3 ms·

> At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. They didn't notice that someone managed to scrape 5,485,636 acc

> At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. They didn't notice that someone managed to scrape 5,485,636 accounts, after they were made aware of the issue?

bredren 4y ago
Not sure if I’m reading this right but what makes the data set interesting is the attacker used a known email address list to get associated twitter ID. The scraped public data is only interesting if the email address identifies the victim and the public content compromise the victim in some way. As far as not noticing scraping of the accounts: If all that is needed to scrape public twitter data is the twitter ID, the site is likely being scraped constantly.
- supernes 4y ago
  Yes, it's safe to assume that public data is being scraped off Twitter constantly, especially with their history of nerfing the APIs they provide. And for most of the accounts affected by this breach the impact seems low. But from an engineering standpoint, they failed to audit a somewhat obscure, (presumably) low-traffic endpoint that received an extraordinary amount of attention. It's kind of wild they're willing to admit such incompetence.
  - oefrha 4y ago
    It’s a leak in the Twitter Android app signup flow: https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026 Not sure if iOS is also affected, thread doesn’t say, but the API doesn’t look Android-specific. Leak was there for more than half a year. Unless you believe Twitter is dying and few people are signing up, I fail to see how you can characterize that as an obscure, low traffic endpoint. Edit: On careful reading, it’s actually the onboarding flow, so even if you already have an account you should still hit it when starting to use the app for the first time.
    - deleted 4y ago
      [deleted]
ekianjo 4y ago
Just like they did not notice bots had invaded the platform
- imwillofficial 4y ago

bredren 4y ago

Not sure if I’m reading this right but what makes the data set interesting is the attacker used a known email address list to get associated twitter ID. The scraped public data is only interesting if the email address identifies the victim and the public content compromise the victim in some way. As far as not noticing scraping of the accounts: If all that is needed to scrape public twitter data is the twitter ID, the site is likely being scraped constantly.

supernes 4y ago
Yes, it's safe to assume that public data is being scraped off Twitter constantly, especially with their history of nerfing the APIs they provide. And for most of the accounts affected by this breach the impact seems low. But from an engineering standpoint, they failed to audit a somewhat obscure, (presumably) low-traffic endpoint that received an extraordinary amount of attention. It's kind of wild they're willing to admit such incompetence.
- oefrha 4y ago
  It’s a leak in the Twitter Android app signup flow: https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026 Not sure if iOS is also affected, thread doesn’t say, but the API doesn’t look Android-specific. Leak was there for more than half a year. Unless you believe Twitter is dying and few people are signing up, I fail to see how you can characterize that as an obscure, low traffic endpoint. Edit: On careful reading, it’s actually the onboarding flow, so even if you already have an account you should still hit it when starting to use the app for the first time.
  - deleted 4y ago
    [deleted]

ekianjo 4y ago

Just like they did not notice bots had invaded the platform

imwillofficial 4y ago