Twitter API safety breach exposes 5.4 million customers’ knowledge

In July this yr, cybercriminals started promoting the person knowledge of greater than 5.4 million Twitter customers on a hacking discussion board after exploiting an API vulnerability disclosed in December 2021. 

Not too long ago, a hacker launched this info at no cost, simply as different researchers reported a breach affecting thousands and thousands of accounts throughout the EU and U.S. 

In response to a blog post from Twitter in August, the exploit enabled hackers to submit e mail addresses or telephone numbers to the API to determine which account they had been linked to.  

Whereas Twitter mounted the vulnerability in January this yr, it nonetheless uncovered thousands and thousands of customers’ non-public telephone numbers and e mail addresses, and highlights that the influence of uncovered APIs may be devastating for contemporary organizations.  

The true influence of API assaults

The Twitter breach comes amid a wave of API assaults, with Salt Safety reporting that 95% of organizations skilled safety issues in manufacturing APIs over the previous 12 months, and 20% suffered an information breach on account of safety gaps in APIs. 

This excessive fee of exploitation suits with Gartner’s prediction that API assaults would develop into the most-frequent assault vector this yr.  

One of many unlucky realities of API assaults is that vulnerabilities in these methods present entry to unprecedented quantities of information, on this case, the information of 5.4 million customers or extra. 

“As a result of APIs are meant for use by methods to speak with one another and alternate huge quantities of information — these interfaces symbolize an alluring goal for malicious actors to abuse,” mentioned Avishai Avivi, SafeBreach CISO. 

Avivi notes that these vulnerabilities present direct entry to underlying knowledge. 

“Whereas conventional software program vulnerabilities and API vulnerabilities share some widespread traits, they’re completely different at their core. APIs, to an extent, belief the system that’s making an attempt to connect with them,” Avivi mentioned. 

This belief is problematic as a result of as soon as an attacker beneficial properties entry to an API, they’ve direct entry to a corporation’s underlying databases, and all the knowledge contained inside them. 

What’s the menace now? Social engineering

Essentially the most vital menace rising from this breach is social engineering. Utilizing the names and addresses harvested from this breach, it’s potential that cybercriminals will goal customers with e mail phishing, voice phishing, and smishing scams to try to trick customers into handing over private info and login credentials. 

“With a lot info disclosed, criminals may fairly simply use it to launch convincing social engineering assaults in opposition to customers. This may very well be not solely to focus on their Twitter accounts, but additionally through impersonating different companies similar to on-line purchasing websites, banks and even tax places of work,” mentioned Javvad Malik, safety consciousness advocate with KnowBe4. 

Whereas these scams will goal finish customers, organizations and safety groups can present well timed updates to make sure that customers are conscious of the threats they’re more than likely to counter and the right way to tackle them. 

“Folks ought to all the time stay looking out for any suspicious communications, particularly the place private or delicate info is requested similar to passwords,” Malik mentioned. “When unsure, folks ought to contact the alleged service supplier instantly or log onto their account instantly.” 

It’s additionally a good suggestion for safety groups to remind staff to activate two-factor authentication on their private accounts to scale back the probability of unauthorized logins.