Researchers make wormy Twitter attack
The hack is similar to a clickjacking attack on Twitter last month
IDG News Service - Computer security researchers have devised a new Twitter attack that they say could spread virally, much like a worm on the microblogging service.
The attack, posted online Thursday by researchers at Secure Science, is an innocuous proof of concept that forces users to send out a predetermined Twitter message, but it could be repurposed into a very nasty worm, said Lance James, chief scientist at Secure Science.
"You can couple an attack with our code and it would just tear the crap out of Twitter," he said.
The hack is similar to a clickjacking attack that was making the rounds on Twitter last month. There, hackers used a sneaky technique to trick users into clicking on a link without realizing it. The link would post the Twitter message saying "don't click" along with a URL.
This time around, Secure Science's researchers found a way to take advantage of a Web programming error on Twitter's support site to post the unwanted message. After a warning message, Secure Science's test code posts the message: "@XSSExploits I just got owned!" to the victim's profile.
However, a malicious user could do much worse with this bug, James said. The attack could be modified so that there would be no warning screen, and it could be beefed up with a sensational message that users would be more likely to click. If it were combined with malicious browser attack code, it could be used to take control of victims' machines, James said.
"I'm holding my breath, hoping no one does something stupid at this moment," he said.
Twitter could disable the attack by fixing the cross site scripting flaw that the Secure Science researchers are exploiting, but if another similar bug were to pop up on the site, users would be faced with the same problem all over again.
The issue is made worse by the fact that because of Twitter's 140-character limit, Twitterers use shortened Web links such as Tinyurl.com and often have no idea whether or not they are clicking on a trustworthy Web link, James said.
Twitter's security practices have been in the spotlight lately as the service has gained mainstream popularity. In January, the company instituted a full security review after hackers gained access to the accounts of then President-elect Barack Obama, Fox News, and CNN.
James said he hopes that his demonstration will push Twitter into making security a priority.
"We don’t want to cause any damage to Twitter," he said.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!