Important! June 12th, 2024 Webinar Attendees, please click here to complete our Survey or Verification Request Form.

Click Here

Twitter Flaw Exposes 17 Million Users

Last update





Print Friendly, PDF & Email
Here's the latest on emerging cyber threats.

A recently-revealed Twitter software flaw and a malicious new type of ransomware are two emerging threats being monitored by cyber security experts.

The Twitter vulnerability allowed hackers to match 17 million user accounts with their phone numbers. And the new ransomware strand – known as Maze – is targeting law firms and other private companies in the US.

Below are two blogposts on both threats from cybersecurity expert Craig Petronella.

If you have professional liability coverage through Alta Pro Insurance, you’re invited to attend a free CLE webinar on social engineering and phishing scam coming in March. Stay tuned for more details. This is just one of the many benefits from being a part of the Alta Pro family. Here’s how to join.

FBI Warns Business Owners: Beware of Increasing Maze Attacks
By Craig Petronella, CEO Petronella Technology Group

Directly on the heels of LockerGoga and MegaCortex, a different strand of ransomware, Maze, which was first discovered nearly a year ago, started to target private companies in the US in November, and the FBI wants to make sure you know about it.

Just two days after issuing an alert for LockerGoga and MegaCortex, the FBI has issued a “TLP: Green” alert for Maze, meaning that they are only able to release limited details; otherwise, they may aid hackers. That being said, the FBI is strongly urging any victims to share the details of their attack with them; any details may be able to assist agents in finding the cyber attackers. In the alert, victims of Maze ransomware attacks were urged to share information with the FBI as soon as possible to help its agents trace the attackers and bring them to justice.

What is Maze?
After a successful breach, Maze replicates the data it accesses before it encrypts it.  Once encrypted, Maze sends a ransom to its victims. Where Maze is a little bit more insidious, however, is that the data thieves threaten to not only destroy the files if they don’t receive payment, but to also publish it, which is something the City of Pensacola and a Georgia-based wire and cabling firm, Southwire, discovered when they did not pay up.

How does Maze infiltrate their victims?
Maze has successfully breached their victims using:

  • Felonious cryptocurrency websites
  • Malspam
  • Phishing scams (as government agencies and security vendors)
  • Exploit kits (i.e. Fallout downloads)

What if I am attacked?
The FBI recommends NOT paying the ransom because there is no way to know if the hackers will actually decrypt your data. Even if you pay, they might still leak and/or destroy your files. They do strongly urge victims to contact them.

Twitter Vulnerability Exposed in a Big Way
By Craig Petronella, CEO Petronella Technology Group 

Ibrahim Balic, a security researcher, recently exposed a flaw in Twitter’s app that allowed him to match unique Twitter user accounts with 17 million phone numbers months ago. He was able to accomplish this by uploading large lists of phone numbers by way of Twitter’s “Contacts Upload” feature that is available on the social media giant’s Android app.

It is interesting to note, too, that the “Contact Upload” feature won’t accept the lists when the numbers are in sequential order. He had to generate the numbers by hand, then he randomized them into the app. So it appears that while Twitter did possibly anticipate this could happen, they didn’t go far enough in protecting their users.

Fortunately, though, this bug only existed in the Android app; it doesn’t exist in the web-based “Contact Upload.” He also discovered that if you upload your phone number, Twitter will provide you with user data. The researcher was able to match these records over the course of two months. The data flow was stopped when Twitter finally blocked him on December 20.

Balic has yet to go to Twitter with this finding, but he did contact many of the high-profile users he was able to uncover, via a group text in WhatsApp in order to notify them directly.

But Twitter is apparently aware of the problem and they have publicly stated that they are working hard to fix the bug. Let’s hope the fix comes sooner, rather than later.

If you practice in Wisconsin, Texas, Minnesota, Ohio, Illinois, Indiana or Michigan, you can stay a step ahead of the competition by being a member of Alta Pro Lawyers RPG. You’ll get access to free webinars, the Pro Practice Playbook, Reminger ProLink, Ask the Risk Pro and more. Here’s how to join.

About the Author
Craig A. Petronella is the CEO of Petronella Technology Group Inc, a cybersecurity group that specializes in helping law firms with security and compliance. With 30 years of experience, he is the author of “How Hackers can Crush your Law Firm,” Peace of Mind Computer Support” and other titles. MIT Certified: AI, Blockchain & Hyperledger. Phone: 919-601-1601; Helpdesk Support: 919-422-2607. For more information about a cyber-crime risk assessment call: 1-877-468-2721


Print Friendly, PDF & Email

Related Posts on!

Alta Pro Logo Icon

About the Editorial Staff

In an age of consolidation where increasingly impersonal transactions have made customer service an oxymoron, we bring together independent agents, insurance companies, and other industry specific service providers to develop and deliver insurance products and risk management solutions that benefit our insurance customers.

Join Our Newsletter

Occasional newsletters and CLE invites

Find Us on Social

Upcoming CLE Webinar: Essential Business Skills for Busy Lawyers Part 2 – Build Your Legal Practice Like a Pro

August 28, 2024 1:00 pm EST
CLE Credit: 1.0 Regular

Colleen L. Byers

Colleen Byers Mediation, LLC


Latest Videos

1 Hour

Essential Business Skills for Busy Lawyers Part 1 – Communicate Like A Pro

1 Hour

Creating an Attorney Compensation Plan That Will Build Firm Culture and Attract Top Talent

1 Hour

Cybersecurity for Attorneys: Employing Competent and Reasonable Safeguards

Need Help?

Visit our Frequently Asked Questions page. 

Or email us directly at

Or submit your issue in the comment form below and we will respond as soon as possible.