Mashable, The Washington Post, CNN and other Twitter users have all reported this morning that Twitter has asked them to reset their passwords. According to reports, security administrators at Twitter noticed “something fishy” and sent out emails to users whose accounts may have been compromised. Twitter administrators reportedly also changed the passwords on the affected accounts.
The email certainly looks like it came from Twitter.
Twitter Password Reset Email
Something is indeed “phishy” in all of this, since although it has been widely reported, Twitter itself has been unusually silent about this attack. In the past, Twitter is usually out in front whenever they’ve been hit with legitimate denial-of-service attacks or other threats.
However, CNN also reported today that Biz Stone, Twitter co-founder wrote in a January blog that certain sites may be trying to masquerade as Twitter. And he cautioned users to be very careful about clicking on links in emails. He also said that Twitter would proactively reset passwords, and that appears to be what they have done today.
So, what should you do if you receive a suspicious communication from Twitter? Here are a few tips.
- Check the official Twitter blog. Twitter is usually very quick to post information here.
- Check the Twitter status board. Again, Twitter is usually really good about posting information about service outages and problems. This is where you can keep track of this type of information
- Check which applications you have given permission to access your account. http://twitter.com/account/connections. If there are applications you do not recognize, revoke their access.
- If you are still having trouble accessing your account, contact @Twitter directly or contact their help desk. They are generally pretty responsive.
Above all . . . you have to be careful. If it looks like a phish, and smells like a phish . . . chances are it is!
We’ll update this blog post when we receive any additional information.