Feeds

Leaked: The 'secret OAuth app keys' to Twitter's VIP lounge

Rogue apps could pose as micro-blogging site's Very Important Programs

Secure remote control for conventional and virtual desktops

Twitter's private OAuth login keys, used by the website's official applications to get preferential treatment from the micro-blogging site, have apparently been leaked. The secret credentials could now allow any software to masquerade as an approved Twitter client.

A set of key pairs uploaded to Github are supposedly used by Twitter for iPhone, Android, iPad, Mac OS X and Windows Phone, Twitter for Google TV, and TweetDeck. Once authenticated, these programs get access to features unavailable to clients that don't have Twitter's approval. But they need to store the keys somewhere on the user's computer or gadget, and it appears someone has found them.

The keys were first posted on the GitHub website five months ago, but were updated within the past day; GitHubbers claim the data is genuine.

So now unapproved apps could send this information to Twitter to impersonate the legitimate clients, circumventing access controls and blocks Twitter imposes on unofficial third-party software, Kaspersky Lab's news service Threatpost noted.

The micro-blogging site can create new keys and secrets for its apps, roll out updated versions of its software with the new login data, and only accept the new credentials - however, that'll break access to anyone who hasn't upgraded.

But before that happens, anyone can, in theory, write any old code that presents itself as an official app to Twitter and thus enjoy all the services available exclusively to the website's own gear, if the leak is genuine.

Twitter has used OAuth to authenticate approved third-party apps such as TweetDeck and others since August 2010. Facebook also uses the technology.

OAuth offers users the ability to sign into Twitter from software clients without having to faff around with usernames and passwords: third-party apps don't store the user's login credentials and their access can be revoked.

But the technology is not without its problems. For example, when Twitter detected a breach last month, and advised 250,000 early adopters of the micro-blogging service to change their passwords, the use of OAuth meant it was still possible for authenticated Twitter clients to post tweets without prompting user for their new password. In effect, Twitter for iPhone, Android, TweetDeck and the rest effectively stayed signed-in.

In the case of this week's Github post, the keys will need to be revoked and new credentials issued in order to resolve the problem - an effort that may just push Twitter into axing support for third-party applications altogether. We have approached Twitter for comment and will update this story if they get back to us. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
'Serious flaws in the Vertigan report' says broadband boffin
Report 'fails reality test' , is 'simply wrong' and offers ''convenient' justification for FTTN says Rod Tucker
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.