Twitter Bug Allowed Researcher to Match 17 Million Phone Numbers to User Accounts: Report

Twitter has had a busy year quashing some annoying bugs. From dropping notifications every time someone unfollowed a user to mislabelled retweets, Twitter users have seen it all. But as the year comes to an end, the social networking giant may have one more issue to deal with. A security researcher claims he was able to match 17 million phone numbers to actual Twitter accounts, exposing a flaw in Twitter's Android mobile app. He said the bug is only present on the Android app.

Ibrahim Balic, a security researcher, told TechCrunch that he was able to upload a large list of mobile phone numbers using the contacts upload feature on Twitter's Android app. When users upload a phone number, Twitter fetches relevant matching user data.

Balic explained that Twitter doesn't allow users to upload lists of phone numbers in a sequence. So he worked around the constraint by generating over two billion mobile phone numbers and then sorted them in random order. He then uploaded the entire list to Twitter via the company's Android app. The security researcher claims he was able to match mobile phone numbers from users in several countries including Iran, Israel, Greece, Armenia, France, Germany, and others.

Twitter blocked Balic's attempts on December 20 this year, claims the researcher. Balic was able to match mobile phone numbers of high-profile Twitter users which included politicians and government officials. He warned them directly via WhatsApp instead of notifying Twitter. TechCrunch reported that Twitter is working on fixing the issue to ensure the bug can't be exploited by others.

Last weekend, Twitter asked its Android app users to update the app. The social networking platform claimed it fixed a serious security vulnerability and all users must update the app on their Android devices to stay secure. It's still unclear whether this new version of the app fixed the bug Balic exposed.

Earlier this year, Twitter admitted that 'bugs' were impacting the company's advertising revenue. In June 2019, a bug on Twitter started notifying users every single time someone unfollowed them. The issue affected a specific number of Twitter users and the company fixed it later on.