A Twitter app bug was used to match 17M phone numbers to user accounts

https://techcrunch.com/2019/12/24/twitter-android-bug-phone-numbers/

by kkm • 7 years ago

301 125 7 years ago

mherdeg• 7 years ago

Over a two-month period, Balic said he matched records from users in Israel, Turkey, Iran, Greece, Armenia, France and Germany, he said, but stopped after Twitter blocked the effort on December 20.

Sounds like the other thing Balic discovered (not explicitly published here) is the rate limit below which Twitter's anomaly detection will not notice that you are using an interesting API endpoint.

While he did not alert Twitter to the vulnerability, he took many of the phone numbers of high-profile Twitter users — including politicians and officials — to a WhatsApp group in an effort to warn users directly.

Uh. I wonder how that went over?

ec1096852• 7 years ago

Doesn’t really have anything to do with the Android app. He was using an api endpoint that anyone could hit.

Step #1, turn two factor authentication on

Step #2, have your phone number leaked because of a dumb feature.

deogeo2• 7 years ago

I think these days, Twitter will suspend your account immediately after sing-up, for "suspicious activity", and require a phone number to re-enable it.

Mirioron• 7 years ago

At this point it has to be on purpose, right? There is no way that Twitter has just overlooked this closing of accounts "for suspicious activity" for years right when the account is created.

ec1096852• 7 years ago

The dumb feature is letting folks look up their friends by their phone number.

ribosometronome• 7 years ago

It sounds like he spent two months extracting data through a flaw that's existed for years and then bragged about it after it got closed to his egregious usage.

Is this considered normal or ethical behavior for a security researcher?

thepangolino• 7 years ago

They literally ruined it for everyone else for the publicity. Typical of PR obsessed white hat script kiddies.

sp3323• 7 years ago

There's nothing white-hat about this. He accessed as much private data as possible, and didn't report the vulnerability to Twitter or to affected users.

MiroF• 7 years ago

this is grey hat at best

Buge4• 7 years ago

What was ruined? And who ruined it?

bluesign2• 7 years ago

tbh there is nothing ethical or legal about this, actually has to have legal consequences and maybe prison time.

tessting• 7 years ago

accessing an API? I question how ethical what he did is, but I don't see how it is illegal. I think it's a lot like scraping, which LinkedIn failed to sue people for.

Buge4• 7 years ago

it got closed to his egregious usage.

Hopefully it wasn't just closed to him, but closed to everyone else too.

Is this considered normal or ethical behavior for a security researcher?

weev did something similar (scraped 100k phone numbers from Apple, then shared them with a journalist) and was convicted and sentenced to 41 months in prison for it.

edoceo• 7 years ago

Vacated after 13 months.

1f60c• 7 years ago

I think it was irresponsible to keep collecting more phone numbers, and I think he should've let Twitter handle informing users of this vulnerability. Had he used responsible disclosure, he could have claimed a nice bug bounty (between $280 and $2,940, according to [0]).

  [0]: https://hackerone.com/twitter

chance_state• 7 years ago

I'm always curious why these bug bounty programs for billion dollar companies pay so little.

Why not make this a 10K, 25K bounty even if it's small potatoes?

That amount is nothing to Twitter but might prevent what happened in this case (continued collection of data, public release before Twitter could notify users, etc).

I've noticed this trend of painfully cheap bounties at most other tech giants too.

DataWorker• 7 years ago

Supply of labor. The lump of labor fallacy does not apply to software bugs.

throwiay9872• 7 years ago

its literally the main reason i will never be in favor of this "responsible disclosure"

It pays shit and also vilifies users for learning how the system was built

sp3323• 7 years ago

Katie Moussouris has spoken a lot about this. The incentives are pretty complex.

https://www.computerweekly.com/news/252450337/Bug-bounties-n...

https://www.zdnet.com/article/relying-on-bug-bounties-not-ap...

https://threatpost.com/newsmaker-interview-katie-moussouris-...

clubm8• 7 years ago

A bit entitled to expect them to take ~3k. You could get more than that for one famous person's phone number from paparazzi.

charleslmunger• 7 years ago

There are a lot of unethical and illegal things that will earn more money than bug bounties. Some, like posting fake "elon musk giving away ETH" tweets, don't even require finding a security vulnerability. Twitter should increase their bounties to incentivize reporting and auditing, but they're never going to win a bidding war with state-sponsored vulnerability markets.

krick4• 7 years ago

Exactly. And it's not even 3K, it's "280-2940", and well can be argued to be of low importance, because it's "a misused feature, and not a critical bug" (I remember exactly that happening with WhatsApp or Telegram — not sure which it was — after somebody brute-forced phone numbers to collect accounts exactly the same way; and unlike Twitter, they even have a less made-up reason to have your number). Even if you are relatively law-abiding person you have to be absolutely crazy to be expected to collect measly $300-3000 and restraint yourself from finding out Donald Trump's personal phone number.

baybal23• 7 years ago

Very relevant: https://news.ycombinator.com/item?id=21747424

Can this be an API leak which Chinese MSS used to track Chinese users?

It may well as be if we believe that API wasn't implementing discoverability restrictions from privacy settings, and only hid users on the UI level.

Basically Twitter got pwned big time, and now denies it because GDPR will ruin them if breach is proven. Here is what Doubi's online followers figured:
State security got all phone numbers used for Twitter phone verification up to May 2019 and possibly till July.
Twitter haphazardly closed the breach in complete secrecy.
API hole explanation is excluded as people with 100% private accs got police visits.
People with foreign SIM cards also got into trouble. So the explanation that China compromised Twitter's SMS providers is also excluded, as its improbable that they did it in 4+ countries.
2016 breach is also out of question.
The only explanation is that they got hold on a big piece of their user DB, or, worse, they have an active infiltrator in Twitter, or Twitter voluntarily cooperated.

x0x03• 7 years ago

What is SSR? Sorry for the dumb question; all I can find in my moment of curiosity is something about VPNs.

baybal23• 7 years ago

Shadow Socks R

jorblumesea• 7 years ago

If China got OPM, they could easily get most of Twitter's DBs. Most likely through Nationals passing vulns back to home state intelligence agency, who can exfil data but not finger the moles.

angry_octet4• 7 years ago

That's really a non-sequitur. OPM was a basket case, unmaintained legacy systems in a backwater agency.

Klonoar• 7 years ago

Woah, this is something I'd been wondering since that comment thread.

Twitter needs a whistleblower/leaker at this point.

BurningFrog2• 7 years ago

they have an active infiltrator in Twitter

If I was China, I'd go for this. Twitter has thousands of employees, many of which can surely be turned with some pressure. Also many who has family in China that can be used for leverage.

chatmasta• 7 years ago

I’d have to imagine this is very common, and they’ve probably got one at all the big tech companies. It’s an underreported threat IMO. Who would say no to doubling their salary in exchange for running the occasional DB query for their home country?

ljm• 7 years ago

Occam's razor supports this one. Which would also bring liability to Twitter for not taking adequate steps to secure their servers.

It's not like they get l337 h4xx0rs to pwn their internal systems; they probably just have login credentials or permissions they shouldn't have, which aren't audited, and they can sneak things out in plain sight.

nl3• 7 years ago

That is how the Saudis did it.

https://www.npr.org/2019/11/07/777352750/how-saudi-arabia-us...

angry_octet4• 7 years ago

It doesn't scale -- the more you do it, the more likely one of them is to squeal or be caught, then MSS would be leaking their priority target list straight to the the FBI. Instead they would carefully target people with access, but not necessarily force them to divulge information / tamper with systems except when they really need it.

frequentnapper• 7 years ago

this begs the question: is it a security liability to hire anyone with any family in China?

tohnjitor2• 7 years ago

The only explanation? What if Chinese undercover agents are running SIM card sales operations?

krick4• 7 years ago

You answered your own question yourself it that thread it seems:

API hole explanation is excluded as people with 100% private accs got police visits.

Still, thanks for sharing, that's hell of a story. I don't speak Chinese and have no idea what's ShadowSocksR and why this Doubi guy was so hated by Chinese govt for that. Would appreciate more details.

baybal23• 7 years ago

As it is speculated now, this API leak also leaked private accounts as "privacy" check was possibly done client side.

Doubi was one of main developers of Shadowsocks, a traffic obfuscation tool to jump the Chinese firewall.

As said, the guy openly defied Chinese 3 letter services for years, and even trolled a number of agents whom he managed deanonymise himself.

nl3• 7 years ago

Basically Twitter got pwned big time, and now denies it because GDPR will ruin them if breach is proven.

I don't know about any other allegations but this is wrong. GDPR revenue penalties don't apply to breaches.

pbhjpbhj• 7 years ago

I thought they applied with Abby negligence in protection of PII? A breach can be little more than an exposure of poor PII protection.

hamhand• 7 years ago

The story has some problem, Doubi is not an SSR developer, SSR was a high school girl's popular personal fork who mysteriously stopped.

Doubi is a blogger sharing GFW circumvention tips, like easy-to-use installing scripts for VPS, tutorials, reviews and a list of donated free acounts. Before his arrest, his blog had been under attack, domain names blocked.

The phone number thing is very dangerous, twitter bascially won't allow you to use it after a while if you don't provide a valid phone number.

Police monitoring: https://twitter.com/tianlan/status/936909920334528513 https://twitter.com/midiexiang6555/status/117813328167558348...

Fried-rice festival, commemorating the day Mao's only son was spotted and bombed in North Korea while out cooking fried-rice. https://twitter.com/tianlan/status/1198841340865331200

Can_Not2• 7 years ago

Very cool, also you can't use MFA authentication on Twitter without giving them your phone number.

FeatureIncomple• 7 years ago

Twitter now supports OTP 2fa as well.

tialaramex2• 7 years ago

And FIDO Security Keys (U2F / WebAuthn)

The particularly nice thing about FIDO Security Keys that's relevant here is even a hideously incompetent implementation doesn't hurt you. The Relying Party (in this case Twitter) doesn't end up with any secrets, they get an apparently random "cookie" value to give back to you when they want you to prove you've still got that key, and a elliptic curve public key that doesn't correlate to anything except your login on their site. If they screwed up so badly that the Twitter web site showed a user's U2F parameters to every single visitor looking at their tweets it not only wouldn't unmask any pseudonyms used (as a phone number definitely would) it wouldn't even make it easier to login in as that user. FIDO is the right thing everywhere that a second factor is needed, but even more so when you don't trust the implementers to do a good job.

app4soft• 7 years ago

you can't use MFA authentication on Twitter without giving them your phone number.

GitHub also require MFA authentication since this year.

Does it mean that any MFA authentication now has same leaks?

brentonator• 7 years ago

Not unless the service requires a phone number in order to enable MFA. Some providers require the phone number for "recovery" purposes once MFA is enabled very much defeating the usefulness. Countless times we've heard of a helpful AT&T / T-Mobile / Verizon employee forwarding texts or generating a new SIM card for a scammer with a fake ID. It's just too easy.

tialaramex2• 7 years ago

No. But you should be concerned if you choose to give your phone number to people, because if they know it they might leak it through any combination of malice or incompetence.

Other than my banks, none of the systems I've enabled MFA for required a telephone number.

That includes: Dropbox, GitHub, Slack, Facebook, Nintendo, Google, Login.gov and the Digidentity.eu variant of Gov.uk Verify.

Everywhere it was possible I used my FIDO Security Keys which are phishing proof, impractical to de-anonymise and foolproof because the site has no secrets to leak. Whenever I hear that a site I already used MFA for gained WebAuthn or U2F I go back and switch that site to Security Keys.

Everywhere else I used TOTP (Google Authenticator) which can be phished using a live proxy and the site could leak their copy of your TOTP secret (not the changing code, but the secret that drives it) but other than those two concerns it's pretty safe. At least nobody can work out your real world identity by knowing your TOTP secrets.

r1ch• 7 years ago

This was changed recently, you can remove your phone number and continue to get 2FA support. The developer dashboard however won't function without a phone number for whatever reason.

codedokode4• 7 years ago

Also, if Twitter considers your behaviour "suspicious" (or if someone has reported you), it will require a phone number, if I remember correctly.

Can_Not2• 7 years ago

Suspicious activities mostly include "not already having an account" and "not having a phone number on file to sell".

whywhywhywhy• 7 years ago

“ he took many of the phone numbers of high-profile Twitter users — including politicians and officials — to a WhatsApp group in an effort to warn users directly”

What on earth does this actually mean? And why does he still have a verified Twitter account or an account at all when he exploited it for 2 months without informing them?

RicardoLuis0• 7 years ago

I'm pretty sure it means, he made a WhatsApp group, and added/invited those high-profile people to warn them

cipherzero• 7 years ago

I agree. I read that he harvested 17M numbers for 2 months and have a hard time believing he’s a security researcher...

A4ET8a8uTh0• 7 years ago

I see stuff like this and I keep wondering whether it is a bug or an undocumented feature.

3fe9a03ccd14ca5• 7 years ago

The worst part about this is that twitter requires you to add a phone number. Why?? That’s very privacy hostile, since a phone number is very personal and identifiable.

And it’s like a bait and switch. They don’t require it at sign up, but within a short time they’ll lock your account until you add it.

xorcist2• 7 years ago

Any user database is massively more valuable with verified phone numbers.

Even simple chat apps now require personally identifiable information to use.

tjoff• 7 years ago

Well that depends on what you intend to use it for...

Since twitter don't have a legitimate need for it I'd never give them my number. A disposable number, maybe.

HNthrow22• 7 years ago

a dark pattern because while it's not actually required it might as well be, their 'account locked' email conveniently leaves out that you can simply email them and have them re-enable the account without a phone number.

that email for the curious:

Hello,

Your account appears to have exhibited automated behavior that violates the Twitter Rules: https://support.twitter.com/articles/18311.

In order to continue safely using Twitter, please follow these steps:

1. Log in to your account on the web or open your Twitter app (iOS or Android). 2. You’ll see a prompt letting you know your account has been locked. Click or tap “Start”. 3. Select your country/region from the drop down menu, and then enter your phone number. 4. Click “Send code” and Twitter will send you a text message with a confirmation code (note that your standard message rates may apply). 5. Enter the code you received in the “Your code” box and click “Submit”. 6. You will see a confirmation message that your account is now unlocked.

Once you confirm your identity, it may take up to a few minutes for your account to be unlocked.

If you’re still experiencing an issue after confirming your identity, please reply to this message and provide us with specific details of the problem you're experiencing. We’ll do our best to help!

Thanks,

Twitter Support

If you reply to this saying you don't have a phone they will re-enable your account but there's no mention of that or "click here to verify account" option.

mirimir3• 7 years ago

Yeah, I gotta try that sometime.

pixl97• 7 years ago

I setup a Twitter account so I could easily get images off my PS4. Right afterward they locked my account for not entering a number. Today I feel justified for leaving it locked and never looking back.

catalogia3• 7 years ago

Does a usb thumb drive not work? I've used one to get a video off a PS4 once, but that was years ago. They may have changed things

seventhtiger• 7 years ago

I had deleted my account and wanted to make a new one for a new business. When it asked me for a phone number, I clicked back.

It has been a year and it still takes me straight to the phone number form any time I click a link for twitter. I can't even log out or do anything else.

So now I must either provide the phone number, use Twitter incognito, or delete the cookies. My guess is that for the casual non-tech user this means they will never use Twitter again until they put in their phone number because it's not possible to back out.

_jomo• 7 years ago

This is a "feature", not a bug. Twitter keeps asking for phone numbers all the time and then suggests you also allow others to discover your account via phone number.

So this guy merely enumerated a lot of phone numbers and found accounts of users who agreed to have their phone number publicly match their account.

almost_usual• 7 years ago

The worst thing about this ‘feature’ argument is how it could be slightly tweaked into a CFAA violation.

krick4• 7 years ago

Nobody abused anything. If anyone should be sued for that, it's Twitter, not somebody who used their service exactly the way they invite you to do.

krick4• 7 years ago

Yeah. Not long ago I thought I can finally try Twitter, but 20 minutes in (just enough time to follow a couple of people and to start getting familiar with the UI) I found UI to be totally blocked by the demand I submit my phone or else. Naturally, I figured I don't need Twitter that much.

So to call a feature nobody asked for which they went a long way to introduce a "bug"... yeah.

dx87• 7 years ago

Same thing happened to me when I just wanted to sign up to follow some esports organizations. It says a phone number is optional during signup, then a few minutes after I create my account it becomes locked and I get an automated message saying that I'm suspected of being a bot, and the only way to unlock it is by giving them my phone number.

xorcist2• 7 years ago

I recently started to use the "neo-banks" (fintech apps that may or may not be actual banks, mostly for payments). All of them offer an app and APIs and ways to discover which contacts use the same app via their phone number.

Immediately following this I received highly targeted phishing sms messages that included links to plausible looking login pages.

Perhaps this shouldn't be too surprising, but people will get burned and somebody will have to pay for it.

ENOTTY• 7 years ago

So this is a different bug than the one Twitter cryptically e-mailed users about. Cool cool

Lammy• 7 years ago

This must be the "Account Security Issue" Twitter e-mailed me about last week. I was wondering when they'd release more details: https://i.imgur.com/yjzMtLB.png

Transcription:

"SUBJECT: Twitter Account Security Issue – Update Twitter for Android

Hello,

We recently fixed an issue that could have compromised your account. Although we don’t have evidence that this was exploited, we can’t completely confirm so we are letting you know. You can learn more about this issue here.

Please update to the latest version of Twitter for Android as soon as possible to make sure your account is secure.

We’re sorry this happened and will continue working to keep your information secure on Twitter. You can reach out to our Office of Data Protection through this form to request information regarding your account security.

Thanks, Twitter"

Edit: err, no, this appears to be something different still. Not a good week for Twitter: https://news.ycombinator.com/item?id=21847198

codedokode4• 7 years ago

When sites collect phone numbers to "find friends", there is always a chance that they will be leaked. And even worse, someone having enough resources will check all existing phone numbers and get a mapping between numbers and accounts.

This reminds me of a story posted on Russian site [1], where researchers managed to bypass Instagram's protection and find accounts by phone number. Sadly, I cannot confirm described method because their site requires a Google Account to find Instagram account by phone number. But if it's true it shows that even Facebook and thousands of its engineers cannot protect their users' data.

[1] https://translate.google.com/translate?sl=ru&tl=en&u=https%3...

londons_explore3• 7 years ago

When you have a typical "find friends" feature, there is no way to secure it. Each friend can lookup a large address book of 1000 users, then very quickly the whole valid phone number space can be searched.

FrozenVoid• 7 years ago

When a website asks for a phone number i treat it as "please provide a DNA sample and birth certificate in triplicate" and close the tab. Its ridiculous to what ends consumers will go and accept as "privacy compromises". Hopefully GDPR will make these practices costly enough.

skinkestek• 7 years ago

Cannot read it. I get lost in some "respect your privacy" nonsense.

wdb• 7 years ago

Did they report this breach as required by GDPR rules in the EUR? I can't imagine the GDPR rules don't reply to an American company when they are active in the EU? Especially, if they have (do they?) a branch in EU like for ads revenue or royalties to lessen the tax pay in Ireland or The Netherlands like Uber

rootsudo• 7 years ago

Similar bug was used maliciously by HK Police for identifying Telegram users. Telegram now has an option for identification by number.

A Twitter app bug was used to match 17M phone numbers to user accounts

Related Stories