How I Discovered a Security Vulnerability in Twitter That Impacted 1.5M Users

http://bostinnovation.com/2011/02/03/how-i-discovered-a-security-vulnerability-in-twitter-that-impacted-1-5-million-users/

by sliggity • 15 years ago

48 30 15 years ago

bostinnovation.com

kmccarth4• 15 years ago

Twitter Support gets about 100-200 tickets per hour

coderdude3• 15 years ago

Yeah it says so in the blog post. Which I just realized you are the author of.

kmccarth4• 15 years ago

ha, not the author

kmccarth4• 15 years ago

co-founder, yup

nbpoole3• 15 years ago

I need to get better at creating these kinds of titles for my vulnerability writeups :P

tptacek5• 15 years ago

No, you don't. I'm very much not a fan of how this was written up. This is a straightforward "forced-browsing"-style web bug that disclosed support tickets. You could write an article about how support systems are often ignored during software security projects, but that's not what this guy wrote. I'm not really sure what he's trying to demonstrate, other than that he is awesome and Twitter less so. Stay classy.

jdp232• 15 years ago

Good writeup.

Was the vulnerability in Zendesk or in how Twitter had configured the system?

ttol6• 15 years ago

I asked the same thing but was told that Twitter couldn't disclose this to me because of their NDA and other confidentiality agreements. Who is actually at fault is unclear. I wasn't able to reproduce this on Groupon or Rackspace Cloud's Zendesk though, but that doesn't say anything definitive.

jdp232• 15 years ago

belated thanks for the response. i guess we'll never know.

arthurgibson2• 15 years ago

"All support tickets – at the time, 1.5+ million! – were exposed"

* Was this actually 1.5M users or just tickets? Thats a lot of upset people if so.

ttol6• 15 years ago

These were users. I wrote 1-1.5 to set a wide range in case for duplicates, but I rarely saw any. From my observation, the number is closer to 1.5 million than 1 million (and growing by 100-200 per hour).

arthurgibson2• 15 years ago

Wow, I can't even imagine some of the filtering that needs to go on within that system to find the legitimate tickets to address.

gyardley• 15 years ago

Wait, account passwords were visible?

Was this a case of account passwords being sent to Twitter Support by users - 'hey, I can't login, my password is bigclown' - or does Twitter Support have a way to access the user's actual password?

If it's the latter, that's a time bomb waiting to go off.

ttol6• 15 years ago

Former. Also App developers posting their API keys and Consumer Secret keys. So, theoretically, this would allow a malicious person to control all the authorized accounts with that app (and these were big name apps). Autotweeting, DMing, access private messages, etc.

abraham• 15 years ago

Only if they both stole the consumer token and were able to phish the user into going through the authorization flow.

tptacek5• 15 years ago

You usually don't have to write headlines like "1.5M users compromised!" to get people to fix trivial web flaws. Also, before asking VC's and posting public Twitter messages and spending two days trying to track down a security contact, try mailing "security@" first; as you discovered, that sensible default generated an immediate response.

Edited out "not '96 anymore", the word "breathless", and my assessment of his effort to track down security@ as "hinky"; I wasn't happy with the tone of this comment in retrospect either.

nbpoole3• 15 years ago

http://twitter.com/about/security has been on their website for a little while now, but it's not so easy to find via Google (at least for me).

ttol6• 15 years ago

Yea -- it's hard to find because the twitter.com/about/security page is about a week old. When google updates their indexes, it should be easier to find.

ttol6• 15 years ago

No, the security pages were put up after I talked to Bob. (Those are new pages and are about a week old. They were put up precisely because it wasn't easy for people to report security issues.). Also the headline wasn't written by me. Boston Innovation editors modified it. My original headline is on my website at waynechang.com. And yes, it was hard to get a hold of someone -- I spent two days. Emailing security@twitter.com was less obvious then, since emailing support@twitter.com sends back a form rejection letter (try it).

tptacek5• 15 years ago

You're right. The headline on your site is "How I Discovered A Security Vulnerability In Twitter"; the "I found another security vulnerability that impacted 1-1.5 million Twitter accounts." copy is in your subhed. My mistake.

stanleydrew2• 15 years ago

After reading this I have no idea how he actually discovered the vulnerability, aside from a handwavy statement about messing with form input.

Most of the writeup is just a narrative about what he saw and who he talked to afterwards. I'm a little disappointed. I was hoping for more technical detail.

tptacek5• 15 years ago

Presumably, he submitted a ticket, went to the ticket status page, saw a list of tickets each with a link like "http://support.twitter.com/tickets/1532547, and changed the ticket number in the URL. It's possible that it was slightly more tricky than that (it may be that there's a sub-URL that doesn't enforce access control, and that the root URL always did), but from the writeup that appears to be the whole issue.

In standard Rails, which the Twitter support ticket site may very well be, this is a one line fix; call User.tickets.find_by_id instead of Ticket.find_by_id.

stanleydrew2• 15 years ago

Yeah, I didn't expect it to be thrilling. But some detail would have been good. As it is I'm not really sure what the point of the post was, except to say "Hey, I found something wrong with Twitter and then tweeted with some famous people and then once I found the right email address I told them and they fixed it. Oh and did I mention that it was really important because it affected 1.5 million users?"

It would have been more useful if the author included some details and possibly speculation (as you have provided) as to what was going on in Twitter's ticketing setup so that we could all learn from it.

erikabele• 15 years ago

This reminds me of some flaw with Skype's billing system which allowed me to download invoices for virtually every paying business customer just by replacing some chars in a URL. The invoices included a lot of personal details together with various bank account & phone numbers.

Took me 8 months to get someone at Skype to acknowledge the issue; to my knowledge it was never escalated. Wouldn't be surprised if it's still there...

How I Discovered a Security Vulnerability in Twitter That Impacted 1.5M Users

Related Stories