Security weaknesses affecting APIs are rapidly becoming one of the most critical aspects of modern application security. Their complexity and obscurity hinder security testing with traditional tools and automated scanners, and many dangerous security flaws remain undetected. Often they are riddled with a full spectrum of OWASP API Security Top 10 issues, some of which are intricately intertwined and require chained exploitations. It seems that Twitter’s bug bounty has been futile when detecting the vulnerability in a timely manner. The security vulnerability in question is comparatively riskless in light of a myriad of avenues to obtain someone’s phone number, including social engineering and OSINT methodologies. Twitter’s claims about the involvement of “IPs of state-sponsored actors” are a bit incomprehensible without further details. Today, it is virtually impossible to reliably attribute an attack, and I think nation-state actors have access to much more dangerous vulnerabilities affecting Twitter and its suppliers.  Read Less