WingNews logo WingNews GitHub [2]
top | item 1334735

Ask HN: Massive vulnerability on Twitter?

57 points| hcho | 16 years ago | reply

It seems that you can make anybody follow you by tweeting "accept username". Does it work for you too? This looks like an awful vulnerability to me.

48 comments

order
[+] trickjarrett|16 years ago|reply
I believe the 'Accept' is used when you are in private mode and you get notice that someone wants to follow you. So they don't check if the user is in the request queue. Bad bad programmer.
[+] hcho|16 years ago|reply
Good lord, how would twitter recover from that? Possibly by undoing follow's between the moment this bug has surfaced and the moment they suspend following. Meanwhile they'll loose a huge number of legitimate follow request. Terrible stuff.
[+] bena|16 years ago|reply
Or find all statuses that have the pattern of "accept <valid_username>" and then removing <poster> from the <valid_username>'s followers.

That's not the hard part.

The hard part is that it seems that twitter wasn't checking accept messages to see if they were actually requests behind them or if the accepting user is actually a restricted account. So now they have to implement a mechanism that associates follow requests with follow acceptance.

Currently, the exchange is probably something like this behind the scenes: me: @restrictedUserIWantToFollow lemme follow you them: accept guyWhoWantsToFollowMe Everything simply implemented as twitter messages to facilitate cell phone usage. However, the accept message just assumes that there is a valid request being made and adds them to your followers.

Assumption: the mother of all foul-ups.

[+] nkm|16 years ago|reply
I suppose they have a record of all the commands executed.
[+] igorgue|16 years ago|reply
LOL... sorry but when you say it that way it's actually pretty funny.
[+] codesink|16 years ago|reply
If that works there must be other "cool" commands the coder added after implementing this one...
[+] mortenjorck|16 years ago|reply
It's not just a false display, either; it's a real follow: I tried it against my main account using a secondary account, posted a tweet, and then checked Twitterrific on my main account. The new tweet was right there at the top.
[+] kevinp|16 years ago|reply
Ah, the joys of in-band signaling. Now, where'd I put my blue box?
[+] icey|16 years ago|reply
All twitter accounts are reporting 0 followers / 0 following. This is going to be a fascinating study on how Twitter manages crises.
[+] th0ma5|16 years ago|reply
looks like they are getting on top of it, it is on mashable, and i now have 0 followers and am following 0. nice fun, best pr would be to clean it up, and publish who did what and when (hahah)
[+] icey|16 years ago|reply
Kudos to Twitter for taking action quickly at least.
[+] balu|16 years ago|reply
That's quite funny. I just wanted to try this out and received an internal server error. Now all my followers are gone nor am I still following anyone. Twitter strikes back!
[+] benatkin|16 years ago|reply
It's 0 for me, and I didn't send an "accept" tweet.
[+] alexro|16 years ago|reply
The number of conanobrien's "friends" is going up ...
[+] jasonrojas|16 years ago|reply
I am one of them! Definitely strange how twitter would allow these "commands"...
[+] bittersweet|16 years ago|reply
It seems they are doing something about it already, the few 'high profile' users I checked now have 0 following and followers.
[+] jashmenn|16 years ago|reply
Looks like they are fixing the problem, everyone has 0 followers and 0 following right now.
[+] fname|16 years ago|reply
Looks like they're working on it... following/followers counts are blank for everyone
[+] endlessvoid94|16 years ago|reply
Seems to be fixed. I get an internal server error now. Damn, that was interesting.
[+] sgtpepper|16 years ago|reply
What about "reject"? Can you get people to UNFOLLOW you as well?
[+] bena|16 years ago|reply
Yeah, block them, then they won't be able to follow you. Although if your timeline is not private they can still read your feed at twitter.com/yourname
[+] fname|16 years ago|reply
you might, but not using reject.
[+] faramarz|16 years ago|reply
DO NOT DO IT! I just attempted an Accept BillGates and both my "followers" and "following" are reset to zero. this better be a bug. http://twitter.com/faramarzhashemi
[+] uptown|16 years ago|reply
Actually, I didn't do it .... and everything is set to 0's on my profile as well. Either it's part of their clean-up, or their attempts to fix this accidentally wiped everybody back to zero.
[+] tszming|16 years ago|reply
Confirmed and it works, nice catch.

How do you find it?

[+] nkm|16 years ago|reply
It works through the mobile web too