Attacks/Breaches
4/13/2009
01:32 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Twitter Visited By Worms Instead Of Bunnies

An exploit of a cross-site scripting flaw in Twitter sent almost 10,000 spam tweets and compromised at least 190 accounts over the weekend.

Despite Stone's reassurances, Mikko Hypponen, chief researcher at F-Secure, said further attacks occurred Monday. "Twitter administrators don't seem to be able to shut down the various XSS/CSRF worms that have been plaguing the service over the weekend," he said in a blog post. "The actual problems to end users haven't been devastating -- so far. Most of the Twitter worms simply modify people's profiles to infect more users. However, attacks like these could be much worse if the attackers would incorporate nastier attacks, such as browser exploits."

Hypponen observes that the latest worm attack uses the bit.ly URL shortening service to redirect victims to an infected profile. URL shortening services like bit.ly have been criticized recently for various reasons, one of which is the security implications of disguised URLs.

Last month, Secure Science researchers Lance James and Eric Wastl said Twitter was vulnerable to a serious XSS vulnerability that could allow an attacker to hijack users' accounts or, in conjunction with other exploit code, compromise their computers.

The Twitter worm that struck over the weekend appears to make use of a different XSS vulnerability. Its code has been posted on GitHub, a collaborative programming code repository.

A post on the Secure Science blog warns that the viral effect of social networks magnifies the impact of viral computer code. "[W]hen vulnerabilities are found such as cross-site scripting, this viral effect may be easily abused and produce a detrimental outcome such as infecting account holders and possibly crashing the social network," the company said.

According to online news site BNOnews.com, a 17-year-old from Brooklyn, N.Y., identified as Mikeyy Mooney, claimed responsibility for creating the Twitter worm to drive traffic to his Web site, StalkDaily.com.

A request for comment sent to StalkDaily.com was not answered.


Attend a Webcast on why bad security breaches keep happening to good organizations. It happens Wednesday, April 15. Find out more and register.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.