Twitter appena fissato una vulnerabilità che potrebbe aver condiviso i messaggi diretti (DM) e tweet di alcuni utenti protetti con gli sviluppatori che non sono stati autorizzati ad accedere alle informazioni. It appears that the bug is related to Twitter’s Account Activity API that could have resulted in data being delivered to the wrong registered developer, the official statement said.
The company already emailed all said developers. The investigation has confirmed that there is “only one set of technical circumstances where this issue could have occurred."
More about Twitter’s Account Activity API Bug
According to information diviso in Twitter’s blog post, "if you interacted with an account or business on Twitter that relied on a developer using the AAAPI to provide their services, the bug may have caused some of these interactions to be unintentionally sent to another registered developer".
It should be noted that this bug might have occurred when a particular set of technical circumstances were true during the relevant time period for this issue.
The said AAAPI has been affected between May 2017 e settembre 10, 2018, when the bug was fixed shortly after it was discovered. Meno di 1% of Twitter’s 335 million users were affected by the bug. Affected users are being notified about the incident with the help of an in-app notice on the official website. The company is also working with its partner developers to ensure that they are complying with their obligations to delete all the required information that shouldn’t be in their possession. It should be noted that Twitter has hundreds of such developers.
All'inizio di quest'anno, a maggio, Twitter announced a critical security bug that was identified in the service. Users were prompted to change their passwords. The problem lied in the way the account login passwords were stored in the internal database. Più specificamente, an issue with Twitter’s system allowed passwords to be stored without being “masked” properly. Masking refers to the way sensitive information is stored in an internal database.