Feeds

Flaw makes Twitter vulnerable to serious viral attack

Son of Samy?

Build a business case: developing custom apps

Updated Micro-blogging site Twitter suffers from a potentially devastating vulnerability that forces logged-in users to post messages of an attacker's choice simply by clicking on a link. It could be used to spawn a self-replicating worm.

The XSS, or cross-site scripting, error was discovered by Secure Sciences Corp researchers Lance James and Eric Wastl, who have fashioned this link to demonstrate their finding. Clicking on it while logged in to Twitter causes users to immediately broadcast an innocuous message to all of their followers, as this dummy account shows.

More than 15 hours after this story was first published, the gaping hole remained. A Twitter representative has yet to return our email.

Of course, it would be just as easy to craft links that do considerably more damage. Tweets are limited to just 140 characters, making it almost mandatory to use shortened URLs that obscure their final destination. While it's possible to preview the link before visiting, many Twitter users have grown so accustomed to them they click on them directly.

"With a technology such as twitter, I could use it to infect massive amounts of twitter readers/users, say with malware or steal their accounts, etc.," James wrote to The Register by instant messenger. "Because it's a serious hack, I was being nice and put a disclaimer up, but it could (have) been as bad as the samy is my hero stuff + more."

A white-hat hacker, James was speaking hypothetically, of course.

James, who is the author of Phishing Exposed, was referring to the notorious Samy worm, the self-replicating XSS exploit that in 2005 added more than 1 million MySpace friends to a user named Samy. In the process, the social networking site was knocked out of commission.

As the user base of Twitter has skyrocketed, so too have attempts to exploit the site. Hackers have waged cat-and-mouse attacks on the site using so-called clickjacking exploits that, like the XSS vulnerability exposed by James and Wastl, forced logged-in users to tweet simply by clicking on an innocent-looking button. Twitter has been quick to patch the vulnerabilities, but the hackers have been known to launch new attacks that work around the countermeasures.

Now, it's clear Twitter has new potentially serious vulnerabilities to stay on top of. We'd expect this vulnerability to be fixed in fairly short order, but like the clickjacking tit-for-tat, we expect this isn't the last you'll hear of XSS attacks on the site. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?