CERT-In Advisory
CIAD-2022-0003
Securing Twitter Accounts
Original Issue Date: January 14, 2022
Overview
Twitter is an online micro blogging service used for distributing short messages among recipients. Twitter is used by prominent personalities like politicians, journalists, actors, musicians, company heads etc., to broadcast their work, ideas and interact with other users on the platform. Registered users can post, like, reply and rewet tweets, but unregistered users can only read those that are publicly available. Users interact with Twitter through browser or mobile frontend software or programmatically via its Application Programming Interface (API)s.
Description
In the recent past, scammers have hijacked Twitter accounts with a large number of followers using stolen credentials and tweeted scam links. Attackers can also disclose account information of Twitter users as part of hacktivist campaigns and upload email contents, Database dumps and other sensitive information through Twitter handles.
Best Practices to Secure Twitter Accounts
The following best practices are advised to secure Twitter accounts:
- Use Strong Account Specific Password - Create a long and strong password specifically for Twitter and ensure that this password is not used elsewhere. A strong password includes uppercase, lowercase, numbers, and symbols. A password management software may be used to safe keep all yourlogin information securely. A password should not contain personal information( phone number, date of birth etc.,), common dictionary words and sequences (1234, abcd, etc.).
- Use Two Factor Authentication - Two-factor authentication is an extra layer of security for a Twitter account. A security code or security key can be used in addition to a password to enhance the authentication security. A Twitter user can enable this feature in the Security settings. After this feature is enabled, a user will need a password, along with a secondary login method --- either a code, a login confirmation via an app or a physical security key to log in to the Twitter account.
- Beware of Phishing - Attackers will try to access private information using tweets, emails & direct messages on Twitter. Beware of suspicious links and always exercise caution while entering login information.
- Beware of Social Engineering Techniques - Never give username and password out to third parties, especially those promising to get followers or monetary benefits.
- Use Twitter on Secure Devices - Make sure that the twitter is accessed from secure devices ( Computer, Mobile phones, tablets etc.) updated with the most recent software upgrades and anti-virus software.
- Review Alerts From Twitter - When a user log in to Twitter account from a new device for the first time, Twitter will send a push notification or email to the user as an extra layer of security for the account. Any time the email address associated with the Twitter account is changed, Twitter will send notification to the previously-used email address on the account. In the event of account compromise, these alerts will help to take steps to regain control of the account.
- Use Third Party Applications With Caution - There are many third party applications which uses twitter account to log in. A user should be cautious before giving third-party applications access to their account. It is advisable to monitor the applications having access to the users twitter account. A user can revoke access for applications that they don't recognize ort hat are Tweeting on their behalf by visiting the Applications tab in the account settings.
References
CERT-In
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2016-0075
Twitter
https://help.twitter.com/en/safety-and-security/account-security-tips
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|