An incident impacting 5M accounts and private information on Twitter
privacy.twitter.com
An incident impacting 5M accounts and private information on Twitter
1–10 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#2> When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability.
> In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken advantage of the issue before it was addressed.
Yikes. Sounds like they either didn't dig deep enough to see if it was exploited or they don't keep records long enough to be sure.
Re: An incident impacting 5M accounts and private information on Twitter
#3So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great.
But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it.
It was only when the press started to notice they finally disclosed the leak.
That isn't just one bug causing a security leak - it's a chain of bad decisions and bad security culture, and if anything should attract government fines for lax data security, this is it.
Re: An incident impacting 5M accounts and private information on Twitter
#4> When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. > In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken adv…
Probably the latter - all companies operating in the EU have had short (ie. 30 days) retention policies on anything user-identifiable (ie. http logs) for a while now.
But if they didn't keep sufficient logs, they should have alerted the users back then, not now.
Re: An incident impacting 5M accounts and private information on Twitter
#5I think you will see more of this class of attack.
Lots of companies have various 'forgot my username'/'forgot my password'/'trying to sign up for a new account with a new email address but existing phone number'/'add a friend by email or phone' flows. It's very easy to accidentally leak some info that shouldn't be leaked while implementing such a flow, since you are peering into the users database querying by email/phone/other identifier while the user hasn't properly authenticated yet.
Re: An incident impacting 5M accounts and private information on Twitter
#6>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account.
I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
Re: An incident impacting 5M accounts and private information on Twitter
#7Is there a way to know if your own account is compromised?
Re: An incident impacting 5M accounts and private information on Twitter
#8> In January 2022, we received a report through our bug bounty program
> This bug resulted from an update to our code in June 2021
Does this mean the problem existed for 7 months and nobody at Twitter noticed until they received a bug report?
Re: An incident impacting 5M accounts and private information on Twitter
#9>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
The company entity requires blaming others. It can't blame itself, otherwise stakeholder value is affected. If you want to blame anyone, blame the environment that allows these types of actions by companies, or simply stop using them.
BTW, no Twitter account is "ours". If it was, we could download everything (friends and all) and move it somewhere else. Twitter needs to take ownership of all data on their platform - user accounts included. Trying to separate them into different entities is ridiculous.
Re: An incident impacting 5M accounts and private information on Twitter
#10Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable.
Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.