4.9k VIEWS
Pinterest LinkedIn LINE

In 2023, during the early hours of January 6, Bloomberg’s report “Twitter May Have Leaked Information on More Than 230 million People1” came across my feed, so I would like to use it as a case study to consider the risks involved.

Table of Contents

  • Incident Overview
  • Potential Abuse and Risks
    • Risk 1: Email addresses and telephone numbers can be used to link main accounts with secondary and anonymous accounts
    • Risk 2: The information can be used for phishing
    • Risk 3: The information can be used for profiling
    • Risk 4: Spam and DDoS attacks
  • The Identifier Problem

Incident Overview

According to Bloomberg’s English-language report at January 6, 2023 5:17 JST, information on more than 230 million users believed to have leaked from Twitter was posted on the BreachForum message board. The information reportedly included email addresses, Twitter handles (names beginning with @; mine is @_nat), and full names (whatever that means). While writing this entry, I thought to check piyolog and found a far more detailed summary titled “I summarized approximately 200 million records believed to have leaked from Twitter”2. According to it, the data appears to include:

  • Display name
  • Username
  • Follower count
  • Account creation date
  • Email address

As expected, piyokango did a great job. Bloomberg, on the other hand, should write this properly.

This data was apparently not newly extracted, but was likely obtained using a Twitter API “vulnerability” that existed from June 2021 through January 2022. The vulnerability itself was reported to Twitter on January 2022 and fixed immediately. According to Twitter’s report dated August 5, 20223, “if someone submitted an email address or phone number to Twitter’s systems, Twitter’s systems would tell the person what Twitter account the submitted email addresses or phone number was associated with, if any.”45.

It was already known in July 2022 that this API vulnerability had actually been exploited. The report reads as though only Twitter handles could be extracted, but once a Twitter handle is known, the “name” in the Twitter profile linked to that handle is also known. The material posted on BreachForum may therefore have combined previously extracted data with publicly available names. Moreover, in December 23, 2022, approximately 400 million records that also included telephone numbers were reportedly “offered for exclusive sale for 200,000 dollars or multiple sales for 60,000 dollars”6, so this may be a cleaned dataset produced by removing duplicates from that data. For further details, see the piyolog article7.

Potential Abuse and Risks

First, passwords were not leaked, so this incident does not directly create a risk of unauthorized login. Nevertheless, this is a useful opportunity to review your login security and configure a FIDO authenticator or one-time password (OTP), so please do so. Twitter also recommends this in the above report dated 8/5. (Conversely, Bloomberg, why put “you should change your password from the Account tab while logged in” before strong authentication? This is exactly the problem.)

Now let us examine the risks, beginning with the risk of exploiting the vulnerability announced on August 2022.

Risk 1: Email addresses and telephone numbers can be used to link main accounts with secondary accounts8 and anonymous accounts9

Risk details:For some individuals, the greatest risk may be that email addresses or telephone numbers can be used as keys to link their secondary and anonymous accounts. Someone could trace old posts from a secondary account, criticize the person for various things, or even blackmail them. The original vulnerability report also identified this linkage as the greatest risk.

Mitigation:This is difficult once it has happened. Deleting secondary or anonymous accounts may be somewhat effective if no archives or screenshots have yet been taken. Conversely, however, people may criticize you for deleting posts or accounts, claiming that you must have something to hide.

Going forward, use different email addresses and mobile telephone numbers when creating secondary or anonymous accounts. In fact, the purpose of writing this blog entry was to explore this area more deeply, as discussed later, so please read that section as well.

Risk 2: The information can be used for phishing

Risk details: Even if information is public or has already leaked, people are easily deceived when shown information that looks correct to them and is used to create a sense of urgency. Imagine being told, “The password for your Twitter account ‘@_nat,’ created in January 5, 201510 (email address: nat@example.com), has leaked. Go to the following site and reset your password immediately,” in an SMS sent to the registered mobile number 080-0987-654311. You might well act on it, right?

Mitigation:Changing your password as Bloomberg recommends is pointless. The 2-factor authentication recommended by Twitter is almost certainly effective if you select “security key.” OTPs using text messages or authenticator applications are vulnerable to phishing, so they do not mitigate this risk. (They are effective against attacks using previously leaked passwords and similar threats.)

Risk 3: The information can be used for profiling

Risk details: Leaked information and information derived from it can be linked by email address or telephone number to information a company already holds and used for targeting profiles.

Mitigation:There are not many practical measures—that is, measures likely to be cost-effective. If you think of one, please write it in the comments.

Risk 4: Spam and DDoS attacks

Risk details:For an ordinary person, spam sent to a leaked email address or telephone number may interrupt work or free time, or cause important messages to be overlooked. For a celebrity, it could amount to a DDoS attack.

Mitigation:This is unfortunate news for anyone who had disclosed an email address or number only to important contacts and therefore never missed anything. You may need to whitelist those to whom it is currently disclosed and reject everything else, or change the number. Particularly for telephone numbers, unless the carrier can provide a remedy, the number may become unusable.

Closer examination would probably reveal many other risks, but this will do for now. If anything occurs to you, I would appreciate it if you would write it in the comments.

The Identifier Problem

When I began this blog post, its title was “Considering the Identifier Problem Through Twitter’s Data Leak Affecting More Than 230 million People,” and I intended to explore the identifier problem in depth. But it has become quite long, it is nearly 3 in the morning, and I am tired, so I will stop here this time. I had planned to write about:

  • The problem of confusing identifiers and credentials:I suspected that the original “vulnerability” might actually have been a design bug arising from this area, and wanting to write about it was what prompted this entry in the first place. I ran out of energy before getting there, though. You may think, “That cannot be,” but this confusion is fairly common, especially when these items are used for password resets. I would like to believe that was not the case with Twitter.
  • The problem of linking accounts:This mainly concerns what was discussed in the risk section. In addition, there are the following issues.
    • Backup authentication methods for pseudonymous accounts
    • The problem of confusing backup authentication methods when reusable identifiers are used
  • Twitter’s use of email addresses and telephone numbers beyond their stated purpose:Twitter used these items, collected as backup authentication methods, for targeting.

I began explaining identifiers on the Japanese-language YouTube channel I launched late last year (as of January 7, 2023, I have uploaded only installment 1).

In installment 1, titled “Identifier Classification and Risks: A Complete Guide to Identifiers, Part One”12, I discuss identifier classifications and risks (the video is embedded below). As the video explains, email addresses and telephone numbers are fundamentally reusable identifiers. They are also omnidirectional identifiers and, in many cases, persistent identifiers. Almost nobody changes their email address and mobile telephone number every 3 years, right? I intended to discuss the lessons from this incident while considering these points, but I will leave that for another time.

See you next time!

Watch this video on YouTube.
Playing the video connects to YouTube.

Footnotes

  1. Excerpt translated from the English version (Twitter Security Headaches Mount With User Data Leak Claim)
  2. https://piyolog.hatenadiary.jp/entry/2023/01/07/000622
  3. An incident impacting some accounts and private information on Twitter
  4. Original: “if someone submitted an email address or phone number to Twitter’s systems, Twitter’s systems would tell the person what Twitter account the submitted email addresses or phone number was associated with, if any.” (Source) The above Twitter report dated August 5, 2022 (retrieved January 6, 2023)
  5. mala provided me with more detailed information. Details are in “Discoverability by phone number/email restriction bypass,” which explains what the issue was. (Added 1/11)
  6. Source: the above piyolog article
  7. https://piyolog.hatenadiary.jp/entry/2023/01/07/000622
  8. secondary accounts
  9. secret accounts
  10. I used @example until 1/11, but because it was a real account, I hurriedly changed it to my own address. I do not think this caused any inconvenience, but I apologize…
  11. This telephone number cannot exist. I researched numbers that can be used in examples.
  12. https://www.youtube.com/watch?v=Ak3nSqwro9I

Related posts