All the latest UK technology news, reviews and analysis

Security firm warns Twitter flaw could give apps unauthorised access to personal messages

23 Jan 2013

Security researchers are advising users to take a close look at their Twitter accounts, having discovered a flaw which gave some third-party applications unauthorised access to personal data, such as direct messages.

Cesar Cerrudo, chief technology officer at security firm IOActive said he had uncovered the flaw when looking at permissions for third-party apps.

In a company blog post, Cerrudo explained that the issue appears to be a loophole in the way users grant permissions and the way a third-party application is able to access those permission.

He said that while testing an application, he noticed that the tool was able to obtain far more access into his own account information than he had allowed.

After some investigation, Cerrudo found that the application was taking advantage of subsequent log-in attempts to access data such as direct messages which he had not granted upon first installation.

"When I signed in again with Twitter without being already logged in to Twitter (not having an active Twitter session – you have to enter your Twitter username and password), the application obtained access to my private direct messages," Cerrudo explained.

"It did so without having authorisation, and Twitter did not display any messages about this. It was a simple bypass trick for third-party applications to obtain access to a user’s Twitter direct messages."

Cerrudo said that while the issue has been reported to Twitter and patched, the heightened access levels remained in the case of the application he was testing.

A Twitter spokesperson confirmed to V3 the that the issue reported by Cerrudo had in fact been patched. The company advises users who are concerned about application privileges to review their account's application settings page.

According to Cerrudo, users would be wise to keep a close eye on their security settings.

"I love Twitter. I use it daily," he wrote.

"However, I think Twitter still needs a bit of improvement, especially when it comes to alerting its users about security issues when privacy is affected."

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
Shaun Nichols

Shaun Nichols is the US correspondent for He has been with the company since 2006, originally joining as a news intern at the site's San Francisco offices.

More on Security
What do you think?
blog comments powered by Disqus

Windows 10 poll

What are your first impressions of Windows 10?

Popular Threads

Powered by Disqus
V3 Sungard roundtable event - Cloud computing security reliability and scalability discussion

CIOs debate how to overhaul businesses for the digital era

V3 hosts roundtable with Sungard Availability Services

Updating your subscription status Loading

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button

Getting started with virtualisation

Virtualisation can help you reduce costs, improve application availability, and simplify IT
management. However, getting started can be challenging


Converting big data and analytics insights into results

Successful leaders are infusing analytics throughout their organisations to drive smarter decisions, enable faster actions and optimise outcomes

.NET Developer - Fastest Growing Social Media Firm - London

.NET Developer (ASP.NET, C#, C#.NET, dot NET, Web Application...

.NET Developer - ASP.NET MVC 5, C#, Web API, Agile - London

.NET Developer (ASP.NET, C#, C#.NET, dot NET, Web Application...

.NET Developer - Fastest-Growing Internet Co Ever - London

.NET Developer (ASP.NET, C#, C#.NET, dot NET, Web Application...

.NET Developer, ASP.NET MVC, C#, Agile - London

.NET Developer (ASP.NET, C#, C#.NET, dot NET, Web Application...
To send to more than one email address, simply separate each address with a comma.