Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

31–40 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#31

Post by hunter2_ »

londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

Rate limiting should be used to mitigate this, although I suppose a botnet could overcome that to some extent proportional to the size of the botnet.

And for anyone who didn't read TFA, this incident goes well beyond leaking what phone numbers use the product, it leaked the usernames associated with each as well.

Re: An incident impacting 5M accounts and private information on Twitter

#33

Post by NelsonMinar »

Isn't this the second or third time for Twitter to have this exact same flaw? From 2020: https://www.socialmediatoday.com/news/twitter-uncovers-secur...

I might be confused; this is a very old feature of Twitter that does have an opt out. Maybe this new disclosure is the opt out didn't work? https://help.twitter.com/en/safety-and-security/email-and-ph...

It's a different problem, but this year Twitter also got a $150M fine for illegally using the phone numbers they demand from users for marketing purposes. https://www.theverge.com/2022/5/25/23141968/ftc-doj-twitter-...

Re: An incident impacting 5M accounts and private information on Twitter

#34

Post by davchana »

colechristensen wrote: post #14
londons_explore wrote: post #13

Earlier quoted context omitted.

No mention of that fact that 'use another phone number' is quite an expensive thing to do in countries where a phone number has an annual fee of hundreds of dollars. Suddenly 'use twitter securely' has gone from 'free' to 'hundreds of dollars a year'. Perhaps they should announce this as a price change instead?

>countries where a phone number has an annual fee of hundreds of dollars. Is this a thing? I've never heard of it. Where?

In India, its not expensive at all, but every sim card is available only after you provide a copy of your national id card aka Aadhar Card.

Re: An incident impacting 5M accounts and private information on Twitter

#35

Post by hunter2_ »

addingnumbers wrote: post #17
bink wrote: post #2

> When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. > In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken adv…

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

I always wonder who "we" refers to in that usage, legally speaking. Does it refer only to a subset of employees / board members who are authorized to speak for the company? Because then even if someone analyzing logs sees something damning, if middle management is trained to stop that knowledge from reaching the top, then those speaking for the company can continue saying "we" didn't know it.

Re: An incident impacting 5M accounts and private information on Twitter

#36

Post by bluetidepro »

mromanuk wrote: post #7

Is there a way to know if your own account is compromised?

> We will be directly notifying the account owners we can confirm were affected by this issue. We are publishing this update because we aren’t able to confirm every account that was potentially impacted, and are particularly mindful of people with pseudonymous accounts who can be targeted by state or other actors.

So they may contact you, or may not. It would be nice if this gets added to something like haveibeenpwned

Re: An incident impacting 5M accounts and private information on Twitter

#37

Post by RL_Quine »

londons_explore wrote: post #13
some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

No mention of that fact that 'use another phone number' is quite an expensive thing to do in countries where a phone number has an annual fee of hundreds of dollars. Suddenly 'use twitter securely' has gone from 'free' to 'hundreds of dollars a year'. Perhaps they should announce this as a price change instead?

If you know the right providers it's about $2/month for a non-VOIP, physical SIM to receive SMS for this sort of garbage.

Re: An incident impacting 5M accounts and private information on Twitter

#38

Post by RL_Quine »

hunter2_ wrote: post #31
londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

Rate limiting should be used to mitigate this, although I suppose a botnet could overcome that to some extent proportional to the size of the botnet. And for anyone who didn't read TFA, this incident goes well beyond leaking what phone numbers use the product, it leaked the usernames associated with each as well.

Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.

Re: An incident impacting 5M accounts and private information on Twitter

#39

Post by HowardStark »

RL_Quine wrote: post #37
londons_explore wrote: post #13

Earlier quoted context omitted.

No mention of that fact that 'use another phone number' is quite an expensive thing to do in countries where a phone number has an annual fee of hundreds of dollars. Suddenly 'use twitter securely' has gone from 'free' to 'hundreds of dollars a year'. Perhaps they should announce this as a price change instead?

If you know the right providers it's about $2/month for a non-VOIP, physical SIM to receive SMS for this sort of garbage.

Would be super interested in hearing more about where you could find such a deal _with a physical SIM_. Seems far too good to be true.

Re: An incident impacting 5M accounts and private information on Twitter

#40

Post by trasz »

AlotOfReading wrote: post #26
colechristensen wrote: post #14

Earlier quoted context omitted.

>countries where a phone number has an annual fee of hundreds of dollars. Is this a thing? I've never heard of it. Where?

You need a plan to have a number because it's difficult/impossible to get a number allocated to you as an individual. If we assume "hundreds" means >=$200/year, then the maximum monthly payment we can have for that not to be true is $16/mo. The absolute cheapest phone plans I could find in the US that weren't for alarm systems were $15/mo on mvnos like mint. In practice, I suspect few people are paying less than $25-…

There are no prepaids? Which country do you have in mind?
Post reply on HN