Twitter Gets Slammed By the StalkDaily XSS Worm

CurtMonash writes "Twitter was hit Saturday by a worm that caused victims' accounts to tweet favorably about the StalkDaily website. Infection occurred when one went to the profile page of a compromised account, and was largely spread by the kind of follower spam more commonly used by multi-level marketers. Apparently the worm was an XSS attack, exploiting a vulnerability created in a recent Twitter update that introduced support for OAuth, and it was created by the 17-year-old owner of the StalkDaily website. More information can be found in the comment thread to a Network World post I put up detailing the attack, or in the post itself. By evening, Twitter claimed to have closed the security hole."

Comments

To hire or to jail, that is the question

[BadAnalogyGuy]

A 17 year old is old enough to understand the ramifications of his actions to a reasonable extent. He no doubt understood that releasing a worm like that would be met with an unfavorable reaction. But he did it anyway. In this sense, he is a potential menace to the Internet.

However, he is still in his formative years. His abilities could be nurtured in productive directions and we could have the next Edward Dijkstra in the making.

So do we punish him and turn him to the Dark Side? Or do we show him love and respect and turn him? There is still good in him. I can feel it.

Re:To hire or to jail, that is the question

[SuperNothing307]

No offense, but having a good understanding of XSS attacks at 17 doesn't exactly equate to the mathematical and analytical abilities of Edward Dijkstra. I know I don't put myself anywhere near that level. In fact, I'd argue that the chances are well in favor of him doing something like this again, except worse, rather than his becoming someone who does something beneficial for the world. I mean, look at all the attention he has gotten for this. Imagine what would happen if he does something worse! Punish him now, make him understand the gravity of his actions.

Re:To hire or to jail, that is the question

[rs79]

I say anything that slows down the spread of those fucking annoying twitter people is a good thing and he should be awarded a medal.

Tweet this, bitch.

Bit obvious

[Toe, The]

Cool exploit, but worm-spamming your own public site is a bit, um, not well thought out. Or maybe it's a great way of getting a job. Depends on the legality of the worm, I suppose. :)

Re:Bit obvious

[timholman]

Cool exploit, but worm-spamming your own public site is a bit, um, not well thought out.

Especially when you read the Terms of Service on Mr. Mooney's own StalkDaily website, e.g.:

7. You must not modify, adapt or hack StalkDaily.com or modify another website so as to falsely imply that it is associated with StalkDaily.com.

8 You must not create or submit unwanted email to any StalkDaily members ("Spam").

9. You must not transmit any worms or viruses or any code of a destructive nature.

Talk about having a "Do as I say, not as I do" morality. At least it's refreshing to see that hypocrisy is not restricted to people over 30.

Would you trust StalkDaily?

[Joao]

Seriously, would you? The developer admits to infecting people's computers and accounts in order to advertise his services, and doesn't think he did anything wrong. How can anyone trust his services then?

For starters he should be forced to take down StalkDaily. I'm sure Tweeter lawyers are looking into this right now. And for once, I agree with such a move. /not a tweeter user

Re:Would you trust StalkDaily?

[Anonymous Coward]

Two issues with your post:
One, the dev did not infect anyone's computers. He wrote a small program, on the site, that would update the profile of anybody who saw one of the spam comments. For example, you visit a friend's page who has one of these comments (and therefore the code) and your profile is updated with a comment (and the code). The only "infection" was on the site, not the end users. Also, no accounts were hacked. Simply a case of instructing the visitor's browser to slyly update the visitor's status while looking at a different page. TFA states that there were no passwords, usernames, or anything else in the code.
Two, it's twitter.

Re:author found. Now what?

[berend botje]

Hang him, I'd say.

Re:Clearly he should be made to

[Anpheus]

Go and manually run anti virus software on every infected PC.

Not that kind of worm. It was purely a scripting attack involving javascript. No one's computers were harmed, only a bunch of twitter accounts. (Which can no doubt be fixed by patching the whole and some good SQL query to fix all the accounts in one go.)

Re:throw the scumbag in jail

[Teun]

Idiots like him are the reason viruses exist.

Stop right there! You are infringing on a Microsoft technology.

Re:author found. Now what?

[oldhack]

Buy that man a beer. :-)

Re:I saw this.

[sakdoctor]

You have used the verb "tweeted".
Ninjas have been dispatched to your location, to make sure you don't do it again.

Sounds Like A Publicity Stunt

[Dreadneck]

FTA:

StalkDaily.com is similar in design and features to Twitter. In addition to the features of Twitter, it also allows users to upload videos and photos. Through looking at the code behind Twitter, Mikeyy was able to produce a similar site to Twitter with some additional features. "I used my past knowledge to gain an insight on how Twitter worked and outputted to a user. Although both of the sites are coded in different languages I was able to give my site the same features as Twitter, while coding some of my own."

It sounds to me like the kid was trying to promote his Twitter knockoff site, but for some reason felt the need to do so by poking a stick in Twitter's eye. Makes me think the whole thing was a juvenile cry for attention. I knew a kid like that in high school. He was smart as could be but would do anything, no matter how socially unacceptable, to get attention.

I think the kid needs counseling and guidance and not a jail sentence.

Re:author found. Now what?

[morgan_greywolf]

I tried, but they closed down the Microsoft Pub.

Re:NoScript?

[morgan_greywolf]

You're not ignorant. You're right. In addition, recent Firefox browsers have built-in XSS blocking.

Samy is my hero

[The Real Toad King]

This sounds almost exactly like the Samy worm to me.

Re:NoScript?

[wannabgeek]

Yeah right! Every time some vi comes up, people start holding NoScript as a panacea. I use NoScript so I am aware of its advantages. But it's not a cure-all. There are so many sites (twitter in this case) which simply do not work without Javascript being enabled. So most of the NoScript users who use twitter through a browser will have Javascript enabled - by white listing it in NoScript. So, no sorry, NoScript is not a protection against this one.

Spell Twitter

[wfstanle]

Remember, you can't spell "Twitter" without using the word "twit".

Re:author found. Now what?

[Anonymous Coward]

Yeah, but if you ask for a beer the bartender calls you a N00B and if you ask what beers are available he tells you to RTFMenu.