Connect with us

Hi, what are you looking for?


Data Protection

Bug in Twitter Android App Exposed Protected Tweets

Twitter revealed on Thursday that users of its Android application may have had their supposedly protected tweets made public due to a bug.

Twitter revealed on Thursday that users of its Android application may have had their supposedly protected tweets made public due to a bug.

When a new Twitter account is created, the tweets posted by the user are public by default. However, users can ensure that only approved followers can see their posts by using the “Protect my Tweets” option from the account’s “Privacy and safety” settings.

However, due to a flaw, people who used Twitter for Android may have had the protected tweets setting disabled if they made certain changes to account settings, such as modifying the associated email address.

Twitter patches new privacy bugAccording to the social media giant, the bug existed between November 3, 2014, and January 14, 2019, when a patch was released.

Twitter says it has notified impacted users and re-enabled the protected tweets option if it was disabled. The company claims the flaw did not impact the iOS app or the web version.

“We are providing this broader notice through the Twitter Help Center since we can’t confirm every account that may have been impacted. We encourage you to review your privacy settings to ensure that your ‘Protect your Tweets’ setting reflects your preferences,” Twitter said.

This is not the first time in recent months that Twitter has disclosed information exposure bugs. In May of last year, Twitter warned users that a bug caused plaintext passwords to be stored in its internal logs.

In September, the company reported that a flaw exposed the direct messages of millions of users to third-party developers for well over a year. In December, a researcher revealed the existence of a vulnerability that resulted in Twitter apps getting more permissions than they claimed.

In mid-December, Twitter told users that it may have been targeted in a state-sponsored attack. The incident was discovered during the analysis of an information disclosure flaw affecting one of its support forums.

Advertisement. Scroll to continue reading.

Related: New Twitter Rules Target Fake Accounts, Hackers

Related: New Open Source Tools Help Find Large Twitter Botnets

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.


The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Artificial Intelligence

Two of humanity’s greatest drivers, greed and curiosity, will push AI development forward. Our only hope is that we can control it.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...