Categories
More and more cyber threat actors are active everywhere due to the advancement of technology. According to the most recent news, researchers have found a weakness in Twitter’s recommendation algorithm. Yep, you heard correctly. The designation CVE -2023-29218, given to this new vulnerability, denotes the official awareness of the threat it may provide to cyber security.
We will learn in this blog what the Twitter Algorithm is for, how Denial of Service assaults operate, how this algorithm functions, and the precautions that must be taken to prevent cyberattacks.
Table of Content
What Actually Happened?
Twitter is a well-known company that attempts to inform users of what’s happening globally and continuously keeps them up to date. After taking over by Elon Musk, Twitter decided to open source its Twitter recommendation algorithm source code. The reason behind it was to show how Twitter recommends tweets to its user. Soon after releasing its recommendation algorithm exposed a section of its source code online earlier this month, and shortly after the release, Security researchers found that the attacker can manipulate to mute a specific account on Twitter. A developer also flagged this issue on GitHub. MITRE also assigned CVE to that specific Twitter code that addresses this vulnerability.
The flaw can allow attackers to cause DoS attacks on Twitter accounts and reduce their reputation score. This can be done by using multiple accounts to mute, unfollow or block a specific account to reduce that account’s reputation on Twitter.
A botnet activist informed us that this is how someone can create a botnet army and use them to ban, lowering the account tweet view.
Twitter has responded to the vulnerability by “💩” emoji.
However Musk said on Twitter space: “It’s going to be quite embarrassing, and people are going to find a lot of mistakes, but we’re going to fix them very quickly,”
What Issues Exist with Open-Source Code?
It can be more transparent and encourage other developers to contribute if the code is published on open-source websites like Github. As a result, organizations are able to enhance the software’s features, functionality, and code quality.
Organizations must, nevertheless, also deal with a few difficulties. The code is open source, so anyone may inspect and check it out. The vulnerability of open-source software can potentially be revealed. This aids in lowering the organization’s attack surface but, if discovered by a malicious actor, has the potential to have a large-scale effect on many other organizations.
A security researcher identified the vulnerability in Twitter and informed Twitter of it. There’s a chance that someone is already abusing this algorithmic flaw.
Why this attack was called DDoS?
A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic on a targeted network, server, or service by overloading the target web service with excessive traffic from two or more compromised computer systems.
For a DDoS attack to be successful, the attacker must take control of a network of running computers. Attackers infect computers and other machines, such as Internet of Things (IoT) devices, with malware, turning them into zombie or bot machines that the attackers may control.
The attacker can employ several bots on Twitter to shut down a reputable user’s account or service.
What can be Done to Prevent Such Attacks?
There is no question that open-sourcing code can result in high-quality software development, but organizations cannot ignore the hazard it exposes. This vulnerability exists as a result of Twitter’s decision to give its algorithm code to the open-source community. However, there are some preventative steps that an organization can follow.
- Secure code Review: Reviewing the source code and implementing the SDLC (Software Development Life Cycle) approach might assist organizations in preventing these attacks.
- Continuous Monitoring: Regular code and application security audits are necessary to prevent vulnerabilities from having to be fixed with each new version of the software.
- Authentication and Authorization mechanism: Implement limitations on who and how someone can make modifications to your program; don’t let everyone edit your code. Even on GitHub, carefully review the modifications made before accepting them.
Kratikal’s Role
Kratikal, a cert-in empanelled organization helps in the prevention of such attacks. Organizations need to begin putting potential cyber security practices and procedures into action to maintain their security and build a workplace that is cyber resilient. Additionally, Kratikal’s proficiency in putting in place sophisticated security measures like reverse proxies, DNS protection, and two-factor authentication can assist organizations in remaining ahead of the changing threat landscape and guaranteeing the security of their data and infrastructure.
With Kratikal’s all-inclusive cybersecurity solutions, businesses can reduce the risk of cyberattacks and guarantee that their operations are secure from any potential threats.
We are grateful that you took the time to read this blog. Please feel free to comment below with your thoughts.
About The Author
