Web site publishes hacked Twitter information

Technology news Web site TechCrunch published on Wednesday sensitive internal documents belonging to Twitter, including financial projections, offering a rare glimpse into the wildly popular microblogging site.

TechCrunch reported that a hacker had gained "easy access" to hundreds of pieces of internal Twitter information — from pass codes to meeting minutes — and then forwarded the data to the site en masse.

This marks the third time this year the popular San Francisco-based site was the victim of a security breach stemming from a simple end-run around its defenses: A hacker guessed the password for an employee's personal e-mail account and worked from there to steal confidential company documents.

Twitter, a social networking company that permits users to post tweets of 140 characters or less, has catapulted to prominence in past months, particularly after it was used by protesters in Iran following a disputed election there.

"We are in touch with our legal counsel about what this theft means for Twitter, the hacker and anyone who accepts and subsequently shares or publishes these stolen documents," Twitter said in an official blog post.

Dangers highlighted
The techniques used by the attackers to obtain access to Twitter highlight the dangers of a broader trend promoted by Google Inc. and others toward storing more data online, instead of on computers under your control.

The shift toward doing more over the Web — a practice known as "cloud computing" — means that mistakes employees make in their private lives can do serious damage to their employers, because a single e-mail account can tie the two worlds together.

Stealing the password for someone's Gmail account, for example, not only gives the hacker access to that person's personal e-mail, but also to any other Google applications they might use for work, like those used to create spreadsheets or presentations.

That's apparently what happened to Twitter, which shares confidential data within the company through the Google Apps package that incorporates e-mail, word processing, spreadsheet, calendar and other Google services for $50 per user per year.

Co-founder Biz Stone wrote in a blog posting Wednesday that the personal e-mail of an unnamed Twitter administrative employee was hacked about a month ago, and through that the attacker got access to the employee's Google Apps account.

Separately, the wife of co-founder Evan Williams also had her personal e-mail hacked around the same time, Stone wrote. Through that, the attacker got access to Williams' personal Amazon and PayPal accounts.