An editorial piece by Jaded Security on the July 4, 2011 @FoxNewsPolitics Twitter compromise and the broader question of credential security on verified media accounts.
Happy Fourth of July. Someone compromised the @FoxNewsPolitics Twitter account overnight and posted a series of tweets claiming President Obama had been shot and killed. The tweets stayed up for hours.
Let that sink in for a moment. A verified news-organisation Twitter account was used to broadcast a fake presidential assassination to over 30,000 followers. On Independence Day.
What happened
The tweets appeared between 2:00 and 6:00 AM Eastern. They claimed Obama had been shot at a Ross restaurant in Iowa, provided fake details about wounds and hospital status, and even announced a fake death. The account was not recovered until morning.
The group claiming responsibility called themselves The Script Kiddies, allegedly affiliated with Anonymous. Whether that affiliation was real or self-declared was anyone’s guess. In the current climate, everyone wants to be associated with Anonymous.
The real problem here
This is not about Fox News getting embarrassed. This is about the credibility infrastructure of social media as a news-distribution platform.
Twitter has become a primary news source for millions of people. When a verified account belonging to a major news network broadcasts a presidential assassination, people believe it. Some of those people act on it. Markets could move. Panic could spread. People could get hurt.
The security protecting that verified account? A password. That is it. A single password standing between a Twitter account and a national panic.
Lessons nobody will learn
- Every corporate social-media account needs multi-factor authentication. This was true before today and it will still be true tomorrow when everyone forgets about this.
- Social-media credentials should not be shared among teams via email or spreadsheet. They are shared via email or spreadsheet at virtually every organisation that does not actively police it.
- Incident-response plans need to include social-media compromise scenarios. Almost none do.
- The speed at which false information spreads on Twitter makes traditional “contact our PR team” response times dangerously inadequate.
Nobody will implement any of these recommendations. The industry will have this exact same conversation again within the year, with a different account and a different fake crisis.