All the latest UK technology news, reviews and analysis

Security firm warns Twitter flaw could give apps unauthorised access to personal messages

23 Jan 2013

Security researchers are advising users to take a close look at their Twitter accounts, having discovered a flaw which gave some third-party applications unauthorised access to personal data, such as direct messages.

Cesar Cerrudo, chief technology officer at security firm IOActive said he had uncovered the flaw when looking at permissions for third-party apps.

In a company blog post, Cerrudo explained that the issue appears to be a loophole in the way users grant permissions and the way a third-party application is able to access those permission.

He said that while testing an application, he noticed that the tool was able to obtain far more access into his own account information than he had allowed.

After some investigation, Cerrudo found that the application was taking advantage of subsequent log-in attempts to access data such as direct messages which he had not granted upon first installation.

"When I signed in again with Twitter without being already logged in to Twitter (not having an active Twitter session – you have to enter your Twitter username and password), the application obtained access to my private direct messages," Cerrudo explained.

"It did so without having authorisation, and Twitter did not display any messages about this. It was a simple bypass trick for third-party applications to obtain access to a user’s Twitter direct messages."

Cerrudo said that while the issue has been reported to Twitter and patched, the heightened access levels remained in the case of the application he was testing.

A Twitter spokesperson confirmed to V3 the that the issue reported by Cerrudo had in fact been patched. The company advises users who are concerned about application privileges to review their account's application settings page.

According to Cerrudo, users would be wise to keep a close eye on their security settings.

"I love Twitter. I use it daily," he wrote.

"However, I think Twitter still needs a bit of improvement, especially when it comes to alerting its users about security issues when privacy is affected."

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
Shaun Nichols

Shaun Nichols is the US correspondent for He has been with the company since 2006, originally joining as a news intern at the site's San Francisco offices.

More on Security
What do you think?
blog comments powered by Disqus

Green IT poll

How important is it to your business that a cloud provider uses renewable energy like solar or wind to power their data centres?

Popular Threads

Powered by Disqus
Galaxy S5 vs Nexus 5 head to head review front

Galaxy S5 vs Nexus 5 video review

We compare Samsung and Google's top devices

Updating your subscription status Loading

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button

Getting started with virtualisation

Virtualisation can help you reduce costs, improve application availability, and simplify IT
management. However, getting started can be challenging


Converting big data and analytics insights into results

Successful leaders are infusing analytics throughout their organisations to drive smarter decisions, enable faster actions and optimise outcomes

Assistant IT Director

Assistant IT Director Annual Salary: Up to £74,954...

Head of IT Projects

Head of IT Projects Annual Salary: Up to £48,153...

Head of IT Service Management

Head of IT Service Management Annual Salary of up...

Technical Salesforce.Com Analyst

From a secret recipe to a bold idea and very proud traditions...
To send to more than one email address, simply separate each address with a comma.