A hacker known as the “Mauritania Attacker” recently claimed to have leaked a huge cache of Twitter account credentials on a file-sharing service called Zippyshare. Twitter has refuted this claim, saying that no user account details or passwords have been compromised. A spokesperson for the microblogging network said that they have investigated the situation and can confirm “no Twitter accounts were compromised.”
This isn’t exactly the first time that a hacker has attacked Twitter. Earlier this year a lot of high profile Twitter accounts, such as the Associated Press, Thomson Reuters and CBS News, were hijacked. Soon after those incidents Twitter implemented two-step authentication to increase account security. Security researchers believe that Twitter’s systems weren’t hacked by the “Mauritania Attacker.” Instead, it is believed that a third-party app caused a leak of nearly 15,000 account details. The hacker uploaded OAuth tokens online, which he claims can be used to directly log into user accounts. OAuth tokens are actually used to verify apps that connect to Twitter, they’re not enough to grant access to someone’s account. OAuth tokens once issued don’t expire, they have to be manually revoked. Those who would like to take a cautionary step as a result of this token leak can head over to their account settings and revoke rights of all third party apps. Granting them the rights again means that a new OAuth token would be issued, and users can continue to use their favorite third-party apps to access the microblogging network.
Filed in . Read more about Twitter.