|
This weekend has seen the popular social media site Twitter infected by several worms. Fortunately the technical team at Twitter were on the ball, were able to stop these attacks from progressing too far and have now plugged the vulnerabilities that these attacks exploited.
Both attacks used a technique known as “cross site scripting” (XSS). The perpetrators of the worms discovered that you could put Javascript code into the “Bio” section of a Twitter account. Anyone then visiting the home page of that account would activate the Javascript which would, in turn, infect the visitors account. Thus the worm was able to spread from one account to another.
The first attack occurred on Saturday 11th April. This worm infected Twitter accounts and then started sending spam posts to the StalkDaily web site. Twitter say that only 90 accounts were affected before they brought the situation under control.
The second attack happened the following day and was instigated by a 17 year old New Yorker called Mikey Mooney, who apparently perpetrated the attack because he was bored (I should have so much free time). This worm, known as “Mikeyy”, again perpetrated a XSS attack this time posting spam messages to Twitter itself. By the time the situation was brought under control some 10,000 spam Tweets had to be removed. More details of the how the attacks were perpetrated can be found on Mashable and the Twitter Blog
Fortunately these attacks were relatively benign and as such have shown Twitter where it needed to do some serious tightening of security. However the fact remains that security was breached and those people whose accounts were attacked are fortunate that the payload was nothing more serious than spam messages.
Whilst it’s very easy to criticise the Twitter team from afar XSS attacks have been around for some considerable time and so you have to ask the question, “Why were these vulnerabilities not foreseen?”. It also behoves each and every one of us to remain ever vigilant in our web activity and be alert to anything unusual happening.
One final point. These worms only affected Twitter users who viewed account details in a web browser. If you use a Twitter client like Tweetdeck, Twhirl or Seesmic Desktop then you won’t have been affected by the worm even if you visited an infected account.
 |
