Twitter said that malicious actors, with potential ties to state-sponsored groups, were abusing a legitimate function on its platform to unmask the identity of users.
The social media giant said that on Dec. 24, 2019, it discovered a large network of fake accounts abusing a legitimate API (application programming interface) function on its platform that, when used as intended, allows accounts to find Twitter users that they may already know by matching phone numbers to their Twitter account names.
The bad actors were using this legitimate feature to uncover Twitter users – opening concerns that they could have potentially obtained the true identities of human rights activists or dissidents who go under pseudonyms on Twitter.
Twitter, which has a
user base of more than 68 million, said that the fake accounts were detected in a wide range of countries. However, a particularly high volume of requests were coming from individual IP addresses located within Iran, Israel, and Malaysia.
“It is possible that some of these IP addresses may have ties to state-sponsored actors. We are disclosing this out of an abundance of caution and as a matter of principle,” said Twitter
in a Monday statement. “We immediately suspended these accounts and are disclosing the details of our investigation to you today because we believe it’s important that you are aware of what happened, and how we fixed it.”
The API only matches users’ phone numbers and names if they have enabled the “Let people who have your phone number find you on Twitter” option. People who did not have this option enabled were not affected, said Twitter.
