Bot army risk as 3,000+ apps found spilling Twitter API keys
- Reference: 1659451509
- News link: https://www.theregister.co.uk/2022/08/02/cloudsek_twitter_api/
- Source link:
[1]Researchers at the company say they've uncovered 3,207 apps leaking Twitter API keys, which can be used to gain access to or even entirely take over Twitter accounts.
Twitter helpfully exposes an API to allow developers access to the microblogging platform. With it, developers can use features such as reading and sending tweets and direct messages, following and unfollowing users and so on. [2]It has proven controversial on occasion and most recently Elon Musk's legal team [3]complained about API rate limits . Basically, Musk's claim was that he couldn't ascertain how many Twitter accounts were run by bots or are otherwise inauthentic.
[4]
That same API has proven a boon to developers whose jobs are made easier by the functionality, although they are also an occasional irritation to users (when, for example, certain games add recent scores to users' Twitter timelines.)
Who would need a bot army?
The API is, however, not really the problem. The issue is the authentication keys given to developers for API access and how those keys are stored. And yes, according to the security house, the keys are sometimes stored in an accessible fashion within the code. The example of developing a mobile application was given, where the API was used for testing and the credentials then saved within the app. Then, as the app moved to production, the keys were not removed. Miscreants could simply download the app, decompile it and get hold of the API keys.
"Thus, from here bulk API keys and tokens can be harvested to prepare the Twitter bot army," said the researchers.
[5]
[6]
And as for what one could do with such an army? Scenarios posited by CloudSEK included spreading misinformation, firing off malware attacks from supposedly trusted accounts, spamming and the inevitable phishing.
[7]Data brokers amass profiles of pregnant women – and, of course, it's all up for sale
[8]BreachForums booms on the back of billion-record Chinese data leak
[9]Culture shock: Ransomware gang sacks arts orgs' email lists
[10]Twitter launches probe after miscreants claim to have swiped 5.4m users' details
Of the 3,207 leaky apps, 57 had premium or enterprise subscriptions to the Twitter API (costing $149/month according to researchers) and some of the leaked credentials belonged to verified Twitter accounts. 230 were leaking enough credentials to permit a full account takeover.
What can be done? The answer is simply good practice. While perhaps not very fashionable in the modern development world, CloudSEK recommends proper versioning replete with code reviews and approval. Keys should be rotated and hiding them in variables is recommended.
"Adequate care," researchers wrote, "should be taken to ensure that files containing environment variables in the source code are not included."
[11]
While leaving secrets in the code might seem like an amusing anecdote for our weekly [12]Who, Me? column (where Register readers confess to messes they made in the pursuit of IT excellence), the report is evidence that shoddy coding practices are alive and well and can have potentially disastrous consequences for the organizations and accounts affected. ®
Get our [13]Tech Resources
[1] https://cloudsek.com/whitepapers_reports/how-leaked-twitter-api-keys-can-be-used-to-build-a-bot-army/
[2] https://www.theregister.com/2020/07/16/twitter_tries_developer_relations_reset/
[3] https://www.theregister.com/2022/07/11/twitter_apis_elon_musk_acquisition/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YulKMxDWbHgW5Czd9wBpHQAAAAs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YulKMxDWbHgW5Czd9wBpHQAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YulKMxDWbHgW5Czd9wBpHQAAAAs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/08/01/pregnant_womens_data_sold/
[8] https://www.theregister.com/2022/07/29/breachedforums_popularity_surge/
[9] https://www.theregister.com/2022/07/26/wordfly_ransomware_attack/
[10] https://www.theregister.com/2022/07/25/twitter_investigates_data_breach/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YulKMxDWbHgW5Czd9wBpHQAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/Tag/Who,%20Me?/
[13] https://whitepapers.theregister.com/
But who uses Twitter ?
I don't for one.
It's degenerated into an echo chamber for the Wokeist Wars.
Any "news" that appears there can be sourced elsewhere. And call me old school I'd rather it was accurate than early.
Also, I suspect that the more people that realise the French word for a Twitter user is "twitto", the fewer people will use it anyway.
Re: But who uses Twitter ?
It was an echo chamber from the get go. And it was precisely because it was an echo chamber that journalists found it so is useful, whether it was because it confirmed their bias or when they came across a group of loons spouting conspiracies.
"230 were leaking enough credentials to permit a full account takeover.
What can be done?"
Lock the owners out of the account. Tell them where they went wrong and return it to them in a week or so. If they won't learn any other way but by experience give them a little experience to learn from.
I for one welcome our robot overlords
I'm all for giving control to the bots it's not as if they'll post anything worse than what people already do!
I wonder how much blame can be attributed to poor code examples
Cannot comment on the twitter APIs as never played with them (..obviously..)
But often when looking at code samples provided for demonstrating API use, the samples are usually focused on easy to read, quick to get up and running and try out and so often the very opposite of good security practice.
.. Consider that awareness of secure coding varies a lot across devs, and the often high pressure imposed by managers to churn code out as fast as possible I wouldn't be surprised if lots of "live" code incorporates some of the bad code patterns used in the example.
e.g. most Google maps API examples have the "key" just as part of the HTML page.
If I go to
https://developers.google.com/maps/documentation/javascript/examples/map-simple
and then click on the stackblitz link
https://stackblitz.com/github/googlemaps/js-samples/tree/sample-map-simple?file=README.md
In the index.html of that code sample I find this
src="https://maps.googleapis.com/maps/api/js?key=AIzaSyB41DRUbKWJHPxaFjMAwdrzWzbVKartNGg&callback=initMap&v=weekly" defer > i.e. sample having key plainly visible in HTML. API providers really ought to be coerced into providing best security practice examples - may be more difficult / slower for users to get up and running but would mean better security practices likely to be used.
Re: I wonder how much blame can be attributed to poor code examples
In this example the Maps API key can only be used from a specified domain hosting the web page. Unless the user has explicitly added a wildcard. In this case it will cost the cos Google charge per api call (after some free credit).
Besides locking the domain hosting the html/javascript, not sure apart from some obsfucation you can really secure client side web stuff. Android apps however is completely different story.
From the start, mobile 'App(lication)s' took the level of security and privacy characterised by the worst release of Windows ever and lowered it by 2-3 orders of magnitude.
Try telling that to the kids of today...
But who's at risk here?
If the only compromised accounts are the ones where developers have foolishly hard-coded the authentication keys into their apps then presumably a) we're talking about a relatively small "army", and b) Joe Public isn't actually at risk.
Or did I miss something?