NNSquad - Network Neutrality Squad
[ NNSquad ] Confirmed: Twitter DNS diversion used Twitter login credentials
Now confirming [ Ref: http://www.nnsquad.org/archives/nnsquad/msg02460.html ] that the Twitter DNS diversion last night was the result of someone using Twitter's own login credentials to change DNS data at Dyn's site, according to Dyn's CTO: http://bit.ly/80Ve4Y (Wired) So as suspected, this was not a "sophisticated" attack (e.g., DNS cache poisoning) but rather a conventional login attack. It is interesting to consider that apparently a single username/password pair was able to take Twitter's entire Web site effectively offline globally. At the very least one would hope that more advanced account control mechanisms (e.g., certificate-based access authentication) would be employed with critical accounts for organizations at this level. --Lauren-- NNSquad Moderator