Twitter: We killed “a large network of fake accounts” and others for abusing API feature that matched phone numbers to usernames

Hackers. [Shutterstock]

Today, Twitter released a statement that says the platform has suspended “a large network of fake accounts,” as well as many others “located in a wide range of countries,” for abusing an API feature that allowed them to match phone numbers to usernames.

Here's the official tweet.

“We observed a particularly high volume of requests coming from individual IP addresses located within Iran, Israel, and Malaysia,” the Twitter security bulletin says. “It is possible that some of these IP addresses may have ties to state-sponsored actors,” the post continued.

TechCrunch previously reported this same issue on December 24, which is also the day Twitter says that it “became aware” that the abuse was taking place, writes Devin Coldewey at TechCrunch.

Security researcher Ibrahim Balic found that a bug in Twitter’s Android app let him submit millions of phone numbers through an official API, which returned any associated user account.

Excerpt from today's TechCrunch report:

The feature is intended, if you have enabled it, to let friends who have your number look up your Twitter handle. But obviously submitting millions of numbers goes “beyond its intended use case.”

If you had turned this feature off, you weren’t affected by this bug. Fortunately for users in the EU this was opt-in there. But for the rest of the world it’s opt-out — so if you had a phone number associated with your account, you may have been affected.

Furthermore, the phone numbers include those provided for purposes of two-factor authentication, so those outside the EU may have been vulnerable to this exploit without realizing it.