EXECUTIVE SUMMARY:
Twitter’s security poses a threat to its users’ information, to its shareholders, to national security and to democracy at-large, according to a whistleblower disclosure presented to The Washington Post and CNN. In addition to describing egregious negligence and recklessness, the disclosure alleges that some of the company’s senior executives have covered up security vulnerabilities and that one or more employees may work for a foreign intelligence service.
The whistleblower is Twitter’s former security chief Peiter “Mudge” Zatko, who asserts that he and his team were discouraged from providing a full account of Twitter’s security issues to the company’s board. Zatko contends that the executive team ordered him to knowingly present cherry-picked and misrepresented data to stakeholders, creating a perception of security improvements. Further documentation suggests that executives brought in a third-party consulting firm to hide the full extent of the company’s security problems.
The disclosure
The whistleblower disclosure totals roughly 200 pages, and includes supporting exhibits. Among a litany of contentions, the author estimates that 4 in 10 computing devices failed to meet basic security standards and that server infrastructure presented a serious vulnerability. Specifically, about 500,000 of the company’s servers operate with outdated software that does not appear to support critical security features, such as encryption for stored data.
More concerning is the allegation that the production environment was impossible to secure. Says the report, every engineer could access the production environment, which amounted to roughly 50% of the company. “There was no logging of who went into the environment or what they did…Nobody knew where data lived or whether it was critical…”
Following the January 6th insurrection in the United States, Zatko worried that a politically motivated insider might attempt to quietly manipulate the company’s production environment and that the actions would be nearly untraceable.
The disclosure goes on to describe insufficient redundancies and procedures to restart or recover from data center crashes. In other words, relatively minor outages at data centers could disrupt the entirety of the company’s operations, harming consumer relationships, business profitability and undermining public and private trust in the company.
Concerns in 2010
In 2010, the US Federal Trade Commission formally submitted a compliant to Twitter concerning how it handled users’ private information. The complaint also addressed the issue of widespread employee access to the production environment and Twitter’s central controls. The following year, Twitter vowed to enhance security through multiple means, including via the creation of a “comprehensive information security program.”
Twitter’s compliance
Zatko contends that, despite the company’s claims, it has never been in compliance with the FTC’s demands and subsequent promises made to the FTC. According to Zatko, the company suffers roughly one serious security incident per week. “Based on my professional experience, peer companies do not have this magnitude or volume of incidents,” wrote Zatko in a February 2022 letter to Twitter’s board.
Twitter response
Twitter released a statement saying that the company’s compliance record speaks for itself, referencing third-party audits filed with the FTC in 2011. Twitter also says that it remains in compliance with relevant privacy regulations and that it has been transparent with regulators in regards to fixing issues.
Zatko’s allegations stem from lack of understanding around Twitter’s existing programs and processes, and how they work to fulfill Twitter’s FTC obligations, said a spokesperson familiar with the matter. A misunderstanding bellies Zatko’s inaccurate claims regarding the company’s levels of compliance.
How many spam bots?
Zatko’s allegations emerge at an interesting time, as Elon Musk attempts to back out of buying the company. Musk alleges that Twitter has provided inaccurate information about the number of spam bots on the platform, saying that the issue is sufficient as to warrant termination of the deal.
According to Musk, the number of bots affects the user experience. In addition, more bots may also impact the company’s long-term value. Twitter responded with a lawsuit contending that Musk intends to use the bots as a pretext for terminating the deal.
The exact user metrics are important for a social media company. The number of real people vs. bots affects how many humans will see an advertisement, which affects advertising revenue streams. Twitter shares this data with investors and advertisers using a metric called ‘monetizable daily active users’ or mDAU. In the past, Twitter has reported that less than 5% of its mDAUs are fake. Zatko’s disclosure contends that reporting number of bots as a percentage obscures the true number of bots affecting the site.
Twitter states that Zatko’s claim around bot measurement lacks context. The company notes that not all bots are bad and that focusing on a total number of bots would potentially include those that the company has already counted and taken action against. Regular suspension and removal of bots are a part of the company’s everyday activities. More than 1 million spam accounts are removed each day.
Twitter allegations and Congress
House Homeland Security Chair Bennie Thompson (D-Miss.) issued a statement noting that the allegations “raise serious questions about Twitter’s commitment to securing user data – whether that means keeping it out of the hands of disgruntled employees, hackers or foreign dictators.”
Republican representative (R-NY) John Katko wrote in an email “These allegations could have serious national security, privacy and election security implications.” Katko adds that Zatko’s charges “must be aggressively investigated.” The sentiment was echoed by Senator Chuck Grassley (R-Iowa), the top Republican on the Senate Judiciary Committee, and Senate Judiciary Chair Dick Durbin (D-Ill).
For more on this emerging story, visit The Wall Street Journal. Lastly, if you would like more authoritative information, timely trend insights, and interviews with experts, sign up for the CyberTalk.org newsletter.
The post Ex-Twitter security chief alleges ‘egregious’ and ‘reckless’ practices appeared first on CyberTalk.
Leer másCyberTalk
