Twitter flaw gave private message access to third-party apps, researcher says
The issue was fixed, but apps that gained this permission without proper authorization still have it
IDG News Service - Users who signed into third-party Web or mobile applications using their Twitter accounts might have given those applications access to their Twitter private "direct" messages without knowing it, according to Cesar Cerrudo, the chief technology officer of security consultancy firm IOActive.
The issue is the result of a flaw in Twitter's API (application programming interface) that led to users not being properly informed about what permissions an application will have on their accounts once granted access. Cerrudo described the problem and explained how he discovered it in a blog post published Tuesday.
Applications that allow users to log in with their Twitter accounts have to be registered with Twitter at https://dev.twitter.com/apps. During registration, their developers have to declare the level of access the applications will have on people's accounts: "read only," "read and write" or "read, write and access to direct messages."
When users attempt to log into such an application for the first time using their Twitter accounts, they get redirected to an authorization page on Twitter's website that lists the permissions requested by the particular application.
Cerrudo said that he discovered the issue while he was testing an application developed by a friend that had a "read, write and access to direct messages" permission declared with Twitter.
When he first signed into the application with his Twitter account, he was redirected to an authorization page that informed him that the application would be able to read tweets from his timeline, see which users he follows, follow new users on his behalf, update his profile information and post tweets on his behalf, he said. The page clearly noted that the application would not be able to access direct messages or the account's password.
"After viewing the displayed web page, I trusted that Twitter would not give the application access to my password and direct messages," he wrote on the blog. "I felt that my account was safe, so I signed in and played with the application."
The researcher noticed that the application had functionality to access and display direct messages, but the feature didn't appear to be working. This made sense because he hadn't been asked to grant that permission.
However, after signing in and out of the application and Twitter a few times, his direct messages started appearing in the application. When checking the list of applications authorized to interact with his Twitter account (Settings > Apps) he noticed that the application did in fact have the read, write, and access direct messages permissions.
"I realized that this was a huge security hole," Cerrudo said.
The researcher confirmed Tuesday that he successfully reproduced the behavior several times by revoking access to the app and going through the authorization process again without being warned that the app would be able to read his private messages. The issue was reported to Twitter on Jan. 16 and was addressed in less than 24 hours, he said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts