Hackers Can Break Into Your Accounts

How Hackers Can Break Into Your Accounts Without Your Password

And how to make sure it doesn't happen to you.

Think like a thief and secure every entry point into your home. From your front door to the doggy door, make sure everything is locked and shades are drawn. All outdoor gates should be secured, as access to a yard makes it easier for thieves to work undetected. Take window and sliding glass door security a step further by placing dowels in the tracks for extra security. Lock the interior door from the garage as another safe guard as garages can be easily compromised.

By Eric Limer

In the wee hours of Wednesday morning, a host of prominent Twitter accounts were compromised and, as a result, began spouting swastika-laden propaganda in support of Turkey's president Recep Erdoğan ahead of a referendum next month which could consolidate his power. So yeah: Now's a good time to check your own accounts and make sure you close the backdoor that let this happen to other people.

These professional and verified accounts, including Duke University, Forbes, and Amnesty Inernational, were likely protected by pretty robust security measures such as two-factor authentication and strong passwords. Those are important precautions, and ones you should take, too. But that wasn't enough because hackers have another way: app permissions.

If you've ever logged into an app or service by using your Google/Facebook/Twitter account in lieu of creating a new username and password, you've opened up the app permissions hole. This feature is fine and good—it lets you worry about fewer passwords and sometimes is necessary for apps that work directly with your other account. But it's also a security liability.

In the case of this recent hack, it was an app called "Twitter Counter" that appears to be at fault. Designed to give users analytics data on their accounts, the Twitter Counter app requests permission not just to see your data, but also to tweet. This isn't nefarious on its own, and could be used to let you tweet out things from inside the app. But if Twitter Counter is compromised (and it seems like it was), hackers could make use of that access to start tweeting heinous garbage.

The amount of access these sorts of apps have is always limited. They generally don't have the ability to change your password or the like; your Twitter/Facebook/Google account reserves that for itself. These apps also never get your real password. Your main account simply authorizes them using a generated "token."

If your main password is your house key, these app permissions are separate keys for your garage. The stakes are lower, but the more there are out there, the more likely one will fall into the wrong hands and someone will try to steal your car.

HOW TO TIGHTEN UP YOUR SECURITY

The solution? Revoke as many permissions as you can and do it every few months. Every account has a way to look through what apps have what sort of access to your account. Take a minute to run through the list and remove anything you don't use and anything you don't trust.

Twitter: Click on your avatar on the top right, next to the "Tweet" button, and select Settings and privacy. Look at the list on the left side, under your name and avatar, and click Apps. Click Revoke Access next to anything you don't want or need.

Google: Google makes it easy with the Security Checkup, which automatically runs through your app permissions, app specific passwords, connected devices, and other points of vulnerability for your account. Do it now and clean out all the cobwebs.

Facebook: Click on the question mark drop-down menu to the left of your notifications icon and select Privacy. Go to the left-hand rail and select Apps. Then click Show All at the bottom of the box marked Logged in with Facebook. With Facebook especially, plenty of these apps may have read-only access to your data, so they can look but not touch. Still, get rid of anything you don't use to make yourself as secure as possible.

Any other account that supports app integrations should have a similar list as well, and it is important to keep them pruned. There's no telling what little throwaway app might come back to bite you if its security isn't quite up to snuff, so be stingy with your access. You'll thank yourself.