Twitter Settles with FTC Over ‘Happiness’ Breach

Twitter has agreed to implement a new security program and submit to a security audit from a third party as part of a settlement agreement with the Federal Trade Commission over breaches the micro-blogging service experienced in 2009 that put its customers’ privacy at risk.

One of the breaches allowed hackers to take over high-profile Twitter accounts, including then-President-Elect Barack Obama’s and the official feed for Fox News, and view personal information of the account holders as well as send out fake messages through the accounts.

Twitter will not have to pay a fine in the settlement, but the company is prohibited from “misleading consumers about the extent to which it maintains and protects the security, privacy and confidentiality of nonpublic consumer information, including the measures it takes to prevent authorized access to information and honor the privacy choices made by consumers.”

Twitter was breached in January 2009 after a teenage hacker obtained access to the administrative account of one of its employees. The employee had used a weak password — “happiness” — which the intruder easily discovered by using an automated password-guessing tool to crack it.

The hacker, who goes by the handle GMZ, told Threat Level at the time that cracking the password was easy because Twitter allowed an unlimited number of rapid-fire log-in attempts to be conducted on accounts.

Continue Reading “Twitter Settles with FTC Over ‘Happiness’ Breach” »