Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies

Joined
Mar 6, 2004
Messages
41,699
Twitter has major security problems that pose a threat to its own users' personal information, to company shareholders, to national security, and to democracy, according to an explosive whistleblower disclosure obtained exclusively by CNN and The Washington Post.

The disclosure, sent last month to Congress and federal agencies, paints a picture of a chaotic and reckless environment at a mismanaged company that allows too many of its staff access to the platform's central controls and most sensitive information without adequate oversight. It also alleges that some of the company's senior-most executives have been trying to cover up Twitter's serious vulnerabilities, and that one or more current employees may be working for a foreign intelligence service.

The whistleblower, who has agreed to be publicly identified, is Peiter "Mudge" Zatko, who was previously the company's head of security, reporting directly to the CEO. Zatko further alleges that Twitter's leadership has misled its own board and government regulators about its security vulnerabilities, including some that could allegedly open the door to foreign spying or manipulation, hacking and disinformation campaigns. The whistleblower also alleges Twitter does not reliably delete users' data after they cancel their accounts, in some cases because the company has lost track of the information, and that it has misled regulators about whether it deletes the data as it is required to do. The whistleblower also says Twitter executives don't have the resources to fully understand the true number of bots on the platform, and were not motivated to. Bots have recently become central to Elon Musk's attempts to back out of a $44 billion deal to buy the company (although Twitter denies Musk's claims).

 

Arksun

Expert Member
Joined
Nov 1, 2010
Messages
1,803
I don't know any people that use any personal info on Twitter. Only stupid people need to be concerned.

Cyber security 101: Never use your main email account on sites like Twitter and Reddit. Sign up for an anonymous email address at proton mail and use that. Never use the same nickname you use on other sites and forum. Use something that can't be traced back to you in a simple Google search. A VPN should by now be part of your standard monthly internet bill. Lastly, hide your power level. Never post any personal information that can be used to identify you.
 

konfab

Honorary Master
Joined
Jun 23, 2008
Messages
36,120
Good grief, by the end of this Twitter's board is going to be begging Musk for $10 a share.
But, the disclosure says, Zatko soon learned "it was impossible to protect the production environment. All engineers had access. There was no logging of who went into the environment or what they did.... Nobody knew where data lived or whether it was critical, and all engineers had some form of critical access to the production environment." Twitter also lacked the ability to hold workers accountable for information security lapses because it has little control or visibility into employees' individual work computers, Zatko claims, citing internal cybersecurity reports estimating that 4 in 10 devices do not meet basic security standards.
No wonder Twitter seemingly only censors one side of the political debate. Everyone and their dog seems to have access to the production environment. No audit trails nothing.
 

r00igev@@r

Honorary Master
Joined
Dec 14, 2009
Messages
12,114

ForceFate

Honorary Master
Joined
May 18, 2009
Messages
41,140
I don't know any people that use any personal info on Twitter. Only stupid people need to be concerned.

Cyber security 101: Never use your main email account on sites like Twitter and Reddit. Sign up for an anonymous email address at proton mail and use that. Never use the same nickname you use on other sites and forum. Use something that can't be traced back to you in a simple Google search. A VPN should by now be part of your standard monthly internet bill. Lastly, hide your power level. Never post any personal information that can be used to identify you.
Breaches happen everywhere, including institutions where they keep everything from your credit history to health info.

No, I don't use my primary email address for social media and games.
 

Pegasus

Honorary Master
Joined
May 17, 2004
Messages
13,976
I don't know any people that use any personal info on Twitter. Only stupid people need to be concerned.

Cyber security 101: Never use your main email account on sites like Twitter and Reddit. Sign up for an anonymous email address at proton mail and use that. Never use the same nickname you use on other sites and forum. Use something that can't be traced back to you in a simple Google search. A VPN should by now be part of your standard monthly internet bill. Lastly, hide your power level. Never post any personal information that can be used to identify you.
The people with blue check marks generally use their real names and information.
Also DM’s are used for personal things.
 

Temujin

Honorary Master
Joined
Apr 18, 2015
Messages
18,312
Good grief, by the end of this Twitter's board is going to be begging Musk for $10 a share.

No wonder Twitter seemingly only censors one side of the political debate. Everyone and their dog seems to have access to the production environment. No audit trails nothing.
 

Arksun

Expert Member
Joined
Nov 1, 2010
Messages
1,803
The people with blue check marks generally use their real names and information.
Also DM’s are used for personal things.
Yep, and blue check marks tend to get them fired for having unpopular opinions.
 

B-1

Executive Member
Joined
Apr 17, 2020
Messages
5,546
Its something that doesn't get talked about often but security is usually pretty low down on the list of things that need to get done. It can take a lot of moaning before time is allowed to clean things up or implement new security features. I've seen this across a lot of different industries. Its a similar case of working in a restaurant and seeing all the flaws and problems and not trusting the food there.
 

konfab

Honorary Master
Joined
Jun 23, 2008
Messages
36,120
Its something that doesn't get talked about often but security is usually pretty low down on the list of things that need to get done. It can take a lot of moaning before time is allowed to clean things up or implement new security features. I've seen this across a lot of different industries. Its a similar case of working in a restaurant and seeing all the flaws and problems and not trusting the food there.
Well it is like any form of good engineering. You never notice good engineering.
 
  • Like
Reactions: B-1
Top