Twitter whistleblower

 

What we discovered while Twitter whistleblower Mudge testified to Congress

Sticking bomb of safety vulnerabilities. Covering up security disasters. Duping regulators and deceptive lawmakers.

These are just some of the allegations that Twitter's ex-security lead turned whistleblower, Peiter Zatko, testified to the Senate Judiciary Committee on Tuesday, much less than a month after the discharge of his fierce whistleblower criticism filed with federal regulators. Zatko, better referred to as Mudge, made his first feedback considering the general public released his grievance.

Twitter did now not respond to a request for a remark.

These are the critical takeaways from Mudge's testimony to lawmakers and what we discovered from Tuesday's listening.

FBI warned Twitter it had a Chinese secret agent on the body of workers

Sen. Chuck Grassley, the rating member of the Senate Judiciary Committee, stated in his starting comments that the FBI warned Twitter that it could have a Chinese secret agent on its payroll.

A redacted model of Mudge's whistleblower criticism launched last month stated that Twitter acquired specific records from the U.S. Government that "one or extra precise business enterprise employees had been working on behalf of another unique foreign intelligence organization." The nationality of the overseas intelligence sellers was now not disclosed at the time.

But Mudge instructed the panel that the undercover agent becomes an agent of China's Ministry of State Security, or MSS, the united states' principal intelligence agency. He added that due to the fact Twitter engineers — approximately four 000 personnel — have massive get entry to agency records, an overseas agent hired as an engineer would have called right of access to personal user data and doubtlessly different sensitive organization statistics, which includes Twitter's plans to censor information in a specific location or deliberate to demands of a government request. But because Twitter did no longer closely screen or log personnel' admission, in step with his criticism, Mudge said it changed into "very tough" to pick out what precise records become taken by Twitter personnel as foreign retailers.

The Chinese spy wasn't the most effective agent of foreign authorities on Twitter's payroll. Mudge stated in his criticism that the Indian authorities "succeeded in setting dealers on the corporation payroll" who were granted "direct unsupervised access to the corporation's structures and person records." In August, a former Twitter employee was discovered guilty of spying for the Saudi authorities and handing over consumer facts about suspected dissidents.

Thousands of tries to hack into Twitter weekly

A not unusual theme in Mudge's grievance is that Twitter did not have the visibility to realize what facts engineers had access to or what personal information or company data they had been accessing. But one gadget that tracked logins for Twitter engineers found that it changed into registering "lots" of failed attempts to log in to Twitter's systems each week, Mudge instructed contributors of Congress.

Mudge said in his criticism that the enterprise noticed as many as three 000 failed attempts each day, describing it as a "large crimson flag." In addition, Mudge said then-Twitter leader generation officer Parag Agrawal — now leader executive — did now not assign anybody to diagnose or restore the problem the grievance introduced.

"This fundamental loss of logging inside Twitter is a remnant of being up to now in the back of on their infrastructure, the engineering, and the engineers no longer being given the capacity to position matters in the area to modernize," Mudge testified.

 

What Twitter is aware of approximately its customers and why spies want it

Given the focus of Twitter's apparent lax entry to controls to customers' records, lawmakers asked Mudge what particular kind of facts Twitter collects from its customers. Mudge stated Twitter does not recognize the scale of what data it contains.

He said many of the facts Twitter collects consist of a consumer's phone quantity, the modern-day and beyond IP addresses that the consumer is connecting from, contemporary and beyond email addresses, the individual's approximate place primarily based on IP addresses, and data about the character's tool or browser they're gaining access to Twitter from, which includes the make and version, and person's language.

Mudge stated it became viable that engineers had to get admission to these statistics and might be an attractive target for overseas intelligence businesses. One of the reasons he noted was that it would be beneficial for governments to target particular agencies and keep tabs on what Twitter knows approximately their agents or information operations.

Mudge also warned that Twitter user records would be used for harassment or concentrated on people as part of having an impact on operations within the actual global, such as a member of the family or a colleague, and used as leverage to steer people near them without their consciousness. "It is probably used with different information collection," Mudge told lawmakers, bringing up preceding breaches, along with massive thefts of fitness information and U.S. Government personnel documents, which includes the violation of twenty-two million facts from the U.S. Office of Personnel Management in 2012. Mudge instructed lawmakers that his OPM file turned into stolen in the breach while he labored for the federal government.

U.S. Government corporations permit groups "grade their homework."

Mudge's grievance and next testimony land simply months after Twitter paid $ hundred and fifty million in an agreement with the Federal Trade Commission for violating its 2011 privacy settlement after the organization used email and get in touch with data for securing their accounts but then used that identical information for targeted advertising and marketing.

Mudge instructed lawmakers that at the same time as the government, businesses must enforce the law and that they have the right reason; he accused the FTC of being a "little over its head" with the aid of permitting companies to "grade their homeworFinally, in" In response to a question by way of Sen. Richard Blumenthal, Mudge referenced the 2011 privacy settlement and asked, "How [has Twitter] been passing this?"

Speaking of the regulators and their enforcement powers, Mudge instructed lawmakers: "What I have seen, the tools in the toolbelt are not operating."