banking systems are often insecure because customers reuse passwords.

Trusteer monitored over four million computers for a year and found that 73 per cent of internet banking customers use the same password for their online banking services as they do for other, less secure, sites.