1

I'm doing a security investigation for a friend of mine, working a bit of a Sherlock Holmes here... Trying to figure out a possible hack scenario for the following:

  1. My friend receives a "screw you and your Twitter profile" message on a vBulletin-powered message board, where no one know who she is.
  2. After a while she notices someone changed her profile picture on Twitter.

The message board does not use any Twitter oAuth connected accounts or anything similar, her forum username was some unreal "abracadabra" nonsense name, which is not "personally identifiable". Her forum profile is empty. The only real thing in the profile was - her email.

The only possible scenario that comes to my mind is:

  1. Someone used an exploit on vBulletin to get her real email address or otherwise accessed her account (via Brute force etc)

  2. Figured her Twitter account by email address (for instance, by generating a Gravatar picture out of email and then performing a Google search "by image")

  3. Used some well-known (in the underground circles) exploit for some Twitter "app" she had connected in her account.

Do you see any other possibilities?

PS. Too bad Twitter has no login audit...

PPS. I'm not searching for instructions "how can you hack someones' Twitter", I'm trying to find (based on the scenario), how can we secure her other data (if he hacked Twitter - who knows what else can be compromised).

PPPS. Some background info about the person to rule out the obvious: she' a software engineer and CEO of a small software shop, not your average "Nancy homemaker", she's on a mac (not windows), uses 2-factor on most account (gmail, amazon-aws etc, but not twitter), uses a pwd manager with 2-factor. Her forum pwd was really weak (6 letters), her Twitter pwd was kinda strong.

closed as primarily opinion-based by Jens Erat, schroeder, Steve, RoraΖ, Lucas Kauffman May 27 '15 at 12:30

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Either that or a real life friend is playing a prank – KingJohnno May 26 '15 at 21:32
  • 1
    "When you see hoof prints, think 'horses' not 'zebras'." The message on the bulletin board likely came after the attacker had access to her accounts. Don't look at Twitter - look at her email account. – schroeder May 26 '15 at 22:07
  • 1
    Your questions are all over the map. First, "Am I missing something?" referring to figuring out how the hack was pulled off, then you ask how to secure her other data and next steps. In your comment to LvB's answer, you are actually not looking to secure her Twitter, but wondering what other info can be compromised by a hacker that got into her Twitter and knows her email. Can you please state as clearly as possible what you are trying to accomplish? We've already got two answers about how to secure her Twitter, so we're unclear. – armani May 26 '15 at 22:11
  • 2
    @SergeShultz what if the attacker gained access to her email account first, discovered the message board and the Twitter account details from there? I think you may be making a large assumption as to the sequence of attacks. As we do not have any hard details, we too have to make assumptions, making this question impossible to answer definitively. – schroeder May 26 '15 at 22:33
  • 1
    Btw are we right in assuming there is no password reuse anywhere with her accounts? – LvB May 26 '15 at 22:36
3

I do not know of a way to retrieve who did this short of asking Twitter. As to prevention, demanding on availability you could tell your friend to enable 2 factor authentication This will make any login attempt more noticeable due to getting a sms.

More about security on Twitter you can find on Twitter Security Center


We can only guess what happened without twitters assistance. But a short list of possible attack vectors are

  • session hijacking / stealing
  • password / account guessing
  • xss attack

Most likely if she used a link on the forum it was a xss injection through a remote script.

Session hijack or stealing is likely if the forum itself was compromised (and added malicious scripts to the pages to enable this)

Password / Acount guessing is most likely in the other cases. (This includes brute force)

Not the answer you're looking for? Browse other questions tagged or ask your own question.