Slashdot Mirror
Aussie Student Responsible For Twitter Exploit
bennyboy64 writes "An Australian teen has caused havoc on Twitter by discovering an exploit that hit thousands of users, including Barack Obama's press secretary, and resulted in the tweets of a former British PM's wife linking to hardcore porn, The Sydney Morning Herald reports. Pearce Delphin, who is studying his last year at high school, said that he was surprised that 'so many famous people got infected.'"
Got a great career ahead of him, if he wants...
The summary kind of makes it sound like he's a kid who was looking for exploits and then used it to make a virus. This doesn't seem to be the case at all. According to the TFA he saw some people using CSS in their twitter posts, and wondered if he could use HTML/JavaScript (as I would be too). He found he could, did some experimenting, and his followers then started doing it too and it went viral (the idea), and then some malicious people found it, and went viral (the code).
I assume no punishment is being leveraged against him, but I'm sure many will misunderstand what happened and call for it anyways. Curiosity should be encouraged.
The article says he is the one that discovered the exploit, but he did not create the script that made 'tweets of a former British PM's wife linking to hardcore porn'. Just to clarify.
Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.
This is doubly true when the vector is a social networking site.
[Fuck Beta]
o0t!
Aussie Student Responsible For Twitter Exploit
Discovering an exploit hardly makes him responsible for it. Let's put the blame where it belongs, probably either sloppy coding practices, or high pressure from clueless management to develop software quickly.
Or in keeping with your sig, Microsoft's fault for not including something like noscript to keep your browser from doing the wrong thing?
Famous people don't use Twitter.
Twitter makes people famous.
Followed by the other related quote:
There's a sucker born every minute.
It's their site, their code, and they set the rules.
bullshit, it has to be true that he discovered the exploit, netcraft confirms it:
http://news.netcraft.com/archives/2010/09/21/twitter-users-fall-victim-to-new-xss-worm.html
You mean twitter is actually useful for something?
"so many famous people got infected."
I am not a vegetarian, but I get annoyed at people that proclaim "I am vegetarian. I only eat fish, cheese, and chicken."
Similarly, anyone who was exposed to the computer wrecking virus's of the 90's thru to 2002, know what "infection" really means. I am not a low level coder, only high level languages in a business environment, but I do wonder what some old skoolers must think when they read about a piece of HTML Javascript being described as "Infection". I am vegetarian, I will eat steak only if its well done.
In post Patriot Act America, the library books scan you.
I guess this was the "inout, inout" part of the bible referred to in A Clockwork Orange...?
Living With a Nerd
After a "little bit of coding", he said he "managed to generate a dialog box containing the data from within the Twitter cookie file". He said "theoretically this could be used to maliciously steal users' account details".
They make it sound difficult to alert(document.cookie)...
But "the problem was being able to write code that can steal usernames and passwords while still remaining under Twitter's 140 character tweet limit", he said.
Ah, so the 140-character limit is actually beneficial in some sense!
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Maybe because they (hackers) don't want to be banned from twitter when they are found out?
Disclaimer: I don't Twat or book faces.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Well, the exploit uses JavaScript. This means that any browser that supports JavaScript does not provide some sort of NoScript facility that's installed and turned on by default would be vulnerable to the exploit.
Which means pretty much all of them.
But you can't even blame the browser; the security of Twitter's site belongs solely to Twitter and their crack website development staff.
My blog
My prefs are set to keep sigs hidden, you insensitive clod!
The Admin and the Engineer
please read the rest of TFA, not just that sentence.
He just discovered it but did not exploit it in a malicious way. It was others who did that. I don't think he needs any "defense" for doing an alert('uh oh');
He probably means that its their responsibility that others abused the exploit that he did NOT write.
This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.
Little Bobby Tables strikes again. ;)
http://xkcd.com/327/
would you prefer it hadn't been found and exposed so it can be fixed?
or would you prefer that unknown criminals were the ones exploiting it fraudulently?
because with a latent bug like this, those are the choices.
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
Since the fall of Adam.
Well, you did ask.
err... yeah. change that first line to "had been"
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
I just found that in search results, twitter appears to be still affected by this bug.
The video is still processing but should be up soon.
=================
Unix is very user friendly, it's just picky about who its friends are.
Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.
But famous people are technical experts. That's why we turn to them so often for their opinion and advice on important complicated problems that overwhelm and confuse the average person. ;-)
Reading comprehension fail.
"zzap appears to have discovered the vulnerability shortly after seeing RainbowTwtr's colourful use of CSS injection to display the colours of the rainbow."
He discovered *someone elses* use of the vulnerability. He then went on to make it more publicly known, and finally lamented the evil that was about to descend upon the twitterverse.
Don't they check for identical messages repeating rapidly?
"Exploit"? What, exactly, he "exploited"?
Hey, look at an "exploit" that makes shit posts, and has no value in relation to security whatsoever.
But yeah, he has a great career ahead of him, and he's next security wizard?
No wonder everyone left security industry, and you're left with monkeys interested in Twitter/Facebook only...
This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes. And if hes smart enough to be messing around with the code then he should have been smart enough to figure it will be used for bad purposes. Thats what history of releasing exploits tell me anyways. And some say its twitters fault,well its not twitter who is paying, its the exploited users that pay. I think those who have the knowledge have a mush more responsibility to NOT abuse there knowledge. This kid abused his knowledge,knowing other could use the exploit for bad purposes.
Jack of all trades,master of none
He found the exploit... he didnt exploit anything. He is thusly not responsible at all. The mischievous users and twitter are the ones responsible.
This is exactly the kind of scenario I envisioned last week. This kid's intent wasn't malicious, but think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.
The ping attribute needs to be dropped or considered much more carefully.
"The guy who discovered the exploit, or the coding process which allowed it?"
OH I know this one!!!
What is... the guy that discovered the exploit!
Because see, even though you discovered that the front door was left open it doesn't give you permission to go in. See how that works? Yeah I know it's very confusing, best just to not check if doors are open unless they're doors you own.
my karma will be here long after I'm gone
According to this article http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=da&tl=en&u=http%3A%2F%2Fpolitiken.dk%2Ftjek%2Fdigitalt%2F1065381%2Fnorsk-dreng-fik-twitter-i-knae%2F (google translated) it was a Norwegian boy who discovered the bug. Not that it really matters, I suppose...
A modpoint, a modpoint, my kingdom for a modpoint.
Degaussing scares the bad magnetism out of the monitor and fills it with good karma.
Correct. The actual exploit was discovered by a Japanese man who also discovered an earlier XSS attack on Twitter's dev servers. This story was manufactured by the Australian media.
Agreed. However, what if that door's the Security Entrance for a nuclear power plant (or worse; see Cliff Stoll's "The Cuckoo's Egg")? Isn't it a good thing that people are testing these things? Their actions from then on should dictate their future. Exploit it, or report it to the auths?
Good testers are hard to find. Free, volunteer testers should be welcomed.
There's so much crap going on out there, the authorities can't possibly keep up with all of it (considering their present preoccupation with other things (not going there)).
"Tongue tied and twisted, just an Earth bound misfit
It's a good thing they just used onmouseover rather than onload. That would have been quite a chaotic mess.
Ask me about repetitive DNA
Ok, so you discover the front door is open on your local Nuclear Power Plant. Do you:
(a) Tell every man and his dog the door is open, or
(b) Tell the operator of the power station that the door is open?
A "tester" would go for (b). This guy went for (a).
dnuof eruc rof aixelsid
I think I suggested the ethical one would try to contact the authorities. (a) is last resort, after they prove ineffectual.
"Tongue tied and twisted, just an Earth bound misfit
Likewise the security of Microsoft OSses.
Microsoft should be fined an equivalent of the cost of all the unrequested commercial mail being transmitted on the internet, and should be required to pay everyone who has to delete more than twenty such mails a week for the time lost to the deletion process.
Microsoft should be required to pay every user whose bank account has been compromised the money lost.
And that's just for starters.
Sure, twitter's coding is bad, but the problem is made much worse by Microsoft's shoddy implementations of prototypes and turning the prototypes into de-facto standards well before the tech was ready.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
That was not a security flaw. That was an opportunity.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Oh shut up. Seriously, do some research instead of just doing the trendy, Bash Microsoft thing. What a stupid turdball you are.
Twitter wasn't already evil to start with?
Nothing could be as evil as using the word "twitterverse" without apparent irony.
To have a right to do a thing is not at all the same as to be right in doing it