Slashdot Mirror
Twitter Suffers Web Interface Exploit
HaloZero writes "We're seeing lots of re-tweets on Twitter.com right now, all containing a fragment of JavaScript, which re-tweets itself when moused-over on the Twitter web interface. This could easily be muted into a more sinister attack, so it is recommended that you use a third party client application, or refrain from social media altogether until the problem is resolved."
http://t.co/@"onmouseover="document.getElementById('status').value='RT test_nau';$('.status-update-form').submit();"style="background:red"/
Before you mod me down, please consider the fact that I have a sense of humour plus I posted using "Plain Old Text" plus the script does not work on Slashdot.
I'm sure glad all the tweets about this have the #mouseover hash tag so I can click on it in my client to open the twitter.com web interface and read about how I shouldn't use the twitter.com web interface.
If you want to use the web interface, the mobile version isn't affected: http://m.twitter.com/
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
Why, again, should I be using Twitter?
Trolling is a art,
You'd think people would've learned by now that you can't allow random strings of script in user-submitted data. Why is filtering this stuff out not part of standard input sanitization practices by now?
Add "t.co" to your Windows Hosts file - this will stop the jibberish text.
Although the web interface is still broke. (The interface goes grey, and
any click still tries to go to the t.co web page)
Add this to your Hosts file:
0.0.0.0 t.co
there are people who aren't using hootsuite?
Check out my sysadmin blog!
http://xkcd.com/327/
There's more info on the spread of this exploit from Paul Mutton at Netcraft and Graham Cluely at Sophos.
Disable javascript. If something as simple as twitter requires javascript be enabled on the client, the company deserve all the resulting security problems!
...so it is recommended that you refrain from social media altogether.
There, fixed it for you.
"All great wisdom is contained in .signature files"
Or you could just move to a sane and open alternative, like any of the sites built on status.net, such as http://www.identi.ca
Or even roll your own.
Sorry, I didn't realize Twatter was "social media altogether". Sorry, Slashdot, you just admitted on your front page you are irrelevant. Only Twitter counts.
http://a.no/@"onmouseover=";$('textarea:first.val(this.innerHTML);$.('status-update-form.submit();"class="modal-overlay"/ which puts an overlay on the whole site, causing any mouseover to retweet. Personally I think this is pretty hilarious. If you mouse around a bunch you get something like this: http://i.imgur.com/qTPeK.png Yes I know you can see my acct. in the bg, I don't care; if it were private, why would I put it on twitter?
It is now FIXED.
http://twitter.com/delbius/status/25120366027
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
as is always the case, they'll claim it passed regression testing, so there was nothing they could do... but the simple fact is they failed at creating viable regression tests.
this is kindergarten CS stuff... these are the developers the big name outfits are hiring? do they work in the US? did anyone check their resumes?
this is pathetic
until they fix twitter.
EVERYONE! Grab a shovel.. dig a hole in the sand and instruct the person next to you to put their head in the hole, now bury their heads in the sand. Everyone do the same! Wait... one person will have to be left behind.
This is a well orchestrated attack by twitter to highlight the need to move to their own in-house url shortener t.co instead of all those other pesky untrustworthy other url shorteners. However, on a funny note it's amazing how people will, nay, must click things, especially since it's been shortened into something meaningless. No way those links could be suspect, someone tweeted that... to me! it's ok, i'll just move my mouse over here... and exert some pressure on the left mouse button... oh cr*p what have i done? LOLCATS!
Keep the fear alive!
I'm confused as to how reducing the intensity of this exploit would make it more sinister. If anybody can give me an idea of how that would work, I would appreciate it.
Now on the other hand if this attack were to mutate I could see it easily becoming something that might be very disruptive for twits (those who use Twitter).
The truth is that all men having power ought to be mistrusted. James Madison
If that was TLDR, heres my summary:
"... it is recommended that you ... refrain from social media altogether ..."
Works for me!
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
or, why not stop communicating altogether for a while,..., at least. just admire the ?'weather'?. just like we dreamed of?
there certainly is plenty going on for US to fail to communicate about?;
http://www.google.com/search?hl=en&source=hp&q=weather+manipulation
http://www.google.com/search?hl=en&source=hp&q=cheney+bush+wolfowitz+wmd+blair+weather+obama+authors+vaccine
meanwhile (there'll still be ?something? (prescription sex?) on tv. & buystuffyoudontneed.con etc...); the corepirate nazi illuminati is always hunting that patch of red on almost everyones' neck. if they cannot find yours (greed, fear ego etc...) then you can go starve. that's their (slippery/slimy) 'platform' now. see also: http://en.wikipedia.org/wiki/Antisocial_personality_disorder
never a better time to consult with/trust in our creators. the lights are coming up rapidly all over now. see you there?
greed, fear & ego (in any order) are unprecedented evile's primary weapons. those, along with deception & coercion, helps most of us remain (unwittingly?) dependent on its' life0cidal hired goons' agenda. most of our dwindling resources are being squandered on the 'wars', & continuation of the billionerrors stock markup FraUD/pyramid schemes. nobody ever mentions the real long term costs of those debacles in both life & any notion of prosperity for us, or our children. not to mention the abuse of the consciences of those of us who still have one, & the terminal damage to our atmosphere (see also: manufactured 'weather', hot etc...). see you on the other side of it? the lights are coming up all over now. the fairytail is winding down now. let your conscience be your guide. you can be more helpful than you might have imagined. we now have some choices. meanwhile; don't forget to get a little more oxygen on your brain, & look up in the sky from time to time, starting early in the day. there's lots going on up there.
"The current rate of extinction is around 10 to 100 times the usual background level, and has been elevated above the background level since the Pleistocene. The current extinction rate is more rapid than in any other extinction event in earth history, and 50% of species could be extinct by the end of this century. While the role of humans is unclear in the longer-term extinction pattern, it is clear that factors such as deforestation, habitat destruction, hunting, the introduction of non-native species, pollution and climate change have reduced biodiversity profoundly.' (wiki)
"I think the bottom line is, what kind of a world do you want to leave for your children," Andrew Smith, a professor in the Arizona State University School of Life Sciences, said in a telephone interview. "How impoverished we would be if we lost 25 percent of the world's mammals," said Smith, one of more than 100 co-authors of the report. "Within our lifetime hundreds of species could be lost as a result of our own actions, a frightening sign of what is happening to the ecosystems where they live," added Julia Marton-Lefevre, IUCN director general. "We must now set clear targets for the future to reverse this trend to ensure that our enduring legacy is not to wipe out many of our closest relatives."--
"The wealth of the universe is for me. Every thing is explicable and practical for me .... I am defeated all the time; yet to victory I am born." --emerson
no need to confuse 'religion' with being a spiritual being. our soul purpose here is to care for one another. failing that, we're simply passing through (excess baggage) being distracted/consumed by the guaranteed to fail illusionary trappings of man'kind'. & recently (about 10,000 years ago) it was determined that hoarding & excess by a few, resulted in negative consequences for all.
consult with/trust in your creators. providing more than enough of everything for everyone (without any distracting/spiritdead personal gain motives), whilst badtolling unprecedented evile, using an unlimited
"refrain from social media altogether until the problem is resolved"
I've been doing exactly that, and intend on keeping to do that until the problem of Twitter has been resolved.
What a depressingly stupid machine.
This could easily be muted into a more sinister attack.
mute |myot|
verb [ trans. ]
1 (often be muted) deaden, muffle, or soften the sound of : her footsteps were muted by the thick carpet.
muffle the sound of (a musical instrument), esp. by the use of a mute.
figurative reduce the strength or intensity of : his professional contentment was muted by personal sadness.
2 turn off (the sound on a television, telephone, or other appliance) by activating the mute : he turns the set on, mutes the sound, but flicks through the channels.
mutate |myott|
verb
change or cause to change in form or nature : [ intrans. ] technology continues to mutate at an alarming rate | [ trans. ] the quick-dry solution really worked, even if it did mutate the skin on her fingers to reptilian scales.
Biology (with reference to a cell, DNA molecule, etc.) undergo or cause to undergo change in a gene or genes : [ intrans. ] the virus is able to mutate into new forms that are immune to the vaccine | [ trans. ] certain nucleotides were mutated.
http://www.spy.appspot.com/ a "search" site for social media
Might be fun to note who is using in in ~ realtime.
Domestic spying is now "Benign Information Gathering"
Exploit? I can't see that this is any worse than what the Twitter Web Interface (or any other Twitter interface) was designed to do.
refrain from social media altogether until the problem is resolved
Hey, they found my solution, then again, since I never know when it is vulnerable, I just avoid it altogether.
It seems this one has been fixed already, but if you get infected in the future, here's one way to fix it so you at least won't spread the plague too much. Other methods exist, but this is how you could do it if for some reason you only wanted to use Twitter's main webpages.
1) Make sure you've got a script-blocker, such as NoScript.
2) Disable scripts from Twitter and TwitImg (or whatever the image server is, I can't check it now).
3) Navigate to twitter.com/USERNAME#
4) Right now, you lack a lot of Twitter functionality, but the Undo button should still work. Click it.
5) Twitter should tell you it's attempting to undo. Wait a few moments, and then refresh.
6) Repeat 4 and 5 until you successfully cure yourself.
7) Don't use Twitter again until the exploit is fixed.
8) NOW you can restore your original settings.
or refrain from social media altogether
Sounds like health class again.
I'd happily pay you Tuesday for a biopsy today!
What a stupid, senseless pieces of garbage. And for what purpose are all of these social engineering, I mean networking, sites.
Every web developer should religiously study OWASP's Top Ten Most Critical Web Application Security Risks and be held accountable to it by their superiors.
Those who work with contractors should especially do this as I've found that contractors tend to have the worst habits when it comes to security.
Faith is a willingness to accept something w/o complete proof and to act on it. Reason allows you to correct that faith.
How can I use a 3rd party client when my favourite ones are broken and the ones that aren't broken a missing vital features for those who aren't on Twitter 24/7 (like Gwibber and its lack of scroll-back)? Curse you, OAuth deadline. Curse you!
I've always coded most forms, especially login forms, with random form names / ID's. This stops most generic javascript based attacks. While you could certainly code easily enough to submit form 0 and change value of DOM object 1, it adds to the complexity of the whole exploit, and would have stopped any successful attempts at a hard coded getElementById().
neorush
I heard you're angry.
The only useful thing saw in the article was "refrain from social media altogether".
Thanks for stating the obvious :)