Researchers make wormy Twitter attack
The hack is similar to a clickjacking attack on Twitter last month
IDG News Service - Computer security researchers have devised a new Twitter attack that they say could spread virally, much like a worm on the microblogging service.
The attack, posted online Thursday by researchers at Secure Science, is an innocuous proof of concept that forces users to send out a predetermined Twitter message, but it could be repurposed into a very nasty worm, said Lance James, chief scientist at Secure Science.
"You can couple an attack with our code and it would just tear the crap out of Twitter," he said.
The hack is similar to a clickjacking attack that was making the rounds on Twitter last month. There, hackers used a sneaky technique to trick users into clicking on a link without realizing it. The link would post the Twitter message saying "don't click" along with a URL.
This time around, Secure Science's researchers found a way to take advantage of a Web programming error on Twitter's support site to post the unwanted message. After a warning message, Secure Science's test code posts the message: "@XSSExploits I just got owned!" to the victim's profile.
However, a malicious user could do much worse with this bug, James said. The attack could be modified so that there would be no warning screen, and it could be beefed up with a sensational message that users would be more likely to click. If it were combined with malicious browser attack code, it could be used to take control of victims' machines, James said.
"I'm holding my breath, hoping no one does something stupid at this moment," he said.
Twitter could disable the attack by fixing the cross site scripting flaw that the Secure Science researchers are exploiting, but if another similar bug were to pop up on the site, users would be faced with the same problem all over again.
The issue is made worse by the fact that because of Twitter's 140-character limit, Twitterers use shortened Web links such as Tinyurl.com and often have no idea whether or not they are clicking on a trustworthy Web link, James said.
Twitter's security practices have been in the spotlight lately as the service has gained mainstream popularity. In January, the company instituted a full security review after hackers gained access to the accounts of then President-elect Barack Obama, Fox News, and CNN.
James said he hopes that his demonstration will push Twitter into making security a priority.
"We don’t want to cause any damage to Twitter," he said.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts