Expert Analysis On Attacker Used Twitter API To Match Usernames To Passwords

Twitter has disclosed a security incident involving the abuse of one of its official API features. Twitter admitted a flaw in its backend systems was exploited to discover the cellphone numbers of potentially millions of users en masse, which could lead to their de-anonymization through the exploitable API which has already been abused by systems in Iran, Israel and Malaysia.

Experts Comments

February 05, 2020
Ilia Kolochenko
Founder and CEO
ImmuniWeb
Security weaknesses affecting APIs are rapidly becoming one of the most critical aspects of modern application security. Their complexity and obscurity hinder security testing with traditional tools and automated scanners, and many dangerous security flaws remain undetected. Often they are riddled with a full spectrum of OWASP API Security Top 10 issues, some of which are intricately intertwined and require chained exploitations. It seems that Twitter’s bug bounty has been futile when.....Read More
Security weaknesses affecting APIs are rapidly becoming one of the most critical aspects of modern application security. Their complexity and obscurity hinder security testing with traditional tools and automated scanners, and many dangerous security flaws remain undetected. Often they are riddled with a full spectrum of OWASP API Security Top 10 issues, some of which are intricately intertwined and require chained exploitations. It seems that Twitter’s bug bounty has been futile when detecting the vulnerability in a timely manner. The security vulnerability in question is comparatively riskless in light of a myriad of avenues to obtain someone’s phone number, including social engineering and OSINT methodologies. Twitter’s claims about the involvement of “IPs of state-sponsored actors” are a bit incomprehensible without further details. Today, it is virtually impossible to reliably attribute an attack, and I think nation-state actors have access to much more dangerous vulnerabilities affecting Twitter and its suppliers.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.