All the latest UK technology news, reviews and analysis

Security firm warns Twitter flaw could give apps unauthorised access to personal messages

23 Jan 2013

Security researchers are advising users to take a close look at their Twitter accounts, having discovered a flaw which gave some third-party applications unauthorised access to personal data, such as direct messages.

Cesar Cerrudo, chief technology officer at security firm IOActive said he had uncovered the flaw when looking at permissions for third-party apps.

In a company blog post, Cerrudo explained that the issue appears to be a loophole in the way users grant permissions and the way a third-party application is able to access those permission.

He said that while testing an application, he noticed that the tool was able to obtain far more access into his own account information than he had allowed.

After some investigation, Cerrudo found that the application was taking advantage of subsequent log-in attempts to access data such as direct messages which he had not granted upon first installation.

"When I signed in again with Twitter without being already logged in to Twitter (not having an active Twitter session – you have to enter your Twitter username and password), the application obtained access to my private direct messages," Cerrudo explained.

"It did so without having authorisation, and Twitter did not display any messages about this. It was a simple bypass trick for third-party applications to obtain access to a user’s Twitter direct messages."

Cerrudo said that while the issue has been reported to Twitter and patched, the heightened access levels remained in the case of the application he was testing.

A Twitter spokesperson confirmed to V3 the that the issue reported by Cerrudo had in fact been patched. The company advises users who are concerned about application privileges to review their account's application settings page.

According to Cerrudo, users would be wise to keep a close eye on their security settings.

"I love Twitter. I use it daily," he wrote.

"However, I think Twitter still needs a bit of improvement, especially when it comes to alerting its users about security issues when privacy is affected."

  • Comment  
  • Tweet  
  • Google plus  
  • Facebook  
  • LinkedIn  
  • Stumble Upon  
Shaun Nichols

Shaun Nichols is the US correspondent for He has been with the company since 2006, originally joining as a news intern at the site's San Francisco offices.

More on Security
What do you think?
blog comments powered by Disqus

Microsoft Azure outage

Is cloud computing reliable enough for business yet?

Popular Threads

Powered by Disqus
iPhone 6 is available in silver gold and space grey

iPhone 6 video review

The best iOS handset to date

Updating your subscription status Loading

Get the latest news (daily or weekly) direct to your inbox with V3 newsletters.

newsletter sign-up button

Getting started with virtualisation

Virtualisation can help you reduce costs, improve application availability, and simplify IT
management. However, getting started can be challenging


Converting big data and analytics insights into results

Successful leaders are infusing analytics throughout their organisations to drive smarter decisions, enable faster actions and optimise outcomes

Space Planning Assistant

Central London (Regent campus) Fixed Term until...

IT Security Manager

IT Security Manager Overview: Do you want to...

Business Analyst - ERP Team

BUSINESS ANALYST – ERP TEAM, Based in Uxbridge, London...

PHP Developer MVC - Central London

Who are we? Shopworks We are a Workforce Management...
To send to more than one email address, simply separate each address with a comma.