Robert Siciliano explains how Twitter hacks like the Associated Press breach can cause market panic and financial damage. He recommends enabling two-factor authentication, using unique passwords for each service, and avoiding credential reuse across email, social, and financial accounts.
Chapters
Thanks, Gene.
Hashtag uh-oh. Coming up, how you can avoid getting hacked. The new measures Twitter is taking to make sure your account is protected. Welcome back. You know, more and more people are tweeting. With that comes more opportunities for hackers to find ways to compromise your personal information. We just told you the other day that Twitter has a new optional login process involving text messages to prevent fraud. But will that be enough? Joining us from our Beacon Hill studio is Robert Siciliano, who is an identity theft expert and McAfee consultant. Thanks for joining us.
Good morning.
You know, Robert, in the past, one of the dangers about tweeting was, you know, I'm away on vacation and that opens me up to actual physical theft of my property. Telling people where you are and effectively telling them where you won't be. This is a new kind of theft. Tell me about the steps that Twitter is taking to protect your virtual property.
Sure. So at this point, Twitter has been hacked and decimated by criminal hackers from all over the world. Often trying to make a statement by taking over existing accounts and tweeting inaccuracies, stuff that is blasphemous, inappropriate. And so now Twitter realized that the password itself needs to be updated and upgraded, and they're using what's called two-factor authentication, which essentially means that you have two factors, something that you have, which is your password, and something you know, again, being a password or username. And now it's a text message that you receive, which is an additional code that you plug in to further authenticate you so the bad guys can't just take over your simple username and password.
You know, it is kind of a pain because it's a lot of steps there, but I have to ask you because I know that you protect yourself so fully, is this something that you would do on Twitter?
It's something that I'm doing, absolutely. So once your account is taken over, a few things can happen, uh, that cause problems. Either accounts that you might be connected to via your Twitter that have some financials, some credit card information, could be taken over and used to make fraudulent purchases, or Again, you know, tweets could be sent out that are wrong or inappropriate. Like when the Associated Press was hacked, they said that the White House had been bombed and that Obama was hurt, and it immediately caused the stock market to drop significantly, which was a huge problem at the time.
You know, I can certainly understand, especially businesses, why they want to be careful about what's being tweeted out under their account, but I'm even more concerned about something that you mentioned just a moment ago, the fact that if you get in through Twitter, you could be connected to all sorts of information that could actually drain your bank account. Is that why some of these social media sites are such targets for hackers?
Well, more and more, um, uh, commercial sites, e-commerce sites, are connecting with Twitter and Facebook and others. And so yes, credit card information in some way, shape, or form is connected. Uh, but when you see— and certainly that is a motivation for the bad guy, uh, but, um, when you see, you know, like the AP hack, and Jeep, and Burger King, and many others— 60 Minutes, when, when organizations like that are hacked and inappropriate tweets are being sent out or with the wrong information and it's causing drops in the stock market equating to millions to potentially billions of dollars, then you see the actual weight in gravity that Twitter has. That means that it really needs to be protected like an online bank account or a credit card account.
What's your best piece of advice? I mean, should people not be connecting— individuals, not, not companies necessarily— but should they not be connecting Twitter to Facebook to their Gmail account?
The most important thing really is to make sure that your password is not the same on your Twitter as it is on your email account or any other account. You should have a different password for every single account, so use a password manager of some kind. Beyond that, it is good to use the two-factor that Twitter offers you because any additional layer of protection is another layer to prevent the bad guy from getting in.
Some good advice there, Robert Siciliano. We appreciate it.
