Slashdot Mirror
Twitter Suffers Web Interface Exploit
HaloZero writes "We're seeing lots of re-tweets on Twitter.com right now, all containing a fragment of JavaScript, which re-tweets itself when moused-over on the Twitter web interface. This could easily be muted into a more sinister attack, so it is recommended that you use a third party client application, or refrain from social media altogether until the problem is resolved."
http://t.co/@"onmouseover="document.getElementById('status').value='RT test_nau';$('.status-update-form').submit();"style="background:red"/
Before you mod me down, please consider the fact that I have a sense of humour plus I posted using "Plain Old Text" plus the script does not work on Slashdot.
I'm sure glad all the tweets about this have the #mouseover hash tag so I can click on it in my client to open the twitter.com web interface and read about how I shouldn't use the twitter.com web interface.
If you want to use the web interface, the mobile version isn't affected: http://m.twitter.com/
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
Why, again, should I be using Twitter?
Trolling is a art,
You'd think people would've learned by now that you can't allow random strings of script in user-submitted data. Why is filtering this stuff out not part of standard input sanitization practices by now?
Add "t.co" to your Windows Hosts file - this will stop the jibberish text.
Although the web interface is still broke. (The interface goes grey, and
any click still tries to go to the t.co web page)
Add this to your Hosts file:
0.0.0.0 t.co
http://xkcd.com/327/
There's more info on the spread of this exploit from Paul Mutton at Netcraft and Graham Cluely at Sophos.
Yes, there are people who aren't total social media douchebags who use Twitter.
HootSuite uses ow.ly which for quite a long time wrapped links in a stupid 'social toolbar', a sort of crap Twitter version of the DiggBar. Horrible. If I go to someone's Twitter profile and see that they have mostly been posting from HootSuite, I conclude the same thing as when I see they use Outlook for their e-mail.
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
...so it is recommended that you refrain from social media altogether.
There, fixed it for you.
"All great wisdom is contained in .signature files"
http://a.no/@"onmouseover=";$('textarea:first.val(this.innerHTML);$.('status-update-form.submit();"class="modal-overlay"/ which puts an overlay on the whole site, causing any mouseover to retweet. Personally I think this is pretty hilarious. If you mouse around a bunch you get something like this: http://i.imgur.com/qTPeK.png Yes I know you can see my acct. in the bg, I don't care; if it were private, why would I put it on twitter?
It is now FIXED.
http://twitter.com/delbius/status/25120366027
catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
as is always the case, they'll claim it passed regression testing, so there was nothing they could do... but the simple fact is they failed at creating viable regression tests.
this is kindergarten CS stuff... these are the developers the big name outfits are hiring? do they work in the US? did anyone check their resumes?
this is pathetic
until they fix twitter.
EVERYONE! Grab a shovel.. dig a hole in the sand and instruct the person next to you to put their head in the hole, now bury their heads in the sand. Everyone do the same! Wait... one person will have to be left behind.
This is a well orchestrated attack by twitter to highlight the need to move to their own in-house url shortener t.co instead of all those other pesky untrustworthy other url shorteners. However, on a funny note it's amazing how people will, nay, must click things, especially since it's been shortened into something meaningless. No way those links could be suspect, someone tweeted that... to me! it's ok, i'll just move my mouse over here... and exert some pressure on the left mouse button... oh cr*p what have i done? LOLCATS!
Keep the fear alive!
I'm confused as to how reducing the intensity of this exploit would make it more sinister. If anybody can give me an idea of how that would work, I would appreciate it.
Now on the other hand if this attack were to mutate I could see it easily becoming something that might be very disruptive for twits (those who use Twitter).
The truth is that all men having power ought to be mistrusted. James Madison
I'm sorry, but 1994 called, and it wants its World Wide Web back. Interactive webpages are the future, they are actually really nice when they're done properly, and denying that is just holding you back. I expect that sooner or later secure programming mentalities will become deeply ingrained in Web programming, and things like this will stop happening. There will always be bugs, but that's no different from any other software.
NoScript is a much better solution than out-and-out disabling javascript anyways.
If that was TLDR, heres my summary:
"... it is recommended that you ... refrain from social media altogether ..."
Works for me!
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
"refrain from social media altogether until the problem is resolved"
I've been doing exactly that, and intend on keeping to do that until the problem of Twitter has been resolved.
What a depressingly stupid machine.
This could easily be muted into a more sinister attack.
mute |myot|
verb [ trans. ]
1 (often be muted) deaden, muffle, or soften the sound of : her footsteps were muted by the thick carpet.
muffle the sound of (a musical instrument), esp. by the use of a mute.
figurative reduce the strength or intensity of : his professional contentment was muted by personal sadness.
2 turn off (the sound on a television, telephone, or other appliance) by activating the mute : he turns the set on, mutes the sound, but flicks through the channels.
mutate |myott|
verb
change or cause to change in form or nature : [ intrans. ] technology continues to mutate at an alarming rate | [ trans. ] the quick-dry solution really worked, even if it did mutate the skin on her fingers to reptilian scales.
Biology (with reference to a cell, DNA molecule, etc.) undergo or cause to undergo change in a gene or genes : [ intrans. ] the virus is able to mutate into new forms that are immune to the vaccine | [ trans. ] certain nucleotides were mutated.
http://www.spy.appspot.com/ a "search" site for social media
Might be fun to note who is using in in ~ realtime.
Domestic spying is now "Benign Information Gathering"
Exploit? I can't see that this is any worse than what the Twitter Web Interface (or any other Twitter interface) was designed to do.
1994 called, and it wants its World Wide Web back.
I called, and I want 1994's WWW back. No more "My entire website is in Flash!" No more drive-by downloads. No more web-apps that just write a static page when HTML would have sufficed. <blink>Just "Here's my Dog!" and "Work in Progress" signs.</blink>
It seems this one has been fixed already, but if you get infected in the future, here's one way to fix it so you at least won't spread the plague too much. Other methods exist, but this is how you could do it if for some reason you only wanted to use Twitter's main webpages.
1) Make sure you've got a script-blocker, such as NoScript.
2) Disable scripts from Twitter and TwitImg (or whatever the image server is, I can't check it now).
3) Navigate to twitter.com/USERNAME#
4) Right now, you lack a lot of Twitter functionality, but the Undo button should still work. Click it.
5) Twitter should tell you it's attempting to undo. Wait a few moments, and then refresh.
6) Repeat 4 and 5 until you successfully cure yourself.
7) Don't use Twitter again until the exploit is fixed.
8) NOW you can restore your original settings.
or refrain from social media altogether
Sounds like health class again.
I'd happily pay you Tuesday for a biopsy today!
Every web developer should religiously study OWASP's Top Ten Most Critical Web Application Security Risks and be held accountable to it by their superiors.
Those who work with contractors should especially do this as I've found that contractors tend to have the worst habits when it comes to security.
Faith is a willingness to accept something w/o complete proof and to act on it. Reason allows you to correct that faith.
How can I use a 3rd party client when my favourite ones are broken and the ones that aren't broken a missing vital features for those who aren't on Twitter 24/7 (like Gwibber and its lack of scroll-back)? Curse you, OAuth deadline. Curse you!
*sobs* who ever thought we'd be getting nostalgic for blink tags?
To have a right to do a thing is not at all the same as to be right in doing it
fine fine, i'm getting off your lawn, sheesh!
I've always coded most forms, especially login forms, with random form names / ID's. This stops most generic javascript based attacks. While you could certainly code easily enough to submit form 0 and change value of DOM object 1, it adds to the complexity of the whole exploit, and would have stopped any successful attempts at a hard coded getElementById().
neorush
Seriously, I don't get the anti-JavaScript mindset. From what I understand, however, it is only a small (and quite vocal) minority.
People who disable JavaScript should not expect to experience a working website (including Twitter).