Researchers from cybersecurity firm CloudSEK have uncovered about 3,207 mobile apps that reveal Twitter API keys, which is dangerous because it could allow attackers to gain unauthorized access to accounts associated with those keys.
To gain access to the Twitter API, secret keys and access tokens must be generated. These keys act as usernames and passwords for the apps and also as the users on whose behalf the API requests are made.
One of the dangerous consequences of these keys in the hands of a threat actor is the fact that they can be used to create a bot army that could potentially be used to spread misinformation on the social media platform.
In a hypothetical scenario, the API keys and tokens extracted from the mobile apps can be embedded in a program to conduct large-scale malware campaigns through verified accounts to target their followers.
The key leak is not limited to Twitter APIs.
In order to mitigate attacks from exposed API keys, it is important to check the code for directly hard-coded API keys. It is also important that keys are rotated periodically, as this will help to reduce the probable risks from a leak.
The sources for this piece include an article in TheHackerNews.