Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I have been seeing in the news recently that Twitter (including Wall Street Journal and New York Times) got hacked by a sophisticated hacker (group), but I would have assumed they would have incredible security in place.

So far, my solutions contain methods that:

  • Login via SSL only
  • Token NONCE Tokens (preventing token hijacking)
  • Locking down DB access to only authorized clients (web servers)
  • SQL Injection Protection
  • XSS Protection
  • Protect the passwords by hashing with a Salt and Pepper
  • CSRF tokens
  • Site Code Signing (using RSA/DSA)
  • All Servers only accessible with Private Key's

So, is there any information on how it was done, so that I could build safeguards into my software to prevent similar things happening to my sites?

share|improve this question
Do you have a link to the particular breaches you are talking about? Typically, the details of a breach are not publicly revealed or are quite possibly not even well understood by the victim. As for ways to avoid being compromised, you listed a bunch of decent steps that can be taken, but that's really too broad of a question to fit in a QA format since it effectively asks "How do you do security?" and the answer to that doesn't even fit in a collection of books. – AJ Henderson Feb 13 at 16:17
1  
Who says these attacks were sophisticated? I mean Sony said the Playstation Network attacks were also sophisticated and that actually came down to an old vulerable linux kernel. – Ramhound Feb 13 at 16:47
Sadly, several newspaper articles – cgoddard Feb 13 at 16:59
I know its a very vague question, but it was more of a question of where to find the information on how they where hacked. But i thought it would be something along those lines – cgoddard Feb 13 at 16:59
They alluded to the recent Java 0day being an issue in the attack (blog.twitter.com/2013/02/keeping-our-users-secure.html) If this is true, then it was an internal breach on a machine that had DB access. While it's cute you're coming up with solutions to fix Twitter's problems, I don't think any of the issues described above are part of the problem they encountered. – g3k Feb 13 at 19:12

closed as not a real question by Iszi, AJ Henderson, Lucas Kauffman, Jeff Ferland♦ Feb 14 at 21:33

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 0 down vote

Its easy to say that you have security measures in place, it is very difficult to prove that these methods are sufficient. Large companies like the Wall Street Journal and Twitter will respond to a compromise by commissioning a Penetration Test. This is where the rubber meets the road, you hire a hacker to test your system against attack. This can be though of as a type of QA, but its as real as it gets.

Also obligatory the OWASP top 10 is just a start. Logging in over SSL is totally meaningless if you spill the session id over HTTP (Firesheep). This is covered in OWASP a9.

The CWE-2000 database is much more comprehensive than the OWASP top 10.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.