Bitcoin
$47,961.02-0.32%
Ethereum
$3,531.40-2.23%
XRP
$1.09-1.97%
Cardano
$2.42-1.76%
Polkadot
$36.11+1.39%
Stellar
$0.330746-1.90%
Dogecoin
$0.252832+3.46%
Chainlink
$29.79-4.13%
Uniswap
$25.79-3.50%
Polygon
$1.38-5.51%
Litecoin
$187.43-1.68%
Bitcoin Cash
$646.56+0.73%
Algorand
$2.04+0.21%
Wrapped Bitcoin
$47,981.81-0.42%
Cosmos
$35.74+10.64%
Filecoin
$83.98-4.28%
The Graph
$0.845827-5.15%
Tron
$0.115181-0.66%
Ethereum Classic
$58.71-0.43%
Aave
$378.97-4.71%
Tezos
$6.58-2.52%
EOS
$5.28+3.94%
NEO
$50.66-2.47%
Monero
$266.94-0.58%
IOTA
$1.55-1.50%
BitTorrent
$0.004028-1.28%
Bitcoin SV
$160.88+2.29%
Waves
$30.03-6.60%
Maker
$2,910.41-5.83%
Dash
$205.92-3.28%
Decred
$149.32+4.75%
Decentraland
$0.843648-1.80%
ICON
$1.97-9.34%
NEM
$0.189181+0.97%
Zcash
$138.63-2.05%
Qtum
$13.06+2.14%
NuCypher
$0.346515-1.21%
Yearn Finance
$34,475.05-4.52%
Bitcoin Gold
$66.97-2.08%
OmiseGO
$8.58-2.85%
Basic Attention Token
$0.774300-1.61%
0x
$1.12-1.87%
Fetch.ai
$0.901025-9.77%
Paxos Standard
$0.990173+0.02%
Ren
$1.02-6.57%
Bancor
$4.19-2.29%
Band Protocol
$9.55-1.61%
Kava.io
$6.41+0.14%
Siacoin
$0.018712-2.15%
Nano
$5.63-3.27%
Loopring
$0.467786-3.91%
Storj
$1.40-1.46%
Civic
$0.590694+10.25%
Lisk
$3.63-2.03%
Numeraire
$44.18-1.92%
Orchid
$0.375895-1.44%
PAX Gold
$1,770.44-1.11%
Augur
$26.47-0.34%
Aragon
$5.97-4.43%
Enzyme
$117.17-6.83%
district0x
$0.178043-5.15%
Kyber Network
$1.93+2.30%
SingularDTV
$0.001272-9.60%
Tether
$1.00-0.03%
USD Coin
$0.999895-0.03%
Dai
$1.00-0.04%

Twitter Bug Exposed Millions of User Phone Numbers

A bug in Twitter's Android app let users connect random phone numbers to real Twitter handles.

Dec 26, 2019 at 9:00 p.m. UTC
Updated Sep 13, 2021 at 11:53 a.m. UTC

A security researcher was able to use a bug in the Twitter Android app to identify millions of Twitter users, connecting their phone numbers to their Twitter IDs. The exploit could expose failures in the company's two-factor authentication system and give other security developers pause.

According to a TechCrunch report, the researcher, Ibrahim Balic, created randomized lists of phone numbers and sent them to Twitter.

“If you upload your phone number, it fetches user data in return,” he said.

The user data allowed Balic to find phone numbers for many major Twitter "celebrities" including the private number of a "senior Israeli politician."

“Upon learning of this bug, we suspended the accounts used to inappropriately access people’s personal information. Protecting the privacy and safety of the people who use Twitter is our number one priority and we remain focused on rapidly stopping spam and abuse originating from use of Twitter’s APIs,” a Twitter spokesperson said.

The bug exposed user accounts when Balic uploaded millions of phone numbers and asked Twitter to match them with users. Typically this interface is used only when new users install the app on their phone but, using a set of API calls, Balic was able to spoof this behavior. The resulting breach of privacy - essentially connecting real numbers to real Twitter handles - could reduce the efficacy of two-factor authentication schemes popular on financial applications and wallets.

Image via Shutterstock.

DISCLOSURE

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.

Loading...