{"id":48121,"date":"2022-08-23T13:22:55","date_gmt":"2022-08-23T13:22:55","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33760\/Mudge-Blows-The-Whistle-On-Twitters-Security.html"},"modified":"2022-08-23T13:22:55","modified_gmt":"2022-08-23T13:22:55","slug":"mudge-blows-the-whistle-on-twitters-security","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/mudge-blows-the-whistle-on-twitters-security\/","title":{"rendered":"Mudge Blows The Whistle On Twitter’s Security"},"content":{"rendered":"

Twitter has major security problems that pose a threat to its own users\u2019 personal information, to company shareholders, to national security, and to democracy, according to an explosive whistleblower disclosure obtained exclusively by CNN and The Washington Post. <\/p>\n

The disclosure, sent last month to Congress and federal agencies, paints a picture of a chaotic and reckless environment at a mismanaged company that allows too many of its staff access to the platform\u2019s central controls and most sensitive information without adequate oversight. It also alleges that some of the company\u2019s senior-most executives have been trying to cover up Twitter\u2019s serious vulnerabilities, and that one or more current employees may be working for a foreign intelligence service. <\/p>\n

The whistleblower, who has agreed to be publicly identified, is Peiter \u201cMudge\u201d Zatko, who was previously the company\u2019s head of security, reporting directly to the CEO. Zatko further alleges that Twitter\u2019s leadership has misled its own board and government regulators about its security vulnerabilities, including some that could allegedly open the door to foreign spying or manipulation, hacking and disinformation campaigns. The whistleblower also alleges Twitter does not reliably delete users\u2019 data after they cancel their accounts, in some cases because the company has lost track of the information, and that it has misled regulators about whether it deletes the data as it is required to do. The whistleblower also says Twitter executives don\u2019t have the resources to fully understand the true number of bots on the platform, and were not motivated to. Bots have recently become central to Elon Musk\u2019s attempts to back out of a $44 billion deal to buy the company (although Twitter denies Musk\u2019s claims). <\/p>\n

\n
<\/picture> <\/div>\n<\/p><\/div>\n

Zatko was fired by Twitter (TWTR)<\/a> in January for what the company claims was poor performance. According to Zatko, his public whistleblowing comes after he attempted to flag the security lapses to Twitter (TWTR)<\/a>\u2019s board and to help Twitter (TWTR)<\/a> fix years of technical shortcomings and alleged non-compliance with an earlier privacy agreement<\/a> with the Federal Trade Commission. Zatko is being represented by Whistleblower Aid, the same group that represented Facebook whistleblower Frances Haugen. <\/p>\n

John Tye, founder of Whistleblower Aid and Zatko\u2019s lawyer, told CNN that Zatko has not been in contact with Musk, and said Zatko began the whistleblower process before there was any indication of Musk\u2019s involvement with Twitter. <\/p>\n

After this article was initially published, Alex Spiro, an attorney for Musk, told CNN, \u201cWe have already issued a subpoena for Mr. Zatko, and we found his exit and that of other key employees curious in light of what we have been finding.\u201d <\/p>\n

CNN sought comment from Twitter on more than 50 specific questions regarding the disclosure. <\/p>\n

In a statement, a Twitter spokesperson told CNN that security and privacy are both longtime priorities for the company. Twitter also said the company provides clear tools for users to control privacy, ad targeting and data sharing, and added that it has created internal workflows to ensure users know that when they cancel their accounts, Twitter will deactivate the accounts and start a deletion process. Twitter declined to say whether it typically completes the process. <\/p>\n

\u201cMr. Zatko was fired from his senior executive role at Twitter in January 2022 for ineffective leadership and poor performance,\u201d the Twitter spokesperson said. \u201cWhat we\u2019ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context. Mr. Zatko\u2019s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.\u201d <\/p>\n

\n
<\/picture> <\/div>\n<\/p><\/div>\n

Some of Zatko\u2019s most damning claims spring from his apparently tense relationship with Parag Agrawal, the company\u2019s former chief technology officer who was made CEO<\/a> after Jack Dorsey stepped down last November. According to the disclosure, Agrawal and his lieutenants repeatedly discouraged Zatko from providing a full accounting of Twitter\u2019s security problems to the company\u2019s board of directors. The company\u2019s executive team allegedly instructed Zatko to provide an oral report of his initial findings on the company\u2019s security condition to the board rather than a detailed written account, ordered Zatko to knowingly present cherry-picked and misrepresented data to create the false perception of progress on urgent cybersecurity issues, and went behind Zatko\u2019s back to have a third-party consulting firm\u2019s report scrubbed to hide the true extent of the company\u2019s problems. <\/p>\n

The disclosure is generally much kinder to Dorsey, who hired Zatko and whom Zatko believes wanted to see the problems within the company fixed. But it does depict him as extremely disengaged in his final months leading Twitter \u2013 so much so that some senior staff even considered the possibility he was sick. <\/p>\n

CNN has reached out to Dorsey for comment. A person familiar with Zatko\u2019s tenure at Twitter told CNN the company investigated several claims he brought forward around the time he was fired, and ultimately found them unpersuasive; the person added that Zatko at times lacked understanding of Twitter\u2019s FTC obligations. <\/p>\n

Zatko believes his firing was in retaliation for his sounding the alarm about the company\u2019s security problems. <\/p>\n

The scathing disclosure, which totals around 200 pages, including supporting exhibits \u2013 was sent last month to a number of US government agencies and congressional committees, including the Securities and Exchange Commission, the Federal Trade Commission and the Department of Justice. The existence and details of the disclosure have not previously been reported. CNN obtained a copy of the disclosure from a senior Democratic aide on Capitol Hill. The SEC, DOJ and FTC declined to comment; the Senate Intelligence Committee, which received a copy of the report, is taking the disclosure seriously and is setting a meeting to discuss the allegations, according to Rachel Cohen, a committee spokesperson. <\/p>\n

Sen. Dick Durbin, who chairs the Senate Judiciary Committee and also received the report, vowed to investigate \u201cand take further steps as needed to get to the bottom of these alarming allegations.\u201d <\/p>\n