Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter Gets Slammed By the StalkDaily XSS Worm

Posted by Soulskill on from the tweety-bird-gets-the-worm dept.

CurtMonash writes "Twitter was hit Saturday by a worm that caused victims' accounts to tweet favorably about the StalkDaily website. Infection occurred when one went to the profile page of a compromised account, and was largely spread by the kind of follower spam more commonly used by multi-level marketers. Apparently the worm was an XSS attack, exploiting a vulnerability created in a recent Twitter update that introduced support for OAuth, and it was created by the 17-year-old owner of the StalkDaily website. More information can be found in the comment thread to a Network World post I put up detailing the attack, or in the post itself. By evening, Twitter claimed to have closed the security hole."

8 of 145 comments (clear)

  1. Re:Clearly he should be made to by Anpheus · · Score: 4, Informative

    Go and manually run anti virus software on every infected PC.

    Not that kind of worm. It was purely a scripting attack involving javascript. No one's computers were harmed, only a bunch of twitter accounts. (Which can no doubt be fixed by patching the whole and some good SQL query to fix all the accounts in one go.)

  2. Re:throw the scumbag in jail by Teun · · Score: 4, Informative

    Idiots like him are the reason viruses exist.

    Stop right there! You are infringing on a Microsoft technology.

    --
    "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
  3. Re:Bit obvious by timholman · · Score: 5, Informative

    Cool exploit, but worm-spamming your own public site is a bit, um, not well thought out.

    Especially when you read the Terms of Service on Mr. Mooney's own StalkDaily website, e.g.:

    7. You must not modify, adapt or hack StalkDaily.com or modify another website so as to falsely imply that it is associated with StalkDaily.com.

    8 You must not create or submit unwanted email to any StalkDaily members ("Spam").

    9. You must not transmit any worms or viruses or any code of a destructive nature.

    Talk about having a "Do as I say, not as I do" morality. At least it's refreshing to see that hypocrisy is not restricted to people over 30.

  4. The XSS FAQ by mrkitty · · Score: 2, Informative

    The Cross-site Scripting FAQ http://www.cgisecurity.com/xss-faq.html

    --
    Believe me, if I started murdering people, there would be none of you left.
  5. Re:Ummmm by Anonymous Coward · · Score: 2, Informative

    Fuckwits... XSS = Cross Site Scripting, not XML Style Sheets.

  6. Re:To hire or to jail, that is the question by Anonymous Coward · · Score: 1, Informative

    If you don't like the fucking annoying tweets, nobody is forcing you to read them. Just like slashdot.

  7. Re:To hire or to jail, that is the question by Anonymous Coward · · Score: 1, Informative

    Who the fuck is Edward Dijkstra?

    You mean Edsger W. Dijkstra maybe?

  8. Yes, NoScript by Giorgio+Maone · · Score: 2, Informative

    You're wrong, NoScript DOES give protection against this attack. The malicious code comes from the mikeyylolz.uuuq.com, which is not in your NoScript whitelist even if you're using twitter.com with scripts allowed.

    Please check http://hackademix.net/2009/04/13/mikeyys-stalkdaily-twitter-worm-vs-noscript/

    --
    There's a browser safer than Firefox, it is Firefox, with NoScript