Twitter warns all users to change passwords after discovering internal bug

Happy World Password Day.

Happy World Password Day!

Twitter is asking all of its 330 million users to change their passwords “out of an abundance caution” after it discovered a bug that stored passwords in an unprotected manner.

“When you set a password for your Twitter account, we use technology that masks it so no one at the company can see it. We recently identified a bug that stored passwords unmasked in an internal log,” wrote Paraga Agrawal, Twitter’s chief technology officer, in a blog post on Thursday.

The cause of the issue doesn’t appear to be a hack. Twitter says that there’s no evidence of a breach or misuse of data.

Agrawal says that, in accordance with industry standards, Twitter hashes its passwords using the bcrypt method, by which passwords are replaced with a alphanumeric string. However, the internal bug caused the passwords to be stored in plain text on an internal log before the hashing process, the company says.

“We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again,” the CTO said.

The company is recommending that users change their passwords on Twitter as well as any other sites where they used the same password.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure