Researcher: Twitter flaw gave third-party apps unauthorized access to private messages | PCWorld

Users who signed into third-party Web or mobile applications using their Twitter accounts might have given those applications access to their Twitter private “direct” messages without knowing it, according to Cesar Cerrudo, the chief technology officer of security consultancy firm IOActive.

The issue is the result of a flaw in Twitter’s API (application programming interface) that led to users not being properly informed about what permissions an application will have on their accounts once granted access. Cerrudo described the problem and explained how he discovered it in a blog post published Tuesday.

Applications that allow users to log in with their Twitter accounts have to be registered with Twitter at https://dev.twitter.com/apps. During registration, their developers have to declare the level of access the applications will have on people’s accounts: “read only,” “read and write” or “read, write and access to direct messages.”

When users attempt to log into such an application for the first time using their Twitter accounts, they get redirected to an authorization page on Twitter’s website that lists the permissions requested by the particular application.

The issue was reported to Twitter on Jan. 16 and was addressed in less than 24 hours, he said. They said the issue occurred due to complex code and incorrect assumptions and validations,” Cerrudo said in the blog post.

However, Twitter’s fix does not seem to apply retroactively. After Twitter fixed the issue, the app Cerrudo was testing that already had access to his account continued to display direct messages despite never receiving authorization from him to do so, he said.

Twitter users should check if any of the apps they authorized in the past also gained access to their direct messages without their knowledge, Cerrudo said. This can be done by reviewing their permissions on the Twitter Settings > Apps page.

Cerrudo decided to make this issue public because it can have serious implications and because Twitter did not issue a public advisory or announcement about it. The company should maintain a dedicated page where it can inform users about security issues, he said.

via Researcher: Twitter flaw gave third-party apps unauthorized access to private messages | PCWorld.