

Ask HN: Massive vulnerability on Twitter? - hcho

It seems that you can make anybody follow you by tweeting "accept username". Does it work for you too? This looks like an awful vulnerability to me.
======
trickjarrett
I believe the 'Accept' is used when you are in private mode and you get notice
that someone wants to follow you. So they don't check if the user is in the
request queue. Bad bad programmer.

------
hcho
Good lord, how would twitter recover from that? Possibly by undoing follow's
between the moment this bug has surfaced and the moment they suspend
following. Meanwhile they'll loose a huge number of legitimate follow request.
Terrible stuff.

~~~
bena
Or find all statuses that have the pattern of "accept <valid_username>" and
then removing <poster> from the <valid_username>'s followers.

That's not the hard part.

The hard part is that it seems that twitter wasn't checking accept messages to
see if they were actually requests behind them or if the accepting user is
actually a restricted account. So now they have to implement a mechanism that
associates follow requests with follow acceptance.

Currently, the exchange is probably something like this behind the scenes: me:
@restrictedUserIWantToFollow lemme follow you them: accept
guyWhoWantsToFollowMe Everything simply implemented as twitter messages to
facilitate cell phone usage. However, the accept message just assumes that
there is a valid request being made and adds them to your followers.

Assumption: the mother of all foul-ups.

~~~
jaxn
2nd Assumption: Twitter stores commands that don't get posted as statuses.

------
codesink
If that works there must be other "cool" commands the coder added after
implementing this one...

------
mortenjorck
It's not just a false display, either; it's a real follow: I tried it against
my main account using a secondary account, posted a tweet, and then checked
Twitterrific on my main account. The new tweet was right there at the top.

------
kevinp
Ah, the joys of in-band signaling. Now, where'd I put my blue box?

------
wherespaul
<http://twitter.com/conanobrien> yep it is working. Conan is following 23
people now. He only follows one person.

------
icey
It looks like this guy is the one who discovered it:

<http://twitter.com/borakrc>

~~~
mortenjorck
_Sorry, the profile you are trying to view has been suspended._

~~~
icey
Wow, that was quick (or the timing was just right) - it was available 10
minutes ago.

------
icey
All twitter accounts are reporting 0 followers / 0 following. This is going to
be a fascinating study on how Twitter manages crises.

------
th0ma5
looks like they are getting on top of it, it is on mashable, and i now have 0
followers and am following 0. nice fun, best pr would be to clean it up, and
publish who did what and when (hahah)

~~~
icey
Kudos to Twitter for taking action quickly at least.

------
balu
That's quite funny. I just wanted to try this out and received an internal
server error. Now all my followers are gone nor am I still following anyone.
Twitter strikes back!

~~~
benatkin
It's 0 for me, and I didn't send an "accept" tweet.

~~~
balu
Funny though ;-) Those guys are quick!

------
alexro
The number of conanobrien's "friends" is going up ...

~~~
jasonrojas
I am one of them! Definitely strange how twitter would allow these
"commands"...

------
bittersweet
It seems they are doing something about it already, the few 'high profile'
users I checked now have 0 following and followers.

------
jashmenn
Looks like they are fixing the problem, everyone has 0 followers and 0
following right now.

------
fname
Looks like they're working on it... following/followers counts are blank for
everyone

------
endlessvoid94
Seems to be fixed. I get an internal server error now. Damn, that was
interesting.

------
sgtpepper
What about "reject"? Can you get people to UNFOLLOW you as well?

~~~
bena
Yeah, block them, then they won't be able to follow you. Although if your
timeline is not private they can still read your feed at twitter.com/yourname

------
faramarz
DO NOT DO IT! I just attempted an _Accept BillGates_ and both my "followers"
and "following" are reset to zero. this better be a bug.
<http://twitter.com/faramarzhashemi>

~~~
uptown
Actually, I didn't do it .... and everything is set to 0's on my profile as
well. Either it's part of their clean-up, or their attempts to fix this
accidentally wiped everybody back to zero.

~~~
faramarz
Yea.. Sorry folks. Pre-mature panic. Looks like a site-wide event

------
tszming
Confirmed and it works, nice catch.

How do you find it?

------
nkm
It works through the mobile web too

------
robinduckett
Stephen Fry is following me XD

------
JakaJancar
Good thing they have OAuth.

------
rondobley
yep me too, 0 and 0 after testing it . . .

------
angilly
conan is following me too.

wow.

~~~
tszming
obama is following me :)

~~~
angilly
... ditto. :)

------
dualboot
Fail. Whale.

------
TotlolRon
Massive oil spill on the social graph. Cleaning would be just as fun.

~~~
cyanbane
Perfect analogy. Looks like Twitter is resetting followers/followees as we
speak for people trying it. Is this their 4 story containment unit?

------
shareme
confirmed it works

------
jffortier
Just lost all my followers and the people i was following!!!! OMG!!!! Twitter
took action.

