Twitter admits state-backed hackers in Malaysia, Iran and Israel may have stolen up to 17million phone numbers linked to Android user accounts
- Hackers were exploiting a vulnerability in Twitter’s ‘contacts upload’ feature
- Twitter said ‘some of these IP addresses may have ties to state-sponsored actors’
- A ‘high volume of requests’ came from IP addresses in Iran, Israel and Malaysia
- Website did not elaborate on how many accounts may have been affected
Twitter has revealed there were several attacks by suspected state-backed actors in Malaysia, Iran and Israel to access Android user phone numbers.
In a statement, Twitter said it had identified a ‘high volume of requests’ to use the feature coming from IP addresses in the three countries.
The cyber-security researcher who discovered the flaw and exploited it to match 17million phone numbers with user accounts.
The hackers, who may be working in the employ of a country’s government, were exploiting to a flaw in the company’s ‘contacts upload’ feature.
Twitter simply said in a vague statement that some of the IP addresses involved in the attacks ‘may have ties to state-sponsored actors’.
Scroll down for video
In a statement published on its privacy blog, Twitter said it had identified a ‘high volume of requests’ to use the feature coming from IP addresses in Iran, Israel and Malaysia (stock)
A company spokeswoman declined to say how many phone numbers had been exposed, saying Twitter was unable to identify all accounts that had been impacted.
She said Twitter suspected a possible connection to state-backed hackers because the attackers in Iran appeared to have had unrestricted access to Twitter, even though the network is banned there.
But twitter did say in its blog post that the accounts were suspended as soon as Twitter was made aware of the issue.
Ilia Kolochenko, CEO of web security company ImmuniWeb, comments: ‘Twitter’s claims about the involvement of ‘IPs of state-sponsored actors’ are a bit incomprehensible without further details.
‘Today, it is virtually impossible to reliably attribute an attack, and I think nation-state actors have access to much more dangerous vulnerabilities affecting Twitter and its suppliers.’
TechCrunch reported that a security researcher, Ibrahim Balic, had managed to match 17 million phone numbers to specific Twitter user accounts by exploiting a flaw in the contacts feature of its Android app.
TechCrunch said it was able to identify a senior Israeli politician by matching a phone number through the tool.
The feature, which allows people with a user’s phone number to find and connect with that user on Twitter, is off by default for users in the European Union where stringent privacy rules are in place. It is switched on by default for all other users globally, the spokeswoman said.
Twitter said in its statement that it has changed the feature so it no longer reveals specific account names in response to requests. It has also suspended any accounts believed to have been abusing the tool.
However, the company is not sending individual notifications to users whose phone numbers were accessed in the data leak, which information security experts consider a best practice.
Jake Moore, cybersecurity Specialist at global cybersecurity firm ESET told MailOnline the best way for users to protect themselves online is to use two factor authentication.
‘Twitter recently enabled two factor authentication where a mobile number is not required. This helps to provide privacy without compromising on security,’ he says.
‘It works through authenticator apps or security keys which are, in fact, more secure. To set this up, head to ‘account security’ in the settings.’
HOW CAN PARENTS KEEP THEIR CHILDREN SAFE ON SOCIAL MEDIA?
Children as young as two are using social media, research from charity Barnardo’s has suggested.
Internet companies are being pushed to do more to combat harmful content online but parents can also take steps to alter how their children use the web.
Here are some suggestions of how parents can help their children.
Use parental controls
Both iOS and Google offer features that enable parents to filter content and set time limits on apps.
For iOS devices, such as an iPhone or iPad, you can make use of the Screen Time feature to block certain apps, content types or functions.
On iOS 12, this can be done by going to settings and selecting Screen Time.
For Android, you can install the Family Link app from the Google Play Store.
Talk to your children
Many charities, including the NSPCC, say talking to children about their online activity is vital to keep them safe.
Its website features a number of tips on how to start a conversation with children about using social media and the wider internet, including having parents visit sites with their children to learn about them together and discussing how to stay safe online and act responsibly.
Understand their internet usage
There are tools available for parents to learn more about how social media platforms operate.
Net Aware, a website run in partnership by the NSPCC and O2, offers information about social media sites, including age requirement guidance.
Limit screen time
The World Health Organisation recommends parents should limit young children to 60 minutes of screen time every day.
The guidelines, published in April, suggest children aged between two and five are restricted to an hour of daily sedentary screen time.
They also recommend babies avoid any sedentary screen time, including watching TV or sitting still playing games on devices.
Source: Read Full Article