Twitter API security breach exposes 5.4 million users’ data

In July this yr, cybercriminals started promoting the person knowledge of greater than 5.4 million Twitter customers on a hacking discussion board after exploiting an API vulnerability disclosed in December 2021. 

Just lately, a hacker launched this info at no cost, simply as different researchers reported a breach affecting thousands and thousands of accounts throughout the EU and U.S. 

In keeping with a blog post from Twitter in August, the exploit enabled hackers to submit e-mail addresses or cellphone numbers to the API to establish which account they had been linked to.  

Whereas Twitter mounted the vulnerability in January this yr, it nonetheless uncovered thousands and thousands of customers’ personal cellphone numbers and e-mail addresses, and highlights that the affect of uncovered APIs might be devastating for contemporary organizations.  

The true affect of API assaults 

The Twitter breach comes amid a wave of API assaults, with Salt Safety reporting that 95% of organizations skilled safety issues in manufacturing APIs over the previous 12 months, and 20% suffered an information breach because of safety gaps in APIs. 

This excessive charge of exploitation matches with Gartner’s prediction that API assaults would turn into the most-frequent assault vector this yr.  

One of many unlucky realities of API assaults is that vulnerabilities in these techniques present entry to unprecedented quantities of information, on this case, the information of 5.4 million customers or extra. 

“As a result of APIs are meant for use by techniques to speak with one another and change large quantities of information — these interfaces signify an alluring goal for malicious actors to abuse,” stated Avishai Avivi, SafeBreach CISO. 

Avivi notes that these vulnerabilities present direct entry to underlying knowledge. 

“Whereas conventional software program vulnerabilities and API vulnerabilities share some widespread traits, they’re completely different at their core. APIs, to an extent, belief the system that’s attempting to connect with them,” Avivi stated. 

This belief is problematic as a result of as soon as an attacker beneficial properties entry to an API, they’ve direct entry to a company’s underlying databases, and all the knowledge contained inside them. 

What’s the risk now? Social engineering 

Probably the most vital risk rising from this breach is social engineering. Utilizing the names and addresses harvested from this breach, it’s doable that cybercriminals will goal customers with e-mail phishing, voice phishing, and smishing scams to try to trick customers into handing over private info and login credentials. 

“With a lot info disclosed, criminals may fairly simply use it to launch convincing social engineering assaults towards customers. This may very well be not solely to focus on their Twitter accounts, but in addition through impersonating different companies similar to on-line purchasing websites, banks and even tax workplaces,” stated Javvad Malik, safety consciousness advocate with KnowBe4. 

Whereas these scams will goal finish customers, organizations and safety groups can present well timed updates to make sure that customers are conscious of the threats they’re almost definitely to counter and easy methods to handle them. 

“Individuals ought to at all times stay looking out for any suspicious communications, particularly the place private or delicate info is requested similar to passwords,” Malik stated. “When unsure, folks ought to contact the alleged service supplier instantly or log onto their account instantly.” 

It’s additionally a good suggestion for safety groups to remind staff to activate two-factor authentication on their private accounts to scale back the probability of unauthorized logins.