Twitter Shadow Ban Bug Gets Official CVE

A flaw in Twitter code allows bot abuse to trick the algorithm into suppressing certain accounts.

A vulnerability in Twitters code was recently discovered that allows users to game the algorithm with mass blocking actions from large numbers of accounts, in an effort to suppress specific users showing up in peoples feeds — essentially, it allows bot-created shadow bans in the parlance of social media censorship critics.
Now, the flaw has been assigned a CVE number as an officially recognized security vulnerability: CVE-2023-29218.
The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Twitter accounts to coordinate negative signals regarding a target account, such as unfollowing, muting, blocking, and reporting, as exploited in the wild in March and April 2023, the
MITRE CVE entry
explained.
The vulnerability was first flagged by infosec researcher Federico Andres Lois after analyzing Twitters source code, which was
leaked to the public
and later posted on GitHub by Twitter as part of its
commitment to transparency
.
The bug means that botnet armies have the ability to game the algorithm with mass blocks, mutes, abuse reports, spam reports, and unfollows to drive down the number of times specific accounts show up in Twitters recommendation engine.
The current implementation allows for coordinated hurting of account reputation without recourse,
Lois wrote in his disclosure
. Any other time I would just report this information using a vulnerability channel, but given that this is already popular knowledge there is no use to do so.
The vulnerability has since been discovered by others, prompting a cryptic, yet splashy, response from Twitter CEO Elon Musk.
Who is behind these botnets?
Musk tweeted
. Million dollar bounty if convicted.

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Twitter Shadow Ban Bug Gets Official CVE