Security firm warns Twitter flaw could give apps unauthorised access to personal messages

Security researchers are advising users to take a close look at their Twitter accounts, having discovered a flaw which gave some third-party applications unauthorised access to personal data, such as direct messages.

Cesar Cerrudo, chief technology officer at security firm IOActive said he had uncovered the flaw when looking at permissions for third-party apps.

In a company blog post, Cerrudo explained that the issue appears to be a loophole in the way users grant permissions and the way a third-party application is able to access those permission.

He said that while testing an application, he noticed that the tool was able to obtain far more access into his own account information than he had allowed.

After some investigation, Cerrudo found that the application was taking advantage of subsequent log-in attempts to access data such as direct messages which he had not granted upon first installation.

"When I signed in again with Twitter without being already logged in to Twitter (not having an active Twitter session – you have to enter your Twitter username and password), the application obtained access to my private direct messages," Cerrudo explained.

"It did so without having authorisation, and Twitter did not display any messages about this. It was a simple bypass trick for third-party applications to obtain access to a user’s Twitter direct messages."

Cerrudo said that while the issue has been reported to Twitter and patched, the heightened access levels remained in the case of the application he was testing.

A Twitter spokesperson confirmed to V3 the that the issue reported by Cerrudo had in fact been patched. The company advises users who are concerned about application privileges to review their account's application settings page.

According to Cerrudo, users would be wise to keep a close eye on their security settings.

"I love Twitter. I use it daily," he wrote.

"However, I think Twitter still needs a bit of improvement, especially when it comes to alerting its users about security issues when privacy is affected."