Researcher shares method for hiding ~3MB of data, like ZIP archives, in Twitter images and says Twitter ruled out a security bug bounty for an earlier method
Ax Sharma / BleepingComputer :
Context & Ripple Effects
Ax Sharma has a track record of probing Twitter's edges: in 2019 he demonstrated matching 17M phone numbers to accounts through the Android app before Twitter shut the effort down, and last year Twitter itself warned developers their app keys and tokens had been stored in browser caches. Today's finding extends the pattern from data leaks to data smuggling — roughly 3MB, enough for a ZIP archive, can ride inside ordinary tweet images.
First-order effects
- Twitter's image CDN becomes a de facto file host and covert storage layer for anyone using the method, with no account-level signal that binary payloads are attached to tweets.
Second-order effects
- With no bug bounty on offer for this class of finding, researchers have less reason to disclose privately, pushing techniques like Sharma's straight into public view where abuse actors can adopt them faster than Twitter's trust-and-safety pipeline reacts.
Third-order effects
- The same logic behind AIR-FI's covert RAM-to-radio channel applies here at platform scale: mainstream services are becoming exfiltration infrastructure, which pressures platforms to treat steganography detection as a core content-moderation capability alongside text and link scanning — or to formalize bounty programs that convert smugglers into reporters.
The trend: Platform media pipelines are drifting from passive delivery channels into attack and storage surfaces, forcing social networks to choose between bounty-funded disclosure and public adversarial research.