My Saturday morning was all set - breakfast and biz at Zingerman's (@ZingBakehouse)... Until I did the routine sleepy-eyed check of my Blackberry email. Thanks to a detailed heads-up from David Bloom (@factotem) I now knew that the cereal survey I completed almost two weeks ago wasn't just a one-time or two-time issue - my Twitter account had truly been hacked. Dang.
The true bummer was that I thought I had already fixed it, because I changed my Twitter password yesterday when I suspected something was up. But David got a spammy DM from me this morning, AFTER I changed the password. Not good.
However, I think I've got it fixed (for real this time), and I'll tell you what to do in case this happens to you - but before that, perhaps you can learn something from my mistake so you can avoid this situation altogether.
I'm reasonably careful about the stuff about the stuff I retweet - it comes from a source I trust one way or another. This case was a proverbial perfect storm that served as a nice little wake-up call for me.
This all started with a DM from a guy at Kellogg (or an impersonator - I may never know). Because we've worked with Kellogg and because the group we worked with was so impressive, I'd be glad to help them out however I can. (Honestly, I wouldn't have dreamed in a million years that the ecommerce division for a cereal company would be so innovative. I am in awe.)
Anyway, I didn't know the particular guy who sent me the tweet, but the profile looked real, and he was following me, so everything seemed to check out. The cereal survey he sent me included Frosted Flakes, and I since I believe Tony the Tiger is the coolest cereal mascot of all time, I'll vote for him, no problem. I'll even click the "ShareThis" (@ShareThis) button because I consider ShareThis a trusted a source, and never dreamed the next message I would see would be "Congratulations! All your followers have been notified!" (or something along those lines). Stomach pang #1.
Went to dm the guy that sent me the survey to ask him if he had the same problem, etc. and he no longer following me. Stomach pang #2.
However, no use crying over spilt milk at that point. The damage was already done. Surely it was a one- time thing. I posted an apology to my Twitter and figured that was the end of it, except for a string of entertaining updates about the favorite cereal preferences of my followers. A few followers told me they thought I had been hacked, but like I said, I figured it was a one-time thing and the cereal emails soon stopped.
A week later, I got another string of replies. Stomach pang #3 - they must be CONTINUING to spam my followers. Yikes. Better do something. Changed my Twitter password, figured all was well. The email from David Bloom brought stomach pang #4. I figured wrong.
Thank goodness Twitter had a nice little help page about how to fix a hacked Twitter account (http://bit.ly/XLvL4). Here’s the part that hadn’t dawned on me: I needed to change my password in OTHER Twitter applications, too.
Now the fact that TweetDeck (@TweetDeck) hadn’t been working yesterday, and that the API looked oddly pegged out made sense. I had just used CoTweet (@CoTweet) instead because there wasn’t time to contemplate the issue. Stomach pain #5. Why didn’t that dawn on me? Sigh…
So I changed my Twitter password, and tried logging back in. I got another message that I had been locked out of my account for too many login attempts. No stomach pains this time, though. That’s progress!
It’s not a fair comparison, but I thought of Linda Anger celebrating her hair falling out from chemo (http://bit.ly/1wXN5a), because that’s how she knew the treatments were working. In this case, I figured I was making progress, because someone was trying to get into my account and couldn’t – and I knew from the Twitter help pages that they shut accounts down for just an hour when this happens, so I wouldn’t have to wait long.
Tried an hour later to log in again – the account was still locked down. Tiny stomach pain #6 – what happens if they don’t stop trying to log in? How will I get back into my account? I’ll just hope it works next time I try…
It’s now almost 4 pm (how did that happen?!) and I’m back in my account. Got some stuff accomplished at Zingerman’s, but my coffee date will tell you I was terribly distracted by this mess. I’m just glad it’s over. I hope…
(P.S. I’m curious – CoTweet didn’t seem to be impacted by this, while TweetDeck was – does that mean that it’s important to use applications like CoTweet that use OAuth that securely manage API authorizations???)