Ask HN: Massive vulnerability on Twitter?
It seems that you can make anybody follow you by tweeting "accept username". Does it work for you too? This looks like an awful vulnerability to me.
28 comments
I believe the 'Accept' is used when you are in private mode and you get notice that someone wants to follow you. So they don't check if the user is in the request queue. Bad bad programmer.
Good lord, how would twitter recover from that? Possibly by undoing follow's between the moment this bug has surfaced and the moment they suspend following. Meanwhile they'll loose a huge number of legitimate follow request. Terrible stuff.
Or find all statuses that have the pattern of "accept <valid_username>" and then removing <poster> from the <valid_username>'s followers.
That's not the hard part.
The hard part is that it seems that twitter wasn't checking accept messages to see if they were actually requests behind them or if the accepting user is actually a restricted account. So now they have to implement a mechanism that associates follow requests with follow acceptance.
Currently, the exchange is probably something like this behind the scenes: me: @restrictedUserIWantToFollow lemme follow you them: accept guyWhoWantsToFollowMe Everything simply implemented as twitter messages to facilitate cell phone usage. However, the accept message just assumes that there is a valid request being made and adds them to your followers.
Assumption: the mother of all foul-ups.
That's not the hard part.
The hard part is that it seems that twitter wasn't checking accept messages to see if they were actually requests behind them or if the accepting user is actually a restricted account. So now they have to implement a mechanism that associates follow requests with follow acceptance.
Currently, the exchange is probably something like this behind the scenes: me: @restrictedUserIWantToFollow lemme follow you them: accept guyWhoWantsToFollowMe Everything simply implemented as twitter messages to facilitate cell phone usage. However, the accept message just assumes that there is a valid request being made and adds them to your followers.
Assumption: the mother of all foul-ups.
2nd Assumption: Twitter stores commands that don't get posted as statuses.
LOL... sorry but when you say it that way it's actually pretty funny.
If that works there must be other "cool" commands the coder added after implementing this one...
It's not just a false display, either; it's a real follow: I tried it against my main account using a secondary account, posted a tweet, and then checked Twitterrific on my main account. The new tweet was right there at the top.
Ah, the joys of in-band signaling. Now, where'd I put my blue box?
http://twitter.com/conanobrien yep it is working. Conan is following 23 people now. He only follows one person.
It looks like this guy is the one who discovered it:
http://twitter.com/borakrc
http://twitter.com/borakrc
Sorry, the profile you are trying to view has been suspended.
Wow, that was quick (or the timing was just right) - it was available 10 minutes ago.
and his account has been suspended.
All twitter accounts are reporting 0 followers / 0 following. This is going to be a fascinating study on how Twitter manages crises.
The number of conanobrien's "friends" is going up ...
I am one of them! Definitely strange how twitter would allow these "commands"...
It seems they are doing something about it already, the few 'high profile' users I checked now have 0 following and followers.
Looks like they are fixing the problem, everyone has 0 followers and 0 following right now.
Looks like they're working on it... following/followers counts are blank for everyone
Seems to be fixed. I get an internal server error now. Damn, that was interesting.
[deleted]
DO NOT DO IT! I just attempted an Accept BillGates and both my "followers" and "following" are reset to zero. this better be a bug. http://twitter.com/faramarzhashemi
Confirmed and it works, nice catch.
How do you find it?
How do you find it?
It works through the mobile web too
Stephen Fry is following me XD
Good thing they have OAuth.
yep me too, 0 and 0 after testing it . . .
Fail. Whale.
confirmed it works
Just lost all my followers and the people i was following!!!! OMG!!!! Twitter took action.