Twitter just fixed a vulnerability that may have shared direct messages (DMs) and protected tweets of some users with developers who were not authorized to access the information. It appears that the bug is related to Twitter’s Account Activity API that could have resulted in data being delivered to the wrong registered developer, the official statement said.
The company already emailed all said developers. The investigation has confirmed that there is “only one set of technical circumstances where this issue could have occurred.”
More about Twitter’s Account Activity API Bug
According to information shared in Twitter’s blog post, “if you interacted with an account or business on Twitter that relied on a developer using the AAAPI to provide their services, the bug may have caused some of these interactions to be unintentionally sent to another registered developer”.
It should be noted that this bug might have occurred when a particular set of technical circumstances were true during the relevant time period for this issue.
The said AAAPI has been affected between May 2017 and September 10, 2018, when the bug was fixed shortly after it was discovered. Less than 1% of Twitter’s 335 million users were affected by the bug. Affected users are being notified about the incident with the help of an in-app notice on the official website. The company is also working with its partner developers to ensure that they are complying with their obligations to delete all the required information that shouldn’t be in their possession. It should be noted that Twitter has hundreds of such developers.
Earlier this year, in May, Twitter announced a critical security bug that was identified in the service. Users were prompted to change their passwords. The problem lied in the way the account login passwords were stored in the internal database. More specifically, an issue with Twitter’s system allowed passwords to be stored without being “masked” properly. Masking refers to the way sensitive information is stored in an internal database.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: