10 ms·
Twitter confirms zero-day used to expose data of 5.4M accounts
- Pakdef 4y agoI can see a 600M fine coming... or maybe 60B... and you know who will keep it.
- philliphaydon 4y ago40b fine and they will want to sell to musk at a lower price to get rid of it quickly lol
- rvz 4y agoThe use of phone verification to login or sign up, is a solution looking for a problem and it solves nothing as it creates more problems. Due to Twitter's poor security and use of SMS 2FA which has been proven for years to be insecure as I have repeatedly said [0], now the SS7 2FA hacks, SIM-swapping and SMS phishing scams are going to be much scarier. Henceforth, one can expect a Pegasus-like zero day to be mass deployed on to Twitter users in that breach and remotely exploit their devices easily. It's 2022, and we're still using SMS 2FA. Twitter should get a massive multi-million fine for this breach. [0] https://news.ycombinator.com/item?id=29264937 https://news.ycombinator.com/item?id=29264937
- charcircuit 4y ago>The use of phone verification to login or sign up, is a solution looking for a problem and it solves nothing as it creates more problems It increases the cost of attacking twitter. It does work eslse they would not annoy users by asking for it.
- reset-password 4y agoUntil recently they were asking for it because they were using it for ad targeting. It was discussed here https://news.ycombinator.com/item?id=31510865 https://news.ycombinator.com/item?id=31510865
- k8si 4y agoWhat should Twitter do to fix the problem?
- realusername 4y agoStandard OTP 2FA compatible with Google Authenticator
- Hamuko 4y agoSettings > Security and account access > Security > Two-factor authentication > Authentication app
- laumars 4y agoThe problem is capturing more data for ad targeting. Security is just a way of tricking users into sharing their phone number. It’s basically the ad industry equivalent of the “think of the children” argument governments make against secure encryption.
- winternett 4y agoThe only thing 2FA has been good for in my experience has been giving me a lot more junk calls. It should be outlawed in social media, and they should be required to build proper user support instead. Accounts are still being compromised regularly even with 2FA, it's tedious to use, and it only adds to PII overreach, as phones are becoming more involved in everyone's privacy and payment management. This is a perfect example of casual protection and "failure downplaying" that social platforms conduct on serious volumes of personal data, and how it has become too common place as they warehouse private data that they really don't need. A customer required me to use Skype for a meeting just the other day, It let me authenticate and verify an email account, but before I could even use it, it locked up and asked me for my phone number. This over reach is out of control.
- six0h 4y agoAre you writing off 2fa as a whole, or just sms? Aside from full database breach, why would requiring me to use a security key, or authenticator app be a bad idea? Physical theft is a lot harder (even just due to physical distance from a hacker) than stealing my password, which can happen at any distance
- sebow 4y agoI assume he mostly means SMS. And I fully agree, ever since I've got my security key I've stopped using SMS (though I never really had problems with people trying to social engineer my telecom provider). It's way more secure and it's somewhat permanent compared to a phone number, especially if left at home(since realistically unless you're commuting a lot you don't need it). The biggest perceived risk imo is when travelling(especially since changing countries will most likely trip any account session). Even authenticator apps are better than 2FA through SMS.
- winternett 4y agoAs a whole for social media at least. For items that are of national security and high sensitivity in the business world, personal devices are regularly being used in many cases (Non Gov Furnished Equipment) as well, and that thoroughly defeats the purpose too. The people that seek that level and volume of data are not usually simple amateurs that stumble upon script tools, they are usually engineers, info warriors, and even massive operations themselves with funding, skill, and human resources to get what they want. The best ways to secure data is at the system level and by not collecting data that is not needed for direct relevance to system function to begin with. Personal phone numbers have no relevance to apps like Twitter or Facebook beyond facilitating their personal information and ID lust.
- pram 4y agoHow do you even mitigate sim swapping attacks? I’m getting super paranoid from all the recent news but it seems like you literally can’t do anything about it because the phone companies are so shitty lol
- notRobot 4y agoUse a second SIM+number exclusively for all 2FA that is not publically known (ie, not shared with friends or family or used for chat apps). They can't really SIM swap you if they don't know your number.
- hiq 4y agoThat doesn't help if the attackers manage to social-engineer telcos using other public information such as your name.
- notRobot 4y agoYes. It does make it much harder though. They'd have to try every telco. Bonus points for using an online/obscure telco or sms relay.
- deepdriver 4y agoStill vulnerable to a breach that exposes user data at any one of the services you've signed up for, unless you use a separate SIM for each.
- staticassertion 4y agoDon't use SMS 2FA
- UncleMeat 4y agoYou are still fairly resistant to sim-swapping in this case because they also need your password. The real concern with sim-swapping is password resets via sms.
- 4y ago
- staticassertion 4y agoSo, Twitter got hacked and was pulled in by the FCC and has had to submit periodic reports on how they're keeping data secure. And then they got hacked again, and now they got hacked again. I hope we'll see some real damages for once.
- eastbound 4y agoDamages… from the FCC, right?
- staticassertion 4y agoYes
- seydor 4y agoIt is a bit of consolation that most of the accounts were bots :)
- supernes 4y ago> At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. They didn't notice that someone managed to scrape 5,485,636 accounts, after they were made aware of the issue?
- bredren 4y agoNot sure if I’m reading this right but what makes the data set interesting is the attacker used a known email address list to get associated twitter ID. The scraped public data is only interesting if the email address identifies the victim and the public content compromise the victim in some way. As far as not noticing scraping of the accounts: If all that is needed to scrape public twitter data is the twitter ID, the site is likely being scraped constantly.
- supernes 4y agoYes, it's safe to assume that public data is being scraped off Twitter constantly, especially with their history of nerfing the APIs they provide. And for most of the accounts affected by this breach the impact seems low. But from an engineering standpoint, they failed to audit a somewhat obscure, (presumably) low-traffic endpoint that received an extraordinary amount of attention. It's kind of wild they're willing to admit such incompetence.
- oefrha 4y agoIt’s a leak in the Twitter Android app signup flow: https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026 Not sure if iOS is also affected, thread doesn’t say, but the API doesn’t look Android-specific. Leak was there for more than half a year. Unless you believe Twitter is dying and few people are signing up, I fail to see how you can characterize that as an obscure, low traffic endpoint. Edit: On careful reading, it’s actually the onboarding flow, so even if you already have an account you should still hit it when starting to use the app for the first time.
- deleted 4y ago
- A7med 4y agothey should stop forcing their users to add a phone number, this bug probably sent hundreds of people to jail in some countries
- Hamuko 4y agoPretty sure I don't have a phone number on my account.
- mikro2nd 4y agoMe neither, but I signed up back in the Dark Ages. Pretty sure that if you sign up today there's no way to avoid giving them a phone no. For me that would be reason enough to just say no, but most people give more fucks about these things than I do.
- Hamuko 4y agoI'm not sure if it's mandatory now either. The sign up button on the front page of Twitter.com says "Sign up with a phone number of email address". If you click on it, it defaults to a form with a name, phone number and date of birth, but there's a link titled "Use email instead" that changes it to name/email/date of birth.
- i67vw3 4y agoI just signed up recently with email (deleted the account after my work was done), it asks you phone number after 5 minutes of using it. It blocks you from doing anything unless and until you give them your phone number.
- troad 4y agoIt’s effectively mandatory. If you register an account without it, you will be banned within fifteen minutes, even if you do absolutely nothing, for “suspicious activity”. The only recourse? Handing over your phone number. Apparently that absolves you of any “suspicious activity”. Give it a go in an incognito tab now, you’ll see. It’s intentionally deceptive, and they’ve shown time and time again they can’t be trusted with the data.
- AraceliHarker 4y agoWouldn't this be a good time to estimate the number of bots?
- nano9 4y agoRoughly MAU minus 5.4M
- withinrafael 4y agoAnd yet, Twitter still won't let us delete our own direct messages (for some semblence of safety). Frustrating.
- bluelightning2k 4y ago5.4 million records exposed. In the write up they show an example, but they redacted it. Dodged a bullet there.
- Hamuko 4y agoI was expecting this to be a lot worse before I saw the example, since most of the data is already public. Even if you set your account as private, the name, ID, location, description, avatar etc. is still publicly visible. The worst part is that you can find the email address and phone number, but in order to obtain that information, you already had to have one of those. So you can't just take a random account and find out their phone number if you have no idea what email/number it is already registered to.
- matbatt38 4y agoHence scraping
- matbatt38 4y agoBTW, the person who discovered the issue on HackerOne got a 5k$ bounty
- Gunnerhead 4y agoThat's it?!
- Macha 4y agoOh great, so next recruiters will be sending DMs to my defunct twitter accounts to go with the emails to my defunct email addresses
- NHQ 4y agoThe article claims for Twitter a "zero-day" without giving any details. Is this better or worse than "mistakes were made"?
- tyingq 4y agoIt suggests it was this one: https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026 "Today, Twitter has confirmed that the vulnerability used by the threat actor in December is the same one reported to and fixed by them in January 2022 as part of their HackerOne bug bounty program."
- amadeuspagel 4y agoTwitter requires a phone number to use it. You can make an account without one, but this account is very soon going to get locked until you submit and verify a phone number, even if you just follow a lot of people. On some level I understand this, even following people sends a notification, and some people do use this for spam. And yet I wonder whether instead twitter could just not show these notifications, until, based on the users activity, it's certain that it's a real human, and not a bot.
- ChrisArchitect 4y agoTwitter does not require a phone number to use it. I have numerous multi-year old accounts and never have used a phone number, nor needed one to sign up etc (email).
- lynndotpy 4y agoEarlier, I removed my phone number from my Twitter for 2FA. This week, I got locked out, and had to verify my phone number. I immediately removed it after, and got locked out. I really wish Twitter didn't have my phone number. I have a Yubikey and a TOTP 2FA app, I wonder why they needed it?
- Nextgrid 4y ago> I wonder why they needed it? "Growth & engagement" Every time a tech company asks you for a phone number it's never for security purposes, it's for data mining & ad-tracking purposes instead.
- beeboop 4y agoTwitter likes to pretend phone number is optional for an account, but it isn't. 100% of the time it will eventually lock you out and require a number.
- throwoutway 4y ago> "This bug resulted from an update to our code in June 2021. When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability." They did not have the logs to actually prove whether it had been performed or not? Gee
- jjulius 4y agoForgive my ignorance (and far be it from me to typically defend Twitter), but, sure? Not every vulnerability is part of a system that is being logged. And by virtue of a zero-day exploit being an exploit that is unknown to the owner of the code, well, then yeah... of course not.
- throwoutway 4y agoAccess logs are a pretty typical thing, regardless of what system. Also a best practice. And also part of many compliance frameworks.