Skip to content
by
  • Products
  • Free Tools
  • Search
  • Free Sophos Home
XG Firewall
Next-Gen Firewall
Intercept X
Next-Gen Endpoint
  • Sophos Cloud Optix
  • Sophos Central
  • Sophos Mobile
  • Intercept X for Server
  • Secure Wi-Fi
  • Phish Threat
  • SafeGuard Encryption
  • Secure Email
  • SG UTM
  • Secure Web Gateway
For Home Users

Sophos Home protects every Mac and PC in your home

Learn More
Free Security Tools
Free Trials
Product Demos
Have you listened to our podcast? Listen now

Burger King dethroned in Presidents Day Twitter hack

18 Feb 2013 4 Twitter

Post navigation

Previous: BlackBerry warns of TIFF vulnerability that could allow malware to run on enterprise servers
Next: Jeremy Clarkson falls foul of bodyfat spammers on Twitter, vows to kill hackers
by Chester Wisniewski

BKMCD170It seems like it happens every holiday. A celebrity or major corporate brand loses control of its Twitter account.

Perhaps it is less than coincidental than that the king of burgers was compromised on the American holiday honoring her presidents.

Like other recent hacks, it appears to have been done more for the lulz than to cause anyone any lasting harm.

Whoever hamburgled the account began by modifying the graphics and account name to appear to be its arch rival McDonald’s.

burger king mcdonalds484

"Just got sold to McDonalds because the whopper flopped =[FREDOM IS FAILURE℠. In a hood near you"

The actual McDonald’s Twitter account was quick to reply:

BKMcDTweet484

"We empathize with our @BurgerKing counterparts. Rest assured, we had nothing to do with the hacking."

Some of the tweets sent out during the time it was under control of the attackers promoted a Chicago rapper named Chief Keef.

This just goes to show you can’t always trust an account simply because it is a verified. One person on Twitter made a joke concerning password security:

Whopper484

"Somebody needs to tell Burgerking that 'whopper123' isn't a secure password"

While that may be how this happened, if we look as past incidents it could also be from having too many cooks in the Twitter kitchen.

Many brands are using tools, like HootSuite and If This Then That, to allow multiple people to post to a Twitter feed without ever disclosing the password for the Twitter login.

While these tools are incredibly powerful, if not used properly they can dramatically increase the password attack surface.

Administrators have no visibility into the password strength of the sub-accounts used to post to its feed.

This is another example of why Twitter needs to introduce two factor authentication as soon as possible.

  • Follow @NakedSecurity on Twitter for the latest computer security news.

  • Follow @NakedSecurity on Instagram for exclusive pics, gifs, vids and LOLs!

Free tools

Sophos Firewall Home Edition

Boost your home network security.

Sophos Scan & Clean

Free second-opinion scanner for PCs.

Sophos Cloud Optix

Monitor 25 cloud assets for free.

Post navigation

Previous: BlackBerry warns of TIFF vulnerability that could allow malware to run on enterprise servers
Next: Jeremy Clarkson falls foul of bodyfat spammers on Twitter, vows to kill hackers

4 comments on “Burger King dethroned in Presidents Day Twitter hack”

  1. Adam says:
    February 19, 2013 at 8:56 am

    "Many brands are using tools like HootSuite and If This Then That to allow multiple people to post the a Twitter feed without disclosing the password for the Twitter login itself."

    Are these tools allowed to change the background and profile images too? I thought they only had permission to post tweets?

    Reply
  2. @tattooed_mummy says:
    February 19, 2013 at 2:41 pm

    Ahem 'one person on twitter'? I think you'll find I made the same joke! 🙂 also I wonder if McDonald's password is McPassword?

    Reply
  3. Grammer 5-0 says:
    February 19, 2013 at 3:05 pm

    to allow multiple people to post the a Twitter feed without ever disclosing the password for the Twitter login.

    Reply
    • Speller 6-0 says:
      February 19, 2013 at 11:19 pm

      Get the a life. And learn to spell (or use a spellchecker).

      Reply

Leave a Reply to Grammer 5-0 Cancel reply

Recommended reads

Feb08
by Paul Ducklin
7

OpenSSL fixes High Severity data-stealing bug – patch now!

Feb20
by Paul Ducklin
6

Twitter tells users: Pay up if you want to keep using insecure 2FA

Jan09
by Paul Ducklin
0

CircleCI – code-building service suffers total credential compromise

  • About Naked Security
  • About Sophos
  • Send us a tip
  • Cookies
  • Privacy
  • Legal
  • Intercept X
  • Intercept X for Server
  • Intercept X for Mobile
  • XG Firewall
  • Sophos Email
  • Sophos Wireless
  • Managed Threat Response
  • Cloud Optix
  • Phish Threat
© 1997 - 2023 Sophos Ltd. All rights reserved. Powered by WordPress VIP