Zero-Day Bug Responsible for Massive Twitter Breach

A zero-day vulnerability in Twitter’s code base was liable for a serious information breach that’s thought to have affected 5.4 million customers, the social media agency has revealed.

The risk actor hoped to promote the profile information for $30,000 on a cybercrime website. Some info was scraped from public Twitter profiles, together with location and picture URL. Nonetheless, they have been crucially in a position to hyperlink account emails and telephone numbers with account IDs by leveraging the vulnerability.

“In January 2022, we obtained a report by way of our bug bounty program of a vulnerability in Twitter’s techniques. On account of the vulnerability, if somebody submitted an e-mail tackle or telephone quantity to Twitter’s techniques, Twitter’s techniques would inform the individual what Twitter account the submitted e-mail addresses or telephone quantity was related to, if any,” Twitter explained.

“This bug resulted from an replace to our code in June 2021. After we discovered about this, we instantly investigated and stuck it. At the moment, we had no proof to recommend somebody had taken benefit of the vulnerability.”

Nonetheless, the agency realized final month {that a} malicious actor had certainly been in a position to benefit from the bug earlier than it managed to patch it.

“We will likely be straight notifying the account homeowners we are able to affirm have been affected by this problem,” it mentioned.

“We’re publishing this replace as a result of we aren’t in a position to affirm each account that was probably impacted, and are notably conscious of individuals with pseudonymous accounts who will be focused by state or different actors.”

The agency is recommending those that use Twitter pseudonymously to not add a publicly recognized telephone quantity or e-mail tackle to their account.

It additionally instructed customers change on two-factor authentication for further login safety, utilizing both a devoted app or {hardware} safety keys. Nonetheless, no passwords have been stolen within the assault.