Bug in Twitter Android App Exposed Protected Tweets

Twitter revealed on Thursday that users of its Android application may have had their supposedly protected tweets made public due to a bug.

When a new Twitter account is created, the tweets posted by the user are public by default. However, users can ensure that only approved followers can see their posts by using the “Protect my Tweets” option from the account’s “Privacy and safety” settings.

However, due to a flaw, people who used Twitter for Android may have had the protected tweets setting disabled if they made certain changes to account settings, such as modifying the associated email address.

According to the social media giant, the bug existed between November 3, 2014, and January 14, 2019, when a patch was released.

Twitter says it has notified impacted users and re-enabled the protected tweets option if it was disabled. The company claims the flaw did not impact the iOS app or the web version.

“We are providing this broader notice through the Twitter Help Center since we can’t confirm every account that may have been impacted. We encourage you to review your privacy settings to ensure that your ‘Protect your Tweets’ setting reflects your preferences,” Twitter said.

This is not the first time in recent months that Twitter has disclosed information exposure bugs. In May of last year, Twitter warned users that a bug caused plaintext passwords to be stored in its internal logs.

In September, the company reported that a flaw exposed the direct messages of millions of users to third-party developers for well over a year. In December, a researcher revealed the existence of a vulnerability that resulted in Twitter apps getting more permissions than they claimed.

In mid-December, Twitter told users that it may have been targeted in a state-sponsored attack. The incident was discovered during the analysis of an information disclosure flaw affecting one of its support forums.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/0rfzrBLEGb4/bug-twitter-android-app-exposed-protected-tweets