Feeds

Twitter botches patch for nasty account-hijacking bug

All your tweets are belong to us

Choosing a cloud hosting partner with confidence

For the past 24 hours, Twitter engineers have been fighting a gaping hole that makes it easy for hackers to hijack the accounts of users who do nothing more than view a booby-trapped message.

So far, the hole is winning.

The XSS, or cross-site scripting, bug resides in an application programming interface Twitter provides to makers of dedicated software that works with the service. The hole makes it trivial to bypass protections that prevent user supplied javascript from being served on the twitter.com domain. After Twitter claimed to have fixed the vulnerability Tuesday, security researchers quickly figured out a new way to exploit the weakness. At time of writing, it remained wide open.

The bug was first reported by blogger James Slater in a post that demonstrated it could be used to run arbitrary code on the machines of people who did nothing more than view a booby-trapped tweet. Once viewed, the message pulls down the javascript that, if users are logged in, has the potential to change profiles, post tweets and steal authentication cookies.

"With a few minutes work, someone with a bit of technical expertise could make a Twitter 'application' and start sending tweets with it," Slater wrote here on Wednesday. "Simply by seeing one of these tweets, code can be run inside your browser impersonating you and doing anything that your browser can do."

The bug is the latest to highlight weaknesses in the Web 2.0 service used regularly by millions of subscribers. This time around, attackers are abusing an API that makes it simple for people to write stand-alone applications that send and read messages delivered over Twitter. The interface reserves space in each tweet for the name of the application. Slater showed that the box can be used to invoke potentially harmful javascript that Twitter has taken pains to block in other parts of its service.

"That's a pretty big oversight," said Jeff Williams, CEO of web application security firm Aspect Security. "It's not uncommon when companies move from web services to APIs. They don't take the same level of security scrutiny and apply it to the interface."

Slater put it a little more forcefully. "Twitter made one of the most basic mistakes in developing web applications - never blindly trust data that is provided from the outside world!" he wrote. "Their form did no - or some very, very basic - checking on what you enter in the box."

Twitter's first stab at fixing the bug involved code that invalidated any links in the box that contained spaces, said Aviv Raff, a researcher whose recent month of Twitter bugs spent 30 days documenting more than 50 vulnerabilities affecting the site. Like Slater, he was able to bypass the fix by including URLs that contained no spaces.

"Not so smart [a] way to fix a vulnerability," he said.

What that means is that if you use many web browsers to view Twitter, it's possible, at least at time of writing, for someone to change your profile settings, send a message to all of your followers that appears to come from you or to steal cookies Twitter uses to help authenticate you. People who use third party apps to view tweets are less vulnerable, as are those who use Internet Explorer 8 and Firefox with the NoScript plugin. (In this case, a test account we used was successfully attacked using the latest version of IE, and Raff says NoScript isn't likely to fare any better.)

The alacrity Twitter showed in trying to fix the bug suggests its security team is getting more serious about fortifying the heavily trafficked site. And for that, they deserve a pat on the back.

But the failure shows the team still has work ahead of it.

It's also worth mentioning that many of the third-party applications used to send and receive tweets remain woefully insecure, according to Raff, who said a dozen or so of the bugs he discovered remain unpatched. They reside in apps such as HootSuite, TweetGrid, tr.im, TweetDeck and Twhirl. The common denominator among almost all of them: the Twitter API.

The API is so "easy to implement, that even novice developers can use it," he told The Register. "Which means that insecure apps are being developed." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.