Feeds

Leaked: The 'secret OAuth app keys' to Twitter's VIP lounge

Rogue apps could pose as micro-blogging site's Very Important Programs

Internet Security Threat Report 2014

Twitter's private OAuth login keys, used by the website's official applications to get preferential treatment from the micro-blogging site, have apparently been leaked. The secret credentials could now allow any software to masquerade as an approved Twitter client.

A set of key pairs uploaded to Github are supposedly used by Twitter for iPhone, Android, iPad, Mac OS X and Windows Phone, Twitter for Google TV, and TweetDeck. Once authenticated, these programs get access to features unavailable to clients that don't have Twitter's approval. But they need to store the keys somewhere on the user's computer or gadget, and it appears someone has found them.

The keys were first posted on the GitHub website five months ago, but were updated within the past day; GitHubbers claim the data is genuine.

So now unapproved apps could send this information to Twitter to impersonate the legitimate clients, circumventing access controls and blocks Twitter imposes on unofficial third-party software, Kaspersky Lab's news service Threatpost noted.

The micro-blogging site can create new keys and secrets for its apps, roll out updated versions of its software with the new login data, and only accept the new credentials - however, that'll break access to anyone who hasn't upgraded.

But before that happens, anyone can, in theory, write any old code that presents itself as an official app to Twitter and thus enjoy all the services available exclusively to the website's own gear, if the leak is genuine.

Twitter has used OAuth to authenticate approved third-party apps such as TweetDeck and others since August 2010. Facebook also uses the technology.

OAuth offers users the ability to sign into Twitter from software clients without having to faff around with usernames and passwords: third-party apps don't store the user's login credentials and their access can be revoked.

But the technology is not without its problems. For example, when Twitter detected a breach last month, and advised 250,000 early adopters of the micro-blogging service to change their passwords, the use of OAuth meant it was still possible for authenticated Twitter clients to post tweets without prompting user for their new password. In effect, Twitter for iPhone, Android, TweetDeck and the rest effectively stayed signed-in.

In the case of this week's Github post, the keys will need to be revoked and new credentials issued in order to resolve the problem - an effort that may just push Twitter into axing support for third-party applications altogether. We have approached Twitter for comment and will update this story if they get back to us. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.