Twitter Bug Allowed Researcher to Match 17 Million Phone Numbers to User Accounts: Report

Several phone numbers were matched to high-profile politicians around the globe.

By Harpreet Singh | Updated: 25 December 2019 13:37 IST

Twitter Bug Allowed Researcher to Match 17 Million Phone Numbers to User Accounts: Report

A Twitter flaw allowed a security researcher to match phone numbers with user accounts

Highlights

A security researcher claims to have discovered a bug on Twitter
The flaw let him match 17 million phone numbers to Twitter users
The bug affects only the Android app

Twitter has had a busy year quashing some annoying bugs. From dropping notifications every time someone unfollowed a user to mislabelled retweets, Twitter users have seen it all. But as the year comes to an end, the social networking giant may have one more issue to deal with. A security researcher claims he was able to match 17 million phone numbers to actual Twitter accounts, exposing a flaw in Twitter's Android mobile app. He said the bug is only present on the Android app.

Ibrahim Balic, a security researcher, told TechCrunch that he was able to upload a large list of mobile phone numbers using the contacts upload feature on Twitter's Android app. When users upload a phone number, Twitter fetches relevant matching user data.

Balic explained that Twitter doesn't allow users to upload lists of phone numbers in a sequence. So he worked around the constraint by generating over two billion mobile phone numbers and then sorted them in random order. He then uploaded the entire list to Twitter via the company's Android app. The security researcher claims he was able to match mobile phone numbers from users in several countries including Iran, Israel, Greece, Armenia, France, Germany, and others.

Twitter blocked Balic's attempts on December 20 this year, claims the researcher. Balic was able to match mobile phone numbers of high-profile Twitter users which included politicians and government officials. He warned them directly via WhatsApp instead of notifying Twitter. TechCrunch reported that Twitter is working on fixing the issue to ensure the bug can't be exploited by others.

Last weekend, Twitter asked its Android app users to update the app. The social networking platform claimed it fixed a serious security vulnerability and all users must update the app on their Android devices to stay secure. It's still unclear whether this new version of the app fixed the bug Balic exposed.

Earlier this year, Twitter admitted that 'bugs' were impacting the company's advertising revenue. In June 2019, a bug on Twitter started notifying users every single time someone unfollowed them. The issue affected a specific number of Twitter users and the company fixed it later on.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Twitter, Twitter Android App

Harpreet Singh

Email Harpreet

Harpreet is the community manager at Gadgets 360. He loves all things tech, and can be found hunting for good deals when he is not shopping online. He has written about deals and e-commerce in India for many years, as well as covering social media and breaking technology news. More