Twitter and Facebook have announced that personal data of hundreds of users may have been compromised after they used their accounts to log in to certain third-party apps. This includes their names, gender, email addresses, usernames, and possibly their most recent tweets.
Both companies received a report from security researchers who found that a software development kit called One Audience, allowed third party developers to access personal data.
“We recently received a report about a malicious mobile software development kit (SDK) maintained by oneAudience. We are informing you about this today because we believe we have a responsibility to inform you of incidents that may impact the safety of your personal data or Twitter account,” Twitter wrote in a blog post on Monday.
Apps usually ask for access to users’ social media accounts such as Facebook and Twitter to offer extra features such as the ability to share achievements and in-game leaderboards. However, apps using this SDK potentially allowed third-party developers to access much more data than users originally intended to.
The company also notes that it might have been possible for someone to take control of someone else’s Twitter account using this vulnerability, however, no evidence in this regard has been found yet.
“We think it’s important for people to be aware that this exists out there and that they review the apps that they use to connect to their accounts,” said Lindsay McCallum, a Twitter spokeswoman.
For now, the vulnerability only seems to affect Twitter users on Android, as no evidence has been found yet that suggests iOS users were also impacted.
Twitter said it has informed Google and Apple about the vulnerability so that they can take evasive measures. The company also said it will be informing Twitter users impacted by this vulnerability.
