Windows 10: Twitter for Android security vulnerability discovered and fixed

Brink · Aug 5, 2020

We recently discovered and fixed a vulnerability in Twitter for Android related to an underlying Android OS security issue affecting OS versions 8 and 9. Our understanding is 96% of people using Twitter for Android already have an Android security patch installed that protects them from this vulnerability. For the other 4%, this vulnerability could allow an attacker, through a malicious app installed on your device, to access private Twitter data on your device (like Direct Messages) by working around Android system permissions that protect against this.

We donât have evidence that this vulnerability was exploited by attackers. But, because we canât be completely sure, here's what weâre doing to keep the small group of potentially vulnerable people safe:

Updated Twitter for Android to make sure external apps canât access Twitter in-app data by adding extra safety precautions beyond standard OS protections

Requiring anyone that may be impacted to update Twitter for Android

Sending in-app notices to everyone who could have been vulnerable to let them know if they need to do anything

Identifying changes to our processes to better guard against issues like this

To keep your Twitter data safe, please update to the latest version of Twitter for Android on all Android devices that you use to access Twitter. This issue did not impact Twitter for iOS or Twitter.com.

Your privacy and trust is important to us and we will continue working to keep your data secure on Twitter. If youâd like additional information regarding your account security, you can reach out to our Office of Data Protection through this form.
Click to expand...

Source: Twitter For Android Security Vulnerability

:)

Brink · Aug 5, 2020

Vulnerability within Twitter for Android Security Issue Now Fixed

We recently fixed a vulnerability within Twitter for Android that could allow a bad actor to see nonpublic account information or to control your account (i.e., send Tweets or Direct Messages). Prior to the fix, through a complicated process involving the insertion of malicious code into restricted storage areas of the Twitter app, it may have been possible for a bad actor to access information (e.g., Direct Messages, protected Tweets, location information) from the app.

We don’t have evidence that malicious code was inserted into the app or that this vulnerability was exploited, but we can’t be completely sure so we are taking extra caution.

We have taken steps to fix this issue and are directly notifying people who could have been exposed to this vulnerability either through the Twitter app or by email with specific instructions to keep them safe. These instructions vary based on what versions of Android and Twitter for Android people are using. We recommend that people follow these instructions as soon as possible. If you are unsure about what to do, update to the latest version of Twitter for Android. This issue did not impact Twitter for iOS.

We’re sorry this happened and will keep working to keep your information secure on Twitter. You can reach out to our Office of Data Protection through this form to request information regarding your account security.
Click to expand...

Source: Blog

Brink · Aug 5, 2020

New Microsoft Edge vulnerability discovered

Trailing along a number of vulnerabilities across Microsoft’s range of products recently, yet another major security flaw has been discovered. This time by security researcher Manuel Caballero, this latest flaw enables the theft of cookie and password data in Microsoft Edge, Microsoft’s default browser for Windows 10.

Using a series of techniques, cookie data, as well as passwords, can be retrieved for websites, such as Twitter and Facebook. In a video posted on YouTube, Caballero shows how this flaw could be used to access the “private” information:

vO6LRO6Sgcg
Click to expand...

Read more: New Microsoft Edge vulnerability discovered, leaks password and cookie data, such as Twitter and Facebook passwords | On MSFT

Update: Microsoft responds to 3 unpatched Microsoft Edge vulnerabilities, no fixes available yet | On MSFT

Brink · Aug 5, 2020

New StrandHogg vulnerability for Android

Promon security researchers have found proof of a dangerous Android vulnerability, dubbed ‘StrandHogg’, that allows real-life malware to pose as legitimate apps, with users unaware they are being targeted.

What’s the impact?

All versions of Android affected, incl. Android 10*

All top 500 most popular apps are at risk*

Real-life malware is exploiting the vulnerability

36 malicious apps exploiting the vulnerability was identified*

The vulnerability can be exploited without root access

When exploited by hackers

They can listen to the user through the microphone

Take photos through the camera

Read and send SMS messages

Make and/or record phone conversations

Phish login credentials

Get access to all private photos and files on the device

Get location and GPS information

Get access to the contacts list

Access phone logs

Click to expand...

Read more:

StrandHogg: Serious Android vulnerability leaves most apps vulnerable to attacks.

Android: New StrandHogg vulnerability is being exploited in the wild | ZDNet

Windows 10: Twitter for Android security vulnerability discovered and fixed

Twitter for Android security vulnerability discovered and fixed

Twitter for Android security vulnerability discovered and fixed

Twitter for Android security vulnerability discovered and fixed

Twitter for Android security vulnerability discovered and fixed - Similar Threads - Twitter Android security

Critically severe Windows vulnerability discovered

Update on Twitter security incident

Vulnerability within Twitter for Android Security Issue Now Fixed

New StrandHogg vulnerability for Android

VLC Security Vulnerability

Twitter discovered a bug in Account Activity API exposing data

McAfee discovers code execution vulnerability using Microsoft’s Cortana

New Microsoft Edge vulnerability discovered

Kaspersky Lab discovers Silverlight zero-day vulnerability