6 ms·

Twitter for Android Security Vulnerability

48 points by mayakacz 6y ago

EE84M3i 6y ago
Strangely, I got a notification for this on twitter.com on Win 10 Chrome and it said "you are no longer using a vulnerable version of Anrdoid on this device".[1] I do use Twitter for Android on my phone, so maybe they sent the notifications to anyone using it but they forgot it could be displayed in the web interface too. I find the "Our understanding" language strange. Presumably this number comes from some kind of metrics, but it seems like a bit of CYA language? Still, appreciate the heads up for something they AFAIK didn't have any obligation to give a notification for. [1] https://i.imgur.com/8dJ9Eq3.png https://i.imgur.com/8dJ9Eq3.png
- cjbprime 6y ago
  I got it on my Mac laptop. I have an Android phone, but it's running Android 10, which isn't vulnerable. I wonder what the actual vulnerability was. The article links to an entire bulletin of fixes.
- dijit 6y ago
  I got this notification on my iOS device, I have never used twitter on Android. I think they just sent it out to everyone.
ISL 6y ago
If only old hardware/phones could get OS security updates by any mechanism. I have a growing drawer of old hardware that is perfectly functional but no longer updateable.
- Jonnax 6y ago
  Likely with locked bootloaders as well! There needs to be a law that states that once a company stops supporting s device they must release the keys to allow users to modify their devices themselves.
- seniorivn 6y ago
  postmarketos is for that
anonu 6y ago
identified October 2018 fixed August 2020 Good job Twitter https://source.android.com/security/bulletin/2018-10-01 https://source.android.com/security/bulletin/2018-10-01
- Jonnax 6y ago
  The security patch from Google is from October 2018 it looks like. So Twitter is to blame for not coding a mitigation for vulnerable devices? Or is it the phone manufacturer's fault for not releasing security patches for their phones?
- j_walter 6y ago
  As if we needed additional evidence that Twitter doesn't take their security as seriously as they should.
JoshTriplett 6y ago
Better yet: don't install the Twitter app, and instead use m.twitter.com, which works perfectly and stays entirely within the browser's sandbox as it should. You can have a separate icon for that as though it were an app, and if you really want to, you can enable push notifications just as you could with an app.
- agency 6y ago
  My experience is that the web app does not work perfectly. In fact I get an endless spinner >50% of the time and lord help me if I try to open a comment thread.
  - JoshTriplett 6y ago
    I've never seen that, even on very large threads. (Using it in Firefox for Android here.)
  - jaynetics 6y ago
    No kidding! I rarely look at Twitter, but if I do, in 50% of cases I have to refresh the page to get any content to show. I thought I was the only one.
  - jjice 6y ago
    Agreed. I rarely use Twitter anymore, but when I do, I use the mobile site, and it's awful in my experience. My phone is about 1.5 years old, but I don't think a website should struggle to load on a somewhat old phone.
    - jfkebwjsbx 6y ago
      A 1.5 years old phone is not "somewhat old"... if anything, it is pretty new. In many countries, it is not even out of warranty! Yes, some people change phones every year, but that does not mean the device itself is old just because you change it.
- tgsovlerkhgsel 6y ago
  I'm often getting some form of "you're rate limited", "not allowed to perform this action" etc. until I hard-reload the full page. Given that others have reported it, and it's been there for a long time, I suspect Twitter at the very least intentionally doesn't put too much resources behind the web site to force people to use the app. Of course, if a service really wants to push an app onto me, it's clear that the app gives them some real benefits, and its usually the kind that aren't a benefit for me (more tracking, better ways to push ads, more "engagement" notifications, ...). So the harder something wants to push an app, the clearer it is that I never, ever want their app to touch my device.
ufmace 6y ago
They're awfully vague about exactly what the vulnerability was and what could exploit it. I thought the sandboxing between apps would be quite solid and well-tested. Did that break somehow, or did the Twitter app have some kind of insecure API for other apps to interface with the local Twitter app?
moonbug 6y ago
I got this alert and have never installed any Twitter app.

48 points by mayakacz 6y ago

Strangely, I got a notification for this on twitter.com on Win 10 Chrome and it said "you are no longer using a vulnerable version of Anrdoid on this device".[1] I do use Twitter for Android on my phone, so maybe they sent the notifications to anyone using it but they forgot it could be displayed in the web interface too. I find the "Our understanding" language strange. Presumably this number comes from some kind of metrics, but it seems like a bit of CYA language? Still, appreciate the heads up for something they AFAIK didn't have any obligation to give a notification for. [1] https://i.imgur.com/8dJ9Eq3.png https://i.imgur.com/8dJ9Eq3.png

cjbprime 6y ago
I got it on my Mac laptop. I have an Android phone, but it's running Android 10, which isn't vulnerable. I wonder what the actual vulnerability was. The article links to an entire bulletin of fixes.
dijit 6y ago
I got this notification on my iOS device, I have never used twitter on Android. I think they just sent it out to everyone.

ISL 6y ago

If only old hardware/phones could get OS security updates by any mechanism. I have a growing drawer of old hardware that is perfectly functional but no longer updateable.

Jonnax 6y ago
Likely with locked bootloaders as well! There needs to be a law that states that once a company stops supporting s device they must release the keys to allow users to modify their devices themselves.
seniorivn 6y ago
postmarketos is for that

anonu 6y ago

identified October 2018 fixed August 2020 Good job Twitter https://source.android.com/security/bulletin/2018-10-01 https://source.android.com/security/bulletin/2018-10-01

Jonnax 6y ago
The security patch from Google is from October 2018 it looks like. So Twitter is to blame for not coding a mitigation for vulnerable devices? Or is it the phone manufacturer's fault for not releasing security patches for their phones?
j_walter 6y ago
As if we needed additional evidence that Twitter doesn't take their security as seriously as they should.

JoshTriplett 6y ago

Better yet: don't install the Twitter app, and instead use m.twitter.com, which works perfectly and stays entirely within the browser's sandbox as it should. You can have a separate icon for that as though it were an app, and if you really want to, you can enable push notifications just as you could with an app.

agency 6y ago
My experience is that the web app does not work perfectly. In fact I get an endless spinner >50% of the time and lord help me if I try to open a comment thread.
- JoshTriplett 6y ago
  I've never seen that, even on very large threads. (Using it in Firefox for Android here.)
- jaynetics 6y ago
  No kidding! I rarely look at Twitter, but if I do, in 50% of cases I have to refresh the page to get any content to show. I thought I was the only one.
- jjice 6y ago
  Agreed. I rarely use Twitter anymore, but when I do, I use the mobile site, and it's awful in my experience. My phone is about 1.5 years old, but I don't think a website should struggle to load on a somewhat old phone.
  - jfkebwjsbx 6y ago
    A 1.5 years old phone is not "somewhat old"... if anything, it is pretty new. In many countries, it is not even out of warranty! Yes, some people change phones every year, but that does not mean the device itself is old just because you change it.
tgsovlerkhgsel 6y ago
I'm often getting some form of "you're rate limited", "not allowed to perform this action" etc. until I hard-reload the full page. Given that others have reported it, and it's been there for a long time, I suspect Twitter at the very least intentionally doesn't put too much resources behind the web site to force people to use the app. Of course, if a service really wants to push an app onto me, it's clear that the app gives them some real benefits, and its usually the kind that aren't a benefit for me (more tracking, better ways to push ads, more "engagement" notifications, ...). So the harder something wants to push an app, the clearer it is that I never, ever want their app to touch my device.

ufmace 6y ago

They're awfully vague about exactly what the vulnerability was and what could exploit it. I thought the sandboxing between apps would be quite solid and well-tested. Did that break somehow, or did the Twitter app have some kind of insecure API for other apps to interface with the local Twitter app?

moonbug 6y ago

I got this alert and have never installed any Twitter app.