Twitter’s response to data leaks is a lesson in how not to do cybersecurity • TechCrunch

Twitter finally broke his silence on the first security incident of the Musk era: an alleged data breach that exposed the contact details of millions of users.

In late December, a poster on a popular cybercrime forum claimed to have harvested the email addresses and phone numbers of 400 million Twitter users through a zero-day security flaw in Twitter’s systems. , previously accused of exposing at least 5 million Twitter accounts before it was patched in January 2022. The subsequent sale of another smaller dataset containing the email addresses associated with more than 235 million Twitter accounts would be a cleaned up version of Twitter’s alleged 400 million user dataset. The researchers warned that the email addresses, which included details of politicians, journalists and public figures, could be used to dox pseudonymous accounts.

Twitter, or what’s left of the company, looked into the situation Last week.

In a unattributed blog post, Twitter said it conducted a “thorough investigation” and found “no evidence” that the data sold online was obtained by exploiting a vulnerability in Twitter’s systems. A lack of evidence, however, is no justification, as it is unclear whether Twitter has the technical means, such as logs, to determine whether user data has been exfiltrated. Instead, the company said the hackers likely circulated a collection of data extracted from past breaches and said the data did not match any of the data obtained by exploiting the bug which was patched in January 2022.

What Twitter says may very well be true, but it’s hard to trust the company’s statement. Twitter’s erratic response raises many of the same questions regulators will want to know: Who was tasked with investigating this breach, and does Twitter have the resources to do a thorough job?

An important lesson about what not make