Shutterstock
What Zatko says he found was a company with extraordinarily poor security practices, including giving thousands of the company's employees — amounting to roughly half the company's workforce — access to some of the platform's critical controls.
But, the disclosure says, Zatko soon learned "it was impossible to protect the production environment. All engineers had access. There was no logging of who went into the environment or what they did.... Nobody knew where data lived or whether it was critical, and all engineers had some form of critical access to the production environment."
Twitter also lacked the ability to hold workers accountable for information security lapses because it has little control or visibility into employees' individual work computers, Zatko claims, citing internal cybersecurity reports estimating that 4 in 10 devices do not meet basic security standards.
About half of the company's 500,000 servers run on outdated software that does not support basic security features such as encryption for stored data or regular security updates by vendors, according to the letter to regulators and a February email Zatko wrote to Patrick Pichette, a Twitter board member, that is included in the disclosure.
The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good.
Twitter did not respond to questions about the risk of data center outages, but told CNN that people on Twitter's engineering and product teams are authorized to access the production environment if they have a specific business justification for doing so. Twitter's employees use devices overseen by other IT and security teams with the power to prevent a device from connecting to sensitive internal systems if it is running outdated software, Twitter added.
The company also said it uses automated checks to ensure laptops running outdated software cannot access the production environment, and that employees may only make changes to Twitter's live product after the code meets certain record-keeping and review requirements.
Twitter has internal security tools that are tested by the company regularly, and every two years by external auditors, according to the person familiar with Zatko's tenure at the company. The person added that some of Zatko's statistics surrounding device security lacked credibility and were derived by a small team that did not properly account for Twitter's existing security procedures.
Zatko says he began asking about the prevalence of bot accounts on Twitter in early 2021, and was told by Twitter's head of site integrity that the company didn't know how many total bots are on its platform. He alleges that he came away from conversations with the integrity team with the understanding that the company "had no appetite to properly measure the prevalence of bots," in part because if the true number became public, it could harm the company's value and image.
Last year, prior to Russia's invasion of Ukraine, Agrawal — then Twitter's chief technology officer — proposed to Zatko that Twitter comply with Russian demands that could result in broad-based censorship or surveillance of the platform, Zatko alleges.
The disclosure does not provide details of Agrawal's suggestion. Last summer, however, Russia passed a law pressuring tech platforms to open local offices in the country or face potential advertising bans, a move western security experts said was intended to give Russia greater leverage over US tech companies.
While Agrawal's suggestion was ultimately discarded, it was still an alarming sign of how far Twitter was willing to go in pursuit of growth, according to Zatko.
The fact that Twitter's current CEO even suggested Twitter become complicit with the Putin regime is cause for concern about Twitter's effects on US national security,
From Zatko's disclosure
"The fact that Twitter's current CEO even suggested Twitter become complicit with the Putin regime is cause for concern about Twitter's effects on U.S. national security," Zatko's disclosure says.
In a filing on Tuesday, lawyers on behalf of Musk said the allegations by Zatko, including “egregious deficiencies” in the platform’s defenses against hackers and privacy issues, meant that Twitter had breached the conditions in the merger agreement.
Former Disney CEO Bob Iger said on Wednesday the entertainment giant had determined that a "substantial portion" of Twitter's users were "not real" in 2016, when Disney was weighing a purchase of the social network.
Iger said the Walt Disney Co (DIS.N) and Twitter Inc (TWTR.N) boards were prepared to enter negotiations when he got cold feet. He said that, with Twitter's help, Disney had learned that "a substantial portion - not a majority -" of users were fake.
...
Iger did not mention Musk by name in his remarks on Wednesday, but he did say: “Interestingly enough, because I read the news these days, we did look very carefully at all of the Twitter users," before going on to say that "a substantial portion" of Twitter users "were not real."
In his memoir, "The Ride of a Lifetime," Iger wrote that he had second thoughts about a deal with Twitter because of the "nastiness" of the discourse on Twitter that he feared would become a distraction.
Opret dig som bruger i dag
Det er gratis, og du binder dig ikke til noget.
Når du er oprettet som bruger, får du adgang til en lang række af sidens andre muligheder, såsom at udforme siden efter eget ønske og deltage i diskussionerne.
- Forside
- ⟨
- Forum
- ⟨
- Nyheder
Gå til bund