Twitter bug: Make anyone follow you on Twitter

Is it an exploit or is it a valid command? I don't think we hacked anything, we just typed in some text that causes people to follow us, for all we know that's a new feature of twitter.

brk• 16 years ago

I highly doubt that. From what I'm reading on the Intarwebs, a LOT of people just couldn't resist playing with this exploit. If they truly banned everyone who did a force-follow with this hack I think they would lose a ton of people who are frankly only getting marginal value from Twitter.

I know that if I actually had to rebuild my followee list for "testing" this little hack out I would probably decide it wasn't worth the effort to start over again on Twitter.

jgrahamc• 16 years ago

Yes, this does work. Now what's the opposite verb to make someone unfollow me?

remi• 16 years ago

"block" :P

lpgauth• 16 years ago

If you tweet “accept [Twitter Username]”, the other user will automaticly follow you.

eg. "accept snoopdog"

yigit4• 16 years ago

the user who found this says he was trying to tweet "accept pwnz" where accept is a music group name.

julio_the_squid3• 16 years ago

Yeah! BALLS TO THE WALL!

This is such an odd bug. I guess it goes to show that nobody knows what strange code which should have been removed four years ago lurks in the heart of Twitter.

nutmeg• 16 years ago

There could be notoriety for anyone who does this to Conan O'brien. He only follows one person AFAIK.

Edit: Looks like this probably already happened.

dmn0012• 16 years ago

ConanOBrien was following 190 a few seconds ago, now there are 266 and its rising.

barnaby3• 16 years ago

Now he's at 0 along with everyone else

benatkin• 16 years ago

It sure does!

http://search.twitter.com/search?q=accept+conanobrien

ErrantX2• 16 years ago

That's an utterly insane bug! Some kind of debug accidentally left in? Or an admin phrase not authorised properly?

jacquesm2• 16 years ago

Laziness and security by obscurity.

maxklein5• 16 years ago

I wonder if they are going to be able to undo this. Do they have a two sided log of the follow process? If it's just one-sided, they may be able to fix the bug but not to reverse the damage.

petercooper2• 16 years ago

I suspect the Summize technology is better than they let on, and they can just do a search for tweets starting with "accept." I doubt there are many legit ones like that.

tibbon• 16 years ago

Wondering if there will be repercussions for people using this, or if they are able to track it? They aren't able to keep a lot of logs due to the volume.

sjwalter2• 16 years ago

They are at least able to tell if you've used it--my account just lost all its followers. http://twitter.com/sjwalter

I'd had a legitimate 30ish followers, used this bug a few times, now 0.

johns• 16 years ago

I think everyone is at 0. I didn't use the bug and I'm at 0/0

noodle• 16 years ago

well, i can tell you right now that my followed and following lists were both just now wiped out, and using the accept bug now produces an internal server error.

edit: seems everyone is at 0/0, but the bug still produces an error for me.

bitsoffreedom• 16 years ago

Well, I just tweeted "accept failure" :-)

simonw2• 16 years ago

My understanding is that they log pretty much everything using Scribe and run analysis using Hadoop and Pig (based on a talk by Kevin Weil and NoSQL EU the other week) http://www.slideshare.net/kevinweil/nosql-at-twitter-nosql-e...

146• 16 years ago

> They aren't able to keep a lot of logs due to the volume.

That's pretty much untrue.

Anyway, I don't imagine it's too hard to grep the logs for the last day's worth of POST and 'accept .*' and undo all the follows constructed from that.

jeiting2• 16 years ago

Wow, tested and verified.

Somebody is working late tonight.

maxklein5• 16 years ago

Okay, all followers of everyone just dropped to 0...

maxklein5• 16 years ago

And the command now gives "internal server error"

TrevorBramble• 16 years ago

Interesting. My "following" and "followers" counts just dropped to 0.

sjwalter2• 16 years ago

Heh, I used this a bunch of times. It did work just fine, I had all sorts of people following me who really shouldn't care about me. And now I have 0 followers.

chegra3• 16 years ago

I went crazy and start adding the top 200 twitter accounts: http://twitaholic.com/top100/followers/

Thought I could sell it afterwards or something. lol

HowardRoark4• 16 years ago

I only added top people on my niche!

dmn0012• 16 years ago

Is it broken now? Both followers and follow count is 0 now?!

galactus• 16 years ago

amazing. They found out, it seems: right now everyone seems to have 0 following and 0 followers.

HowardRoark4• 16 years ago

Thank god. Its everyone.

barnaby3• 16 years ago

I had the exact same feeling of panic, then relief to find out I'm not alone.

mrtron• 16 years ago

Were you drawing outside the lines again?

(horrible ayn rand joke)

icey• 16 years ago

I'm really looking forward to seeing how they handle this.

apphacker2• 16 years ago

Probably just rollback to a previous snapshot?

CoryMathews• 16 years ago

Wow they fixed that really fast.

fijter• 16 years ago

Twitter damage control: TRUNCATE followers;

mtinkerhess• 16 years ago

It appears that they just wiped everyone's list of followers? My feed still works though.

jeiting2• 16 years ago

Now I am getting a 502 when I try to post accept messages.

mrduncan• 16 years ago

They appear to be working on some sort of fix right now.

If you look at "following" lists, everything is showing up as zero for me right now, as in it shows that I'm not following anyone. All other users that I check are also showing that they aren't following anyone.

orblivion• 16 years ago

This is up there with putting everybody in a root terminal by default on their Androids.

lukeqsee• 16 years ago

Everyone shows 0 followers, but your stream still shows those you follow. Interesting.

acangiano• 16 years ago

EDIT: My original message invited people not to try this. It turns out that everyone's counter is showing zero followers, regardless of whether you tried the hack or not. Thanks Travis for pointing this out. I was misled by my desktop client which cached my follower number.

travisp• 16 years ago

even if you don't try it, you'll lose all of your followers

rmc2• 16 years ago

Every's followers count shows zero now, it's not a consequence of doing this

rmorrison2• 16 years ago

I can't believe they didn't create an OOB mechanism for accept/deny requests, especially since they send so much meta data w/ each tweet anyway.

This seems like an extremely basic design flaw.

savrajsingh• 16 years ago

I would guess this exploit has always been possible until today? What's interesting is that someone has probably been wielding this secret power well before it got outed here on hacker news.

rmorrison2• 16 years ago

Or, is there anybody whose career took off due to this bug? For example, a musician who got signed primarily because all of the top 50 music producers were following him on twitter.

HowardRoark4• 16 years ago

I have written a script to follow 1000 users on my niche every day. I find that around 15% of users follow me back. In the next couple of days, I remove the rest 85%. I have been doing this for a few months now and I have a few thousand followers on a few twitter accounts. I have set up websites for each of those niches and get decent amount of traffic though twitter. Been banned the first few times, but I have found my ways around it (mostly).

petercooper2• 16 years ago

That's true for a lot of shortcuts, hacks, and tricks. People will only tend to reveal tricks if they have no economic value to them (or if using them is so illegal that they'd prefer the fame and respect than the jail time ;-))

ilike• 16 years ago

Official:

http://status.twitter.com/post/587210796/follow-bug-discover...

cake• 16 years ago

Less than an hour to fix it, without any major data loss or collateral damages that I can see. That's pretty good !

axod6• 16 years ago

Doesn't seem like a bug to me, it looks like a poor design choice. How many other "special" tweet commands are there?

edit: anyone downmodding care to suggest how putting "accept[username]" in a tweet would be considered a 'bug'?

chc3• 16 years ago

It's not that writing "accept [username]" is a bug — the bug is that you can use it to accept people who haven't asked to follow you. Similarly, OK buttons in dialogs are not a bug, but it would be a bug if they all had the same effect as the OK button in the dialog "Are you sure you want to erase your boot drive?"

jasonlbaptiste• 16 years ago

better question: does it produce a full follow ie- if i did this bug, would billgates actually see me in his stream? OR does it just increase the follower count+i show up on his sidebar. if its the former, then wow. I know they're clearing it out now, but somebody must have been using this for a while.

fname• 16 years ago

Yes.

mortenjorck• 16 years ago

I tried it between my main account and a disused one and tweets from the attacking account showed up both through the web interface and through the API.

obsaysditto• 16 years ago

Its coincidental that Conan tweeted this message a couple days ago:

"If it ever says I’m following more than one person, I’ve been hacked. I’m a completely monogamous Twitterer—I only follow Sarah Killen."

http://twitter.com/ConanOBrien/status/13631062967

zach• 16 years ago

Wow, Conan's Twitter account is not only a test, he's got a user story (that just turned red):

In order to provoke curiosity and amusement

As a celebrity comedy writer and television host

I want to only be shown as following one otherwise-unknown person in Michigan

symesc• 16 years ago

In the past couple minutes I watched Conan's page while his "following" list went from about 11 to 2 and then back to just Sarah.

Page refreshes were very slow. The elves are busy.

whakojacko• 16 years ago

Even without this bug, I dont think they should still allow commands via tweet at all. It made sense when most tweets were via SMS, but not anymore...Maybe for emerging markets with heavy SMS usage, add a 2nd number to send commands to isolate the two?

julio_the_squid3• 16 years ago

Follow and Block make sense as commands you can send through a message. But Accept? Why would you ever be able to control an action on someone else's account? It's rather odd that this exists at all.

duskwuff• 16 years ago

If you've got your tweets protected (private), you have to accept users to allow them to follow you.

thedjpetersen• 16 years ago

Jason Calacanis dream come true :P

yigit4• 16 years ago

here is the official twitter status blog: http://status.twitter.com/

shrikant• 16 years ago

Link doesn't work - does a server hammering lead to a 404? I didn't know it could...

RyanMcGreal• 16 years ago

BBC has a report on this:

http://news.bbc.co.uk/2/hi/technology/10106166.stm

djb_hackernews• 16 years ago

watch everyone play!

http://search.twitter.com/search?q=accept

bena• 16 years ago

I don't think they've actually wiped out your followers and people you follow. I think they just prevented us from accessing those tables because I'm still getting tweets from people I follow, I just can't see the lists.

InclinedPlane2• 16 years ago

Allegedly fixed, twitter is working on rolling back abuses of the hack.

http://status.twitter.com/post/587210796/follow-bug-discover...

tlrobinson• 16 years ago

Fortunately for Twitter it's incredible easy to track (/^accept \w+$/)

InclinedPlane2• 16 years ago

Not quite. accept <username> is a perfectly valid command, but it is designed to allow someone requesting to follow you to follow you. Twitter needed to find accept requests which did not have matching follow requests, which is a bit more effort (but not much, I'd imagine).

As of now the problem appears to be fixed for a lot of people already.

goldham• 16 years ago

I would not want to be in the Twitter offices today. Good day to call in sick.

blizkreeg2• 16 years ago

Oooo approaching 2012 ;) Louisiana oil spill. Massive Twitter bug. Sticky finger Dow collapse. Facebook losing it's privacy mojo.

And to top it off, one line of code I checked in late last night prevented 200 new users from signing up on my freshly minted site.

olh• 16 years ago

Seems that the fix is just a filter. Is anyone else trying to bypass with html ascii? A few minutes ago, a prompt with the html ascii returned a +0x36 on every char. Now it does not give feedback.

"accept BillGates": &#61 ;&#63 ;&#63 ;&#65 ;&#70 ;&#74 ;&#20 ;&#42 ;&#69 ;&#6C ;&#6C ;&#47 ;&#61 ;&#74 ;&#65 ;&#73 ;

Maybe they already really fixed this bug (I hope).

gokhan• 16 years ago

The Turkish user who found the bug explains it here (in Turkish): http://inci.sozlukspot.com/e/4266098/

And people wondering why Axl Rose is following him here :) http://www.mygnrforum.com/index.php?showtopic=164026&st=...

tszming• 16 years ago

Update (6:30 PM PST): We’ve finished our cleanup of the spurious followings generated a result of this bug. If you are still seeing folks you are following who you didn’t choose to follow, please use the block or unfollow tools to remedy.

Obviously, their so called "cleanup" is incomplete, at least for me :)

araneae• 16 years ago

Exploit is fixed, and follower lists are rolled back, but they didn't do a perfect job...

Felicia Day is still following me. ^-^

Twitter bug: Make anyone follow you on Twitter

Related Stories