{"id":27786,"date":"2023-01-05T02:06:10","date_gmt":"2023-01-05T02:06:10","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/05\/200m-twitter-records-released-on-hacking-forum\/"},"modified":"2023-01-05T02:06:10","modified_gmt":"2023-01-05T02:06:10","slug":"200m-twitter-records-released-on-hacking-forum","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/05\/200m-twitter-records-released-on-hacking-forum\/","title":{"rendered":"200M Twitter records released on hacking forum"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Data relating to over 200 million Twitter Inc. users have been published on a hacking forum two weeks<\/a> after data relating to 400 million Twitter users were offered for sale on the same forum.<\/p>\n

The data is available to download from\u00a0BreachForums,\u00a0the successor site to the\u00a0now-shuttered<\/a>\u00a0RaidForums. The listing describes the data as a \u201cDB\/Scrape Leak,\u201d meaning that the data was gathered through access to Twitter and scraping public information. The database includes email addresses, names, screen names, the number of followers each Twitter user has and the date they joined Twitter.<\/p>\n

While the listing comes from a different user than the previously offered 400 million Twitter records, Privacy Affairs claims<\/a> that the data appears to be from the same source. The earlier data was believed to have been gathered by exploiting an application programming interface vulnerability that Twitter fixed in January 2022.<\/p>\n

The database includes information on notable Twitter users such as Alphabet Inc. Chief Executive Office Sundar Pichai, Donald Trump Jr and SpaceX Inc.<\/p>\n

Bleeping Computer reports<\/a> that, while claiming to have been cleaned up to not include duplicates, the database still includes duplicates. Some of the sample data provided has also been confirmed to be legitimate.<\/p>\n

A second listing from a different user on Breach Forums claims to have taken the same data dump and cleaned it up, including removing duplicates. The second listing also claims that the records indicate that the information was collected from early November 2021 through to Dec. 14, 2021.<\/p>\n

\u201cThis is a common example of how an unsecured API that developers design to \u2018just work\u2019 can remain unsecured because when it comes to security, what is out-of-sight is often out-of-mind,\u201d Jamie Boote, associate software security consultant at application security company Synopsys Inc.\u2019s Software Integrity Group<\/a>, told SiliconANGLE. \u201cHumans are terrible at securing what they can\u2019t see.\u201d<\/p>\n

Sammy Migues, principal scientist at Synopsys Software Integrity Group noted that the core of the story are the issues around API security.\u00a0\u201cAs cloud-native app development explodes, so does the world of refactoring monolithic apps into hundreds and thousands of APIs and microservices,\u201d Migues explained. \u201cCertainly, this effort is growing much faster than the skills and numbers of application architects who can craft working secure API and zero trust architectures.\u201d<\/p>\n

\u201cIt\u2019s also growing faster than the time there is available to do threat modeling and skilled security testing,\u201d Migues added. \u201cIn this case, the lapse in API security resulted in email addresses tied to Twitter accounts and it seems the marketplace has spoken on the value of that data\u2013next to nothing.\u201d<\/p>\n

The data breach that led to the listing on BreachForums is also subject to an inquiry<\/a> by Ireland\u2019s privacy regulator.<\/p>\n

Image: BreachForums<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n