Twitter bug on Android allowed researcher to match 17 million phone numbers with accounts

guest · Dec 24, 2019

Twitter bug on Android allowed researcher to match 17 million phone numbers with accounts
December 24, 2019
https://www.neowin.net/news/twitter...-match-17-million-phone-numbers-with-accounts

Twitter has not had the best of years when it comes to data security or privacy concerns. The firm has admitted to accidentally sharing location data of some iOS users with a partner back in May and apologized for using users’ personal information for advertising without their consent. Now, a security researcher, Ibrahim Balic, talking to TechCrunch, has revealed that the Twitter for Android app’s bug helped him match 17 million phone numbers to Twitter accounts.

The exploit of the bug is done through the contact upload feature in the app. The researcher adds that “If you upload your phone number, it fetches user data in return” and while the contact upload feature does not allow the upload of a sequential list of numbers to likely avoid misuse, randomized numbers could be uploaded to then retrieve account information matching the number.

The individual generated around two billion phone numbers in sequence over a period of two months, randomized them and uploaded them to the Twitter for Android app. However, Twitter blocked the researcher’s efforts on 20 December.
Click to expand...

TechCrunch: A Twitter app bug was used to match 17 million phone numbers to user accounts

In one case, TechCrunch was able to identify a senior Israeli politician using their matched phone number.
While he did not alert Twitter to the vulnerability, he took many of the phone numbers of high-profile Twitter users — including politicians and officials — to a WhatsApp group in an effort to warn users directly.
Click to expand...

mirimir · Dec 24, 2019

Hey, that's a "feature", not a "bug". Finding friends on Twitter, based on their phone numbers, I mean.

guest · Feb 3, 2020

Twitter suspends ‘large network’ of fake accounts used to match phone numbers to users
February 3, 2020
https://techcrunch.com/2020/02/03/t...ccounts-used-to-match-phone-numbers-to-users/

Twitter announced today that over the holidays it identified and shut down “a large network of fake accounts,” as well as many others “located in a wide range of countries,” collectively abusing a feature that let them match phone numbers to user accounts.

TechCrunch previously reported this same issue on December 24, which is also the day Twitter says that it “became aware” that the abuse was taking place. Security researcher Ibrahim Balic found that a bug in Twitter’s Android app let him submit millions of phone numbers through an official API, which returned any associated user account.

We recently discovered an issue that allowed bad actors to match a specific phone number with the corresponding accounts on Twitter. We quickly corrected this issue and are sorry this happened. You can learn more about our investigation here: https://t.co/Z6Q4geQ8jo
— Twitter Support (@TwitterSupport) February 3, 2020
Click to expand...

The feature is intended, if you have enabled it, to let friends who have your number look up your Twitter handle. But obviously submitting millions of numbers goes “beyond its intended use case.”
If you had turned this feature off, you weren’t affected by this bug.

“It is possible that some of these IP addresses may have ties to state-sponsored actors,” the post continued.
Click to expand...

Twitter: An Incident Impacting your Account Identity

Log in or Sign up

Twitter bug on Android allowed researcher to match 17 million phone numbers with accounts

guest Guest

mirimir Registered Member

guest Guest

Log in or Sign up

Twitter bug on Android allowed researcher to match 17 million phone numbers with accounts

guest Guest

mirimir Registered Member

guest Guest

Useful Searches