A new proof-of-concept attack gains control of Twitter's "What are you doing?" update function
February 3, 2009
A Web developer has released a proof-of-concept clickjacking attack targeting Twitter that demonstrates how an attacker could take over a member's "update" function on the microblogging site.
In a nutshell, all it takes is for the victim to click on a seemingly innocent link on a Webpage while logged into Twitter, and then his or her "What are you doing?" status is under the attacker's control. "It means anyone can update your Twitter status without you knowing," says James Padolsey, the independent Web developer who wrote the PoC and published it on his Website.
Clickjacking is an attack where a bad guy slips a malicious link invisibly onto a Webpage or under a commonly used button on a Website. When the user clicks on the link or rolls his mouse over the link, he becomes infected. Microsoft has included a new clickjacking protection feature in Internet Explorer 8 that lets Websites safeguard their sites and visitors without browser add-ons.
Padolsey's PoC isn't the first one demonstrated on Twitter, but it's an interesting twist, security experts say. Another researcher created and released one previously.
Robert "RSnake" Hansen, who, along with fellow researcher Jeremiah Grossman, first revealed the dangers of clickjacking, says Twitter isn't as attractive a clickjacking target as other vectors, however. "I don't see it as all that interesting as an attack point compared to routers, banks, Webmail, etc.," says Hansen, founder of SecTheory. "But I can see why there's a fascination in making people say things they didn't intend to say."
Padolsey's Twitter clickjacking attack (click here to experience it if you're a Twitter user) basically positions an iFrame over a button that's linked to Twitter's "Status" function. While logged in to Twitter, the victim clicks the button on the demo page and, voila, his Twitter status gets changed by the attack to a harmless update the user, himself, had no control over: "Yes, I did click the button!!! (WHAT!!??)"
"This is a pretty harmless example, but I can imagine it being used for more sinister endeavours," Padolsey blogged. "Clickjacking is a dangerous, malicious technique -- take it seriously."
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024