Researchers discover 3,207 mobile apps that reveal Twitter API keys

Researchers from cybersecurity firm CloudSEK have uncovered about 3,207 mobile apps that reveal Twitter API keys, which is dangerous because it could allow attackers to gain unauthorized access to accounts associated with those keys.

To gain access to the Twitter API, secret keys and access tokens must be generated. These keys act as usernames and passwords for the apps and also as the users on whose behalf the API requests are made.

One of the dangerous consequences of these keys in the hands of a threat actor is the fact that they can be used to create a bot army that could potentially be used to spread misinformation on the social media platform.

In a hypothetical scenario, the API keys and tokens extracted from the mobile apps can be embedded in a program to conduct large-scale malware campaigns through verified accounts to target their followers.

The key leak is not limited to Twitter APIs.

In order to mitigate attacks from exposed API keys, it is important to check the code for directly hard-coded API keys. It is also important that keys are rotated periodically, as this will help to reduce the probable risks from a leak.

The sources for this piece include an article in TheHackerNews.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web