Researchers make wormy Twitter attack
The hack is similar to a clickjacking attack on Twitter last month
IDG News Service - Computer security researchers have devised a new Twitter attack that they say could spread virally, much like a worm on the microblogging service.
The attack, posted online Thursday by researchers at Secure Science, is an innocuous proof of concept that forces users to send out a predetermined Twitter message, but it could be repurposed into a very nasty worm, said Lance James, chief scientist at Secure Science.
"You can couple an attack with our code and it would just tear the crap out of Twitter," he said.
The hack is similar to a clickjacking attack that was making the rounds on Twitter last month. There, hackers used a sneaky technique to trick users into clicking on a link without realizing it. The link would post the Twitter message saying "don't click" along with a URL.
This time around, Secure Science's researchers found a way to take advantage of a Web programming error on Twitter's support site to post the unwanted message. After a warning message, Secure Science's test code posts the message: "@XSSExploits I just got owned!" to the victim's profile.
However, a malicious user could do much worse with this bug, James said. The attack could be modified so that there would be no warning screen, and it could be beefed up with a sensational message that users would be more likely to click. If it were combined with malicious browser attack code, it could be used to take control of victims' machines, James said.
"I'm holding my breath, hoping no one does something stupid at this moment," he said.
Twitter could disable the attack by fixing the cross site scripting flaw that the Secure Science researchers are exploiting, but if another similar bug were to pop up on the site, users would be faced with the same problem all over again.
The issue is made worse by the fact that because of Twitter's 140-character limit, Twitterers use shortened Web links such as Tinyurl.com and often have no idea whether or not they are clicking on a trustworthy Web link, James said.
Twitter's security practices have been in the spotlight lately as the service has gained mainstream popularity. In January, the company instituted a full security review after hackers gained access to the accounts of then President-elect Barack Obama, Fox News, and CNN.
James said he hopes that his demonstration will push Twitter into making security a priority.
"We don’t want to cause any damage to Twitter," he said.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!