Vulnerabilities / Threats
12:47 PM
Connect Directly

Twitter Patches Account Hijacking Vulnerability

Easy-to-exploit, one-click attack caught more than 100,000 users; additional variations may still be at large.

Strategic Security Survey: Global Threat, Local Pain
(click for larger image and for full photo gallery)
Twitter users faced a virulent new JavaScript-based account hijacking attack on Monday. Simply clicking on one of the malicious links involved, disguised as innocuous-looking links in Tweets, enabled attackers to hijack a user's account and post numerous Tweets.

According to Stefan Tanase at antivirus vendor Kaspersky Lab, which discovered the attack, it "uses a cross-site scripting vulnerability to steal the cookie of the Twitter user, which is transferred to two specific servers. Essentially, any account which clicked on the malicious links is compromised."

So found numerous Twitter users on Monday. According to, just one of the malicious links involved in the attack saw more than 116,000 clicks.

All signs point to this attack's origin -- or at least primary target -- as being Brazil, especially since one of the malicious Tweets, written in Portuguese, claimed that a leading Brazilian pop act had suffered a "tragic accident." Furthermore, the stolen cookies were copied to two domains registered under Brazilian names, and one of the sites is hosted in Brazil, said Tanase. "We are currently working on taking down the malicious URLs and minimizing the damage as much as possible."

On Tuesday, Twitter said it had patched the related vulnerability, apparently after taking the development server offline. But according to security researchers, additional variations on the vulnerability may still be at large.

This bug has legs. It was first disclosed in late July by a security researcher known as "cbr."

But the Web application vulnerability gained a fresh look on Monday after security researcher Mike Bailey crafted and released proof-of-exploit code. "These things are ridiculously easy to attack," he said, noting that his exploit had required less than 10 minutes of coding.

To help combat such attacks in the future, Twitter is beginning to implement a new link-wrapping service known as, which will compare shortened links with a blacklist of known malware attacks before forwarding users on.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-25
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

Published: 2014-07-25
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

Published: 2014-07-25
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_...

Published: 2014-07-25
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authn...

Published: 2014-07-25
SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.