Researchers make wormy Twitter attack
The hack is similar to a clickjacking attack on Twitter last month
IDG News Service - Computer security researchers have devised a new Twitter attack that they say could spread virally, much like a worm on the microblogging service.
The attack, posted online Thursday by researchers at Secure Science, is an innocuous proof of concept that forces users to send out a predetermined Twitter message, but it could be repurposed into a very nasty worm, said Lance James, chief scientist at Secure Science.
"You can couple an attack with our code and it would just tear the crap out of Twitter," he said.
The hack is similar to a clickjacking attack that was making the rounds on Twitter last month. There, hackers used a sneaky technique to trick users into clicking on a link without realizing it. The link would post the Twitter message saying "don't click" along with a URL.
This time around, Secure Science's researchers found a way to take advantage of a Web programming error on Twitter's support site to post the unwanted message. After a warning message, Secure Science's test code posts the message: "@XSSExploits I just got owned!" to the victim's profile.
However, a malicious user could do much worse with this bug, James said. The attack could be modified so that there would be no warning screen, and it could be beefed up with a sensational message that users would be more likely to click. If it were combined with malicious browser attack code, it could be used to take control of victims' machines, James said.
"I'm holding my breath, hoping no one does something stupid at this moment," he said.
Twitter could disable the attack by fixing the cross site scripting flaw that the Secure Science researchers are exploiting, but if another similar bug were to pop up on the site, users would be faced with the same problem all over again.
The issue is made worse by the fact that because of Twitter's 140-character limit, Twitterers use shortened Web links such as Tinyurl.com and often have no idea whether or not they are clicking on a trustworthy Web link, James said.
Twitter's security practices have been in the spotlight lately as the service has gained mainstream popularity. In January, the company instituted a full security review after hackers gained access to the accounts of then President-elect Barack Obama, Fox News, and CNN.
James said he hopes that his demonstration will push Twitter into making security a priority.
"We don’t want to cause any damage to Twitter," he said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts