A Twitter Bug Left Android Users’ Private Tweets Exposed For 4 Years

Jan 18, 2019

Twitter just admitted that the social network accidentally
revealed some Android users’ protected tweets to the public for
more than 4 years — a kind of privacy blunder that you’d typically
expect
from Facebook.

When you sign up for Twitter, all your Tweets are public by
default, allowing anyone to view and interact with your Tweets.
Fortunately, Twitter also gives you control of your information,
allowing you to choose if you want to keep your Tweets
protected.

Enabling “Protect your Tweets” setting makes your tweets private,
and you’ll receive a request whenever new people want to follow
you, which you can approve or deny. It’s just similar to private
Facebook updates that limit your information to your friends only.

In a post on its Help Center ^[2] on Thursday, Twitter
disclosed a privacy bug dating back to November 3, 2014,
potentially caused the Twitter for Android app to disable the
“Protect your Tweets” setting for users without their knowledge,
making their private tweets visible to the public.

The bug only got triggered for those Android users who made
changes to their Twitter account settings, such as changing their
email address or phone number associated with their account, using
the Android app between November 3, 2014, and January 14,
2019.

“We recognize and appreciate the trust you place in us and are
committed to earning that trust every day,” Twitter said in its
statement. “We’re very sorry this happened, and we’re conducting a
full review to help prevent this from happening again.”

Apparently, on January 14, 2019, Twitter rolled out an update
for Android application to fix the programming blunder.

Although Twitter did not specify exactly how many Android users
were affected by this issue, 4 years is a long time duration, and
it’s likely that most users have changed their account settings at
least once in that period.

Twitter said the company has reached out to users whom it knows
has been affected by the privacy bug.

But since Twitter “can’t confirm every account that may have been
impacted,” if you are using Twitter for Android app and your tweets
are supposed to be protected, it is definitely a good idea to head
on to the “Privacy and Safety” settings of your app and
double-check the settings to make sure the “Protect your Tweets” is
enabled.

Desktop and iOS users can breathe a sigh of relief, as they were
not affected by the bug.

The Twitter bug revelation came at the time when the social
network is already under European Union investigation for violating the new General Data Protection
Regulation ^[3] (GDPR) rules.

The new law gives European citizens the right to request their
personal data from companies, but when Twitter turned down a
researcher’s request for data related to its short URL service, the
Irish Data Protection Commission (DPC) opened an investigation.

It seems that the DPC is also aware of the latest privacy bug in
the Twitter for Android app, and according to Bloomberg ^[4], the commission is
currently looking into the matter.

^[1]

References

^{^}
expect from Facebook
(thehackernews.com)
^{^}
Help Center
(help.twitter.com)
^{^}
violating the new General Data
Protection Regulation (thehackernews.com)
^{^}
Bloomberg
(news.bloomberglaw.com)

The Hacker News Headlines

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Aug 18, 2023

The Hacker News Headlines

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

Aug 18, 2023

The Hacker News Headlines

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

Aug 18, 2023

OWASP TOP !0

Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Broken Authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently. Sensitive Data Exposure. Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks. Broken Access Control. Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc. Security Misconfiguration. Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion. Cross-Site Scripting XSS. XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. Insecure Deserialization. Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks. Using Components with Known Vulnerabilities. Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts. Insufficient Logging & Monitoring. Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

A Twitter Bug Left Android Users’ Private Tweets Exposed For 4 Years

References

Related Post

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

You missed

Protected: Rotary VI EAST

Protected: BetterCyberCareer Group

Protected: Benin Club 1931 – Official

Protected: Whatsapp AI Automation Group