upthepunx

The way these things have been going (client-side vulnerability exploitation), I would suspect that the exploited vulnerabilities were closer to the laptops of Twitter employees than the Twitter application itself.

The blog post mentions turning off Java in your browser, which could be a clue to the attack vector Twitter suffered, and it's written by someone from "Information Security" rather than someone from Application Security.

This is likely about Twitter getting creepy. Every online advertising company is worried about the growth of the mobile environment, because it's harder to do all of the tracking that they're used to on those platforms. There are no cookies that follow you across apps.

The cookie equivalent in the mobile world is the SDK. Rather than scattering your "like"/"tweet"/"follow" buttons all over the web to track users' movements, you embed your SDK into everyone's apps to do the same thing.

If you are currently a Crashlytics customer, think about how much information is being transmitted to Crashlytics from your app, and what Twitter is going to be able to do with that now.