Twitter support flaw possibly exploited by state-sponsored groups to access user data

guest · Dec 18, 2018

Twitter support flaw possibly exploited by state-sponsored groups to access user data
December 17, 2018
https://9to5mac.com/2018/12/17/twitter-security-flaw/

A recent bug with one of Twitter’s support forms has exposed user details such as phone number country code and whether accounts had been locked by Twitter. The company believes the flaw was likely used by state-sponsored actors to gain information about Twitter accounts.

As spotted by TechCrunch, Twitter posted details about the bug today on its Help Center: [...]
Twitter told TC that it reported the issue to the proper authorities including the FTC, the European Union’s Data Protection Commissioner, and affected users, but didn’t say how many accounts were impacted.

As for how Twitter discovered the bug and the source of the wave of “requests,” the company believes state-sponsored actors in China and Saudi Arabia may be involved.
Twitter ended the statement by letting users know they don’t need to take any further action and offered an apology.
Click to expand...

guest · Dec 18, 2018

Twitter warned of phone country code leak two years ago — but did nothing, security researcher says
December 18, 2018
https://techcrunch.com/2018/12/18/twitter-warned-country-code-form-leak-bug-security-researcher/

A security researcher found a bug in Twitter’s support form two years ago that exposed the country codes of phone numbers attached to user’s accounts. At the time, his bug report was closed as it did “not appear to present a significant security risk.”

Peerzada Fawaz Ahmad Qureshi reported the bug through HackerOne, which hosts Twitter’s bug reporting program, in the hope of a fix and a bounty payout, but the report was marked as “informative” and no action was taken.
But after the bug was triaged, it was determined that “while this may or may not be ideal behavior, we don’t consider the disclosure of a user’s country code to be sensitive information at this time.”

Little did the company know that the bug could have been later exploited by running a “large number of inquiries” in one go, as Twitter said in its Monday disclosure.
Click to expand...

Log in or Sign up

Twitter support flaw possibly exploited by state-sponsored groups to access user data

guest Guest

guest Guest

Log in or Sign up

Twitter support flaw possibly exploited by state-sponsored groups to access user data

guest Guest

guest Guest

Useful Searches