All the latest UK technology news, reviews and analysis

Security firm warns Twitter flaw could give apps unauthorised access to personal messages

23 Jan 2013

Security researchers are advising users to take a close look at their Twitter accounts, having discovered a flaw which gave some third-party applications unauthorised access to personal data, such as direct messages.

Cesar Cerrudo, chief technology officer at security firm IOActive said he had uncovered the flaw when looking at permissions for third-party apps.

In a company blog post, Cerrudo explained that the issue appears to be a loophole in the way users grant permissions and the way a third-party application is able to access those permission.

He said that while testing an application, he noticed that the tool was able to obtain far more access into his own account information than he had allowed.

After some investigation, Cerrudo found that the application was taking advantage of subsequent log-in attempts to access data such as direct messages which he had not granted upon first installation.

"When I signed in again with Twitter without being already logged in to Twitter (not having an active Twitter session – you have to enter your Twitter username and password), the application obtained access to my private direct messages," Cerrudo explained.

"It did so without having authorisation, and Twitter did not display any messages about this. It was a simple bypass trick for third-party applications to obtain access to a user’s Twitter direct messages."

Cerrudo said that while the issue has been reported to Twitter and patched, the heightened access levels remained in the case of the application he was testing.

A Twitter spokesperson confirmed to V3 the that the issue reported by Cerrudo had in fact been patched. The company advises users who are concerned about application privileges to review their account's application settings page.

According to Cerrudo, users would be wise to keep a close eye on their security settings.

"I love Twitter. I use it daily," he wrote.

"However, I think Twitter still needs a bit of improvement, especially when it comes to alerting its users about security issues when privacy is affected."

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
Shaun Nichols

Shaun Nichols is the US correspondent for He has been with the company since 2006, originally joining as a news intern at the site's San Francisco offices.

More on Security
What do you think?
blog comments powered by Disqus

BYOD vs CYOD vs BYOC poll

Which approach is your firm taking to managing employees' mobile devices?

Popular Threads

Powered by Disqus
Sony Xperia Z2 Tablet powered by Android KitKat 4.4

Sony Xperia Z2 Tablet video

We take a look at the lightweight, waterproof tablet

Updating your subscription status Loading

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button

Data protection: the key challenges

Deduplication is a foundational technology for efficient backup and recovery


iPad makes its mark in the enterprise

The iPad can become a supercharged unified communications endpoint, allowing users to enhance their productivity

Litigation eDiscovery Analyst (DocuMatrix, Relativity, Introspect)

Litigation eDiscovery Analyst (DocuMatrix, Relativity...

C# .NET Developer (SQL, Algorithms, Data Algorithms, Artificial

C# .NET Developer (SQL, Algorithms, Data Algorithms...

Software Development Engineer

Develop: Customise: Configure. Maximise your technical...

Retail and Finance Application Developer and Support Analyst

MS Dynamics Nav: Retail and Finance Application Developer...
To send to more than one email address, simply separate each address with a comma.