A Twitter app bug was used to match 17M phone numbers to user accounts

Re:A Twitter app bug was used to match 17M phone numbers to ... by yzmtf2008 on Tuesday December 24, 2019 @06:35PM (#21875660)

At a public company like Twitter, for SOX compliance reasons, it will be very difficult to find someone that has such permissions, and running anything unusual can be easily found by auditing. I'd stop with the conspiracy theories.

[ Parent | on HN ]

Re:A Twitter app bug was used to match 17M phone numbers to ... by lwf on Tuesday December 24, 2019 @06:47PM (#21875705)

https://www.washingtonpost.com/national-security/former-twit...

In general, most companies want to scope SOX as narrowly as possible. So if you can, only things that your auditors think will affect revenue reporting.

Querying ads performance data? Sure, we'll SOXify it. Querying user accounts writ large? "Meh, our engineers need to be productive."

[ Parent | on HN ]

Re:A Twitter app bug was used to match 17M phone numbers to ... by nl on Tuesday December 24, 2019 @07:25PM (#21875877)

SOX doesn't really stop this kind of prying, and it has happened in the past.

https://www.npr.org/2019/11/07/777352750/how-saudi-arabia-us...

[ Parent | on HN ]

Re:A Twitter app bug was used to match 17M phone numbers to ... by RijilV on Tuesday December 24, 2019 @07:51PM (#21875981)

SOX is about financial compliance. It is not a computer security standard.

I’ve worked for lots of SOX companies as a third party and had root/sqlplus on most of them. There’s really to relationship between SOX and security.

[ Parent | on HN ]

Re:A Twitter app bug was used to match 17M phone numbers to ... by t34543 on Tuesday December 24, 2019 @06:53PM (#21875737)

There are always weaknesses and internal vulnerabilities in every system.

If it was from the inside more likely a privileged user was compromised. It could also explain why Twitter is being quiet, especially if the investigation is ongoing.

[ Parent | on HN ]