Slashdot Mirror
Twitter Suffers Web Interface Exploit
HaloZero writes "We're seeing lots of re-tweets on Twitter.com right now, all containing a fragment of JavaScript, which re-tweets itself when moused-over on the Twitter web interface. This could easily be muted into a more sinister attack, so it is recommended that you use a third party client application, or refrain from social media altogether until the problem is resolved."
http://t.co/@"onmouseover="document.getElementById('status').value='RT test_nau';$('.status-update-form').submit();"style="background:red"/
Before you mod me down, please consider the fact that I have a sense of humour plus I posted using "Plain Old Text" plus the script does not work on Slashdot.
I'm sure glad all the tweets about this have the #mouseover hash tag so I can click on it in my client to open the twitter.com web interface and read about how I shouldn't use the twitter.com web interface.
If you want to use the web interface, the mobile version isn't affected: http://m.twitter.com/
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
Why, again, should I be using Twitter?
Trolling is a art,
You'd think people would've learned by now that you can't allow random strings of script in user-submitted data. Why is filtering this stuff out not part of standard input sanitization practices by now?
Add "t.co" to your Windows Hosts file - this will stop the jibberish text.
Although the web interface is still broke. (The interface goes grey, and
any click still tries to go to the t.co web page)
Add this to your Hosts file:
0.0.0.0 t.co
http://xkcd.com/327/
There's more info on the spread of this exploit from Paul Mutton at Netcraft and Graham Cluely at Sophos.
Yes, there are people who aren't total social media douchebags who use Twitter.
HootSuite uses ow.ly which for quite a long time wrapped links in a stupid 'social toolbar', a sort of crap Twitter version of the DiggBar. Horrible. If I go to someone's Twitter profile and see that they have mostly been posting from HootSuite, I conclude the same thing as when I see they use Outlook for their e-mail.
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
Disable javascript. If something as simple as twitter requires javascript be enabled on the client, the company deserve all the resulting security problems!
...so it is recommended that you refrain from social media altogether.
There, fixed it for you.
"All great wisdom is contained in .signature files"
Or you could just move to a sane and open alternative, like any of the sites built on status.net, such as http://www.identi.ca
Or even roll your own.
Sorry, I didn't realize Twatter was "social media altogether". Sorry, Slashdot, you just admitted on your front page you are irrelevant. Only Twitter counts.
If I go to someone's Twitter profile and see that they have mostly been posting from HootSuite, I conclude the same thing as when I see they use Outlook for their e-mail.
That they're at work?
http://a.no/@"onmouseover=";$('textarea:first.val(this.innerHTML);$.('status-update-form.submit();"class="modal-overlay"/ which puts an overlay on the whole site, causing any mouseover to retweet. Personally I think this is pretty hilarious. If you mouse around a bunch you get something like this: http://i.imgur.com/qTPeK.png Yes I know you can see my acct. in the bg, I don't care; if it were private, why would I put it on twitter?
It is now FIXED.
http://twitter.com/delbius/status/25120366027
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
as is always the case, they'll claim it passed regression testing, so there was nothing they could do... but the simple fact is they failed at creating viable regression tests.
this is kindergarten CS stuff... these are the developers the big name outfits are hiring? do they work in the US? did anyone check their resumes?
this is pathetic
until they fix twitter.
EVERYONE! Grab a shovel.. dig a hole in the sand and instruct the person next to you to put their head in the hole, now bury their heads in the sand. Everyone do the same! Wait... one person will have to be left behind.
This is a well orchestrated attack by twitter to highlight the need to move to their own in-house url shortener t.co instead of all those other pesky untrustworthy other url shorteners. However, on a funny note it's amazing how people will, nay, must click things, especially since it's been shortened into something meaningless. No way those links could be suspect, someone tweeted that... to me! it's ok, i'll just move my mouse over here... and exert some pressure on the left mouse button... oh cr*p what have i done? LOLCATS!
Keep the fear alive!
I'm confused as to how reducing the intensity of this exploit would make it more sinister. If anybody can give me an idea of how that would work, I would appreciate it.
Now on the other hand if this attack were to mutate I could see it easily becoming something that might be very disruptive for twits (those who use Twitter).
The truth is that all men having power ought to be mistrusted. James Madison
If that was TLDR, heres my summary:
"... it is recommended that you ... refrain from social media altogether ..."
Works for me!
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
"refrain from social media altogether until the problem is resolved"
I've been doing exactly that, and intend on keeping to do that until the problem of Twitter has been resolved.
What a depressingly stupid machine.
This could easily be muted into a more sinister attack.
mute |myot|
verb [ trans. ]
1 (often be muted) deaden, muffle, or soften the sound of : her footsteps were muted by the thick carpet.
muffle the sound of (a musical instrument), esp. by the use of a mute.
figurative reduce the strength or intensity of : his professional contentment was muted by personal sadness.
2 turn off (the sound on a television, telephone, or other appliance) by activating the mute : he turns the set on, mutes the sound, but flicks through the channels.
mutate |myott|
verb
change or cause to change in form or nature : [ intrans. ] technology continues to mutate at an alarming rate | [ trans. ] the quick-dry solution really worked, even if it did mutate the skin on her fingers to reptilian scales.
Biology (with reference to a cell, DNA molecule, etc.) undergo or cause to undergo change in a gene or genes : [ intrans. ] the virus is able to mutate into new forms that are immune to the vaccine | [ trans. ] certain nucleotides were mutated.
http://www.spy.appspot.com/ a "search" site for social media
Might be fun to note who is using in in ~ realtime.
Domestic spying is now "Benign Information Gathering"
Exploit? I can't see that this is any worse than what the Twitter Web Interface (or any other Twitter interface) was designed to do.
refrain from social media altogether until the problem is resolved
Hey, they found my solution, then again, since I never know when it is vulnerable, I just avoid it altogether.
It seems this one has been fixed already, but if you get infected in the future, here's one way to fix it so you at least won't spread the plague too much. Other methods exist, but this is how you could do it if for some reason you only wanted to use Twitter's main webpages.
1) Make sure you've got a script-blocker, such as NoScript.
2) Disable scripts from Twitter and TwitImg (or whatever the image server is, I can't check it now).
3) Navigate to twitter.com/USERNAME#
4) Right now, you lack a lot of Twitter functionality, but the Undo button should still work. Click it.
5) Twitter should tell you it's attempting to undo. Wait a few moments, and then refresh.
6) Repeat 4 and 5 until you successfully cure yourself.
7) Don't use Twitter again until the exploit is fixed.
8) NOW you can restore your original settings.
or refrain from social media altogether
Sounds like health class again.
I'd happily pay you Tuesday for a biopsy today!
What a stupid, senseless pieces of garbage. And for what purpose are all of these social engineering, I mean networking, sites.
Every web developer should religiously study OWASP's Top Ten Most Critical Web Application Security Risks and be held accountable to it by their superiors.
Those who work with contractors should especially do this as I've found that contractors tend to have the worst habits when it comes to security.
Faith is a willingness to accept something w/o complete proof and to act on it. Reason allows you to correct that faith.
How can I use a 3rd party client when my favourite ones are broken and the ones that aren't broken a missing vital features for those who aren't on Twitter 24/7 (like Gwibber and its lack of scroll-back)? Curse you, OAuth deadline. Curse you!
I've always coded most forms, especially login forms, with random form names / ID's. This stops most generic javascript based attacks. While you could certainly code easily enough to submit form 0 and change value of DOM object 1, it adds to the complexity of the whole exploit, and would have stopped any successful attempts at a hard coded getElementById().
neorush
The only useful thing saw in the article was "refrain from social media altogether".
Thanks for stating the obvious :)