John
07-20-2009, 07:18 AM
Twitter has fallen victim to a determined hacker. Skip related content
The hacker got the password for an employee's personal email account - possibly by guessing, or by correctly answering a security question - and worked from there to steal confidential company documents.
The methods used by the attackers highlight the dangers of a broader trend promoted by Google and others toward storing more data online, instead of on computers under your control.
The shift towards doing more over the internet - a practice known as "cloud computing" - which means mistakes that employees make in their private lives can do serious damage to their employers, because a single email account can tie the two worlds together.
Stealing the password for someone's Gmail account, for example, not only gives the hacker access to that person's personal email, but also to any other Google applications they might use for work, like those used to create spreadsheets or presentations.
That's apparently what happened to Twitter, which shares confidential data within the company through the Google Apps package that incorporates email, word processing, spreadsheet, calendar and other Google services for $50 (£30.5) per user per year.
Co-founder Biz Stone wrote in a blog post on Wednesday that the personal email of an unnamed Twitter administrative employee was hacked about a month ago, and through that the attacker got access to the employee's Google Apps account.
Separately, the wife of co-founder Evan Williams also had her personal email hacked around the same time, Mr Stone wrote. Through that, the attacker got access to Williams' personal Amazon and PayPal accounts.
Mr Stone said the attacks are "about Twitter being in enough of a spotlight that folks who work here can become targets".
Some of the material the hacker posted online from the Google Apps documents was more embarrassing than damaging, like floor plans for new office space and a pitch for a TV show about the increasingly popular online messaging service.
The hacker got the password for an employee's personal email account - possibly by guessing, or by correctly answering a security question - and worked from there to steal confidential company documents.
The methods used by the attackers highlight the dangers of a broader trend promoted by Google and others toward storing more data online, instead of on computers under your control.
The shift towards doing more over the internet - a practice known as "cloud computing" - which means mistakes that employees make in their private lives can do serious damage to their employers, because a single email account can tie the two worlds together.
Stealing the password for someone's Gmail account, for example, not only gives the hacker access to that person's personal email, but also to any other Google applications they might use for work, like those used to create spreadsheets or presentations.
That's apparently what happened to Twitter, which shares confidential data within the company through the Google Apps package that incorporates email, word processing, spreadsheet, calendar and other Google services for $50 (£30.5) per user per year.
Co-founder Biz Stone wrote in a blog post on Wednesday that the personal email of an unnamed Twitter administrative employee was hacked about a month ago, and through that the attacker got access to the employee's Google Apps account.
Separately, the wife of co-founder Evan Williams also had her personal email hacked around the same time, Mr Stone wrote. Through that, the attacker got access to Williams' personal Amazon and PayPal accounts.
Mr Stone said the attacks are "about Twitter being in enough of a spotlight that folks who work here can become targets".
Some of the material the hacker posted online from the Google Apps documents was more embarrassing than damaging, like floor plans for new office space and a pitch for a TV show about the increasingly popular online messaging service.