Industry News

Twitter Flaw Surrenders Private Messages to Third-Party Apps

Twitter Flaw Surrenders Private Messages to Third-Party Apps

Third party apps that use Twitter accounts for authentication could have accessed private direct messages without users’ knowledge. The flaw in Twitter’s API was discovered by IOActive’s CTO, Cesar Cerrudo and was fixed by Twitter following its report.

The bug was discovered during the registration process in which developers select the level of access apps have on user accounts. Features such as “read only”, “read and write” or “read, write and access to direct messages” can be granted to apps, and users get a notification when the app is first started.

Twitter Flaw Surrenders Private Messages to Third-Party Apps

“After viewing the displayed web page, I trusted that Twitter would not give the application access to my password and direct messages,” Cerrudo said on his blog. “I felt that my account was safe, so I signed in and played with the application.”

Although the app Cerrudo tested did require access to read private direct messages, the feature did not work at first. After signing in and out several times, the application was able to fetch his private direct messages due to “a huge security hole.”

“They said the issue occurred due to complex code and incorrect assumptions and validations,” Cerrudo said in the blog post.

Twitter fixed the breach and, although future apps will be prevented from accessing private direct messages, apps already authorized will still perform this action. By checking the Apps page in the Twitter Settings menu to see which apps have requested access to private direct messages, users will know which apps still have the permission.

About the author


Liviu Arsene is the proud owner of the secret to the fountain of never-ending energy. That's what's been helping him work his everything off as a passionate tech news editor for the past couple of years. He is the youngest and most restless member of the Bitdefender writer team and he covers mobile malware and security topics with fervor and a twist. His passions revolve around gadgets and technology, and he's always ready to write about what's hot and trendy out there in geek universe.