TechCrunch has a riveting account of how Twitter’s security was compromised. It’s a salutary tale of how an ecosystem of Web 2.0 services contains holes that an astute and tireless attacker can exploit. The Summary reads:

1. HC [Hacker Croll, the culprit] accessed Gmail for a Twitter employee by using the password recovery feature that sends a reset link to a secondary email. In this case the secondary email was an expired Hotmail account, he simply registered it, clicked the link and reset the password. Gmail was then owned.

2. HC then read emails to guess what the original Gmail password was successfully and reset the password so the Twitter employee would not notice the account had changed.

3. HC then used the same password to access the employee’s Twitter email on Google Apps for your domain, getting access to a gold mine of sensitive company information from emails and, particularly, email attachments.

4. HC then used this information along with additional password guesses and resets to take control of other Twitter employee personal and work emails.

5. HC then used the same username/password combinations and password reset features to access AT&T, MobileMe, Amazon and iTunes, among other services. A security hole in iTunes gave HC access to full credit card information in clear text.

6. Even at this point, Twitter had absolutely no idea they had been compromised.

What could have happened next is that Hacker Croll could have used or sold this information for profit. He didn’t do that, and says he never intended to. All he wanted to do, he says, was to highlight the weaknesses in Twitter’s data security policies and get them and other startups to consider more robust security measures.

It’s made me think hard about the approach I take to granting access to Web 2.0 services.

In a word, yes.

In research to be presented at the IEEE Symposium on Security and Privacy this week, researchers from Microsoft and Carnegie Mellon University plan to show that the secret questions used to secure the password-reset functions of a variety of websites are woefully insecure. In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study’s participants could guess the correct answers to the participant’s secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.

“Secret questions alone are not as secure as we would like our backup authentication to be,” says Stuart Schechter, a researcher with software giant Microsoft and one of the authors of the paper. "Nor are they reliable enough that their use alone is sufficient to ensure users can recover their accounts when they forget their passwords.”

The least-secure questions are simple ones whose answers can be guessed with no existing knowledge of the subject, the researchers say. For example, the answers to the questions “What is your favorite town?” and “What is your favorite sports team?” were relatively easy for participants to guess. All told, 30 percent and 57 percent of the correct answers, respectively, appeared in the top-five list of guesses.

Hooray! According to BBC NEWS,

The government is dropping plans to hold secret inquests without juries, Justice Secretary Jack Straw has said.

In a Commons written statement, Mr Straw said the move did not command the necessary cross-party support, despite earlier government concessions.

It was included in the Coroners and Justice Bill earlier this year to cover cases involving sensitive information.

Civil liberties groups who feared cases like that of Jean Charles de Menezes would be affected, welcomed the move.

The government had argued that in some cases inquests should be held in private for national security, crime prevention or diplomatic reasons.

Here’s a sobering way to start the new year — precautions you can/should take to minimise the risk of having your cards cloned or your bank account ripped off. By Saar Drinen of the Cambridge Computer Lab’s Security Group.

People often ask me what can they do to prevent themselves from being victims of card fraud when they pay with their cards at shops or use them in ATMs for on-line card fraud tips see e-victims.org, for example. My short answer is usually “not much, except checking your statements and reporting anomalies to the bank”. This post is the longer answer — little practical things, some a bit over the top, I admit — that cardholders can do to decrease the risk of falling victim to card fraud. Some of these will only apply to UK issued cards, some to all smartcards, and the rest applies to all types of cards.

Sobering because I’ve realised that I don’t take many of the precautions recommended.

Thanks to Charles Arthur for the link.