Twitter's recommendation algorithm opens platform to manipulation, bot attacks, researcher finds

Twitter's source code apparently revealed how it's possible to game the company's software to reduce access to specific accounts.

Just three days after Twitter released a portion of its source code online that included the app’s recommendation algorithm, a security researcher found that attackers could manipulate the software to effectively silence specific accounts on the social media platform.

An Argentine developer flagged the issue on the software hosting service GitHub on April 1 after Twitter made the code public in a pair of repositories on the site. “The current implementation allows for coordinated hurting of account reputation without recourse,” the developer wrote.

As a result, the nonprofit Mitre Corporation assigned portions of Twitter’s code a common vulnerabilities and exposure, or CVE, designation based on the way attackers could target specific accounts to diminish their exposure on the platform. It’s not clear who submitted the CVE to the Mitre database, and the company would not identify whoever submitted it for review, per company policy.

The CVE, which is a designation that the information security community uses to identify and track publicly disclosed software flaws, notes that Twitter’s current recommendation algorithm “allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Twitter accounts to coordinate negative signals regarding a target account, such as unfollowing, muting, blocking, and reporting, as exploited in the wild in March and April 2023.”

On the same day the Argentine developer flagged the issue, a Twitter user by the name of “el gato malo” pointed out essentially the same issue, noting that “this is how the botnet/activist armies are crushing accounts.” The user tagged Twitter owner Elon Musk with a suggestion that only “blue check mutes/blocks/reports” should count. Musk replied, asking who was behind the botnets. “Million dollar bounty if convicted,” Musk wrote, although it’s not clear what “convicted” means in this context.

Twitter has disbanded its press team and immediately responded to a request for comment about the CVE and algorithm issue with: “💩”.

In an unsigned blog posted to the company’s website last week, Twitter said releasing the code was “the first step in a new era of transparency,” and that as “the town square of the internet, we’re ultimately doing this to foster transparency and build trust with our users, customers, and the general public.”

Musk later said in a Twitter Spaces session that the release “is going to be quite embarrassing, and people are going to fine a lot of mistakes, but we’re going to fix them very quickly,” according to TechCrunch. He added that the company is “aspiring to the great example of Linux as an open source operating system,” where exploits could be found but “the community identifies and fixes those exploits.”

There are nearly 650 CVEs that mention some kind of algorithm in the National Institute of Standards and Technology database that mirrors the CVE database operated and maintained by the Mitre Corporation. Social media-related CVEs have been assigned in the past, a Mitre representative told CyberScoop Tuesday, including CVE-2022-46405 and CVE-2022-48364, which both have to do with the Mastodon service.

Updated, April 4, 2023: This story has been updated with information from Mitre Corporation regarding previous social media-related CVEs and its privacy policy.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems