Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter Suffers Web Interface Exploit

Posted by CmdrTaco on from the they-meant-to-tweet-that dept.

HaloZero writes "We're seeing lots of re-tweets on Twitter.com right now, all containing a fragment of JavaScript, which re-tweets itself when moused-over on the Twitter web interface. This could easily be muted into a more sinister attack, so it is recommended that you use a third party client application, or refrain from social media altogether until the problem is resolved."

7 of 165 comments (clear)

  1. First Post by Anonymous Coward · · Score: 5, Funny

    http://t.co/@"onmouseover="document.getElementById('status').value='RT test_nau';$('.status-update-form').submit();"style="background:red"/

    Before you mod me down, please consider the fact that I have a sense of humour plus I posted using "Plain Old Text" plus the script does not work on Slashdot.

    1. Re:First Post by blai · · Score: 5, Funny

      RT @Anonymous\ Coward http://t.co/@ [t.co]"onmouseover="document.getElementById('status').value='RT test_nau';$('.status-update-form').submit();"style="background:red"/ Before you mod me down, please consider the fact that I have a sense of humour plus I posted using "Plain Old Text" plus the script does not work on Slashdot.

      --
      In soviet Russia, God creates you!
  2. Hmm by grub · · Score: 4, Insightful


    Why, again, should I be using Twitter?

    --
    Trolling is a art,
    1. Re:Hmm by MrHanky · · Score: 4, Funny

      It's the best, perhaps only way to automatically retweet. That's a fairly unique service.

  3. Again? by Dragoniz3r · · Score: 4, Insightful

    You'd think people would've learned by now that you can't allow random strings of script in user-submitted data. Why is filtering this stuff out not part of standard input sanitization practices by now?

  4. Re:Or mobile by bbtom · · Score: 4, Funny

    The conditional word "if" was included for your convenience.

    --
    catch (HumourFailureException e) { e.user.send("You, sir, are a humourless idiot."); }
  5. Re:Easy solution by Culture20 · · Score: 5, Insightful

    1994 called, and it wants its World Wide Web back.

    I called, and I want 1994's WWW back. No more "My entire website is in Flash!" No more drive-by downloads. No more web-apps that just write a static page when HTML would have sufficed. <blink>Just "Here's my Dog!" and "Work in Progress" signs.</blink>