API4:2023 — Unrestricted Resource Consumption

Slide 13 · Real Incident: No Rate Limit + Sensitive Lookup

Phone number in. Twitter account out. 5.4 million times.

Twitter, 2022 — a lookup API with no rate limit lets anyone map phone numbers to accounts.

Real Incident · 2021–2022

Twitter — 5.4 Million Accounts Scraped via Phone/Email Lookup API

Twitter's "find your contacts" feature included an API endpoint that accepted a phone number or email address and returned the associated Twitter account. This was designed for users to find people they knew.

The endpoint had a vulnerability: it returned account data without requiring the queried phone number or email to belong to the requesting user. Combined with no meaningful rate limiting, any authenticated Twitter user could query any phone number or email and receive the matching account.

Attackers (and researchers) automated this: iterate through phone number ranges, send each to the endpoint, collect the account data returned. 5.4 million Twitter accounts were scraped, matching each account to a phone number or email address. The dataset was posted for sale online in July 2022, then made freely available.

Twitter (then pre-Musk) disclosed the breach in August 2022. The vulnerability in the lookup endpoint had been reported through their bug bounty program in January 2022 — six months before the breach disclosure. Twitter paid the reward but did not disclose the breach until the data appeared publicly.

Lesson: Lookup endpoints that accept arbitrary input are high-value targets for enumeration. Without rate limiting, a single authenticated user can systematically map a sensitive attribute (phone number) to a platform identity (Twitter account) for millions of people. Rate limiting per user per time window is the minimum required control on any enumerable lookup endpoint.

← Back See it in attack scenarios →