Vulnerabilities / Threats
9/8/2010
12:47 PM
Connect Directly
RSS
E-Mail
50%
50%

Twitter Patches Account Hijacking Vulnerability

Easy-to-exploit, one-click attack caught more than 100,000 users; additional variations may still be at large.




Strategic Security Survey: Global Threat, Local Pain
(click for larger image and for full photo gallery)
Twitter users faced a virulent new JavaScript-based account hijacking attack on Monday. Simply clicking on one of the malicious links involved, disguised as innocuous-looking links in Tweets, enabled attackers to hijack a user's account and post numerous Tweets.

According to Stefan Tanase at antivirus vendor Kaspersky Lab, which discovered the attack, it "uses a cross-site scripting vulnerability to steal the cookie of the Twitter user, which is transferred to two specific servers. Essentially, any account which clicked on the malicious links is compromised."

So found numerous Twitter users on Monday. According to bit.ly, just one of the malicious links involved in the attack saw more than 116,000 clicks.

All signs point to this attack's origin -- or at least primary target -- as being Brazil, especially since one of the malicious Tweets, written in Portuguese, claimed that a leading Brazilian pop act had suffered a "tragic accident." Furthermore, the stolen cookies were copied to two domains registered under Brazilian names, and one of the sites is hosted in Brazil, said Tanase. "We are currently working on taking down the malicious URLs and minimizing the damage as much as possible."

On Tuesday, Twitter said it had patched the related vulnerability, apparently after taking the dev.twitter.com development server offline. But according to security researchers, additional variations on the vulnerability may still be at large.

This bug has legs. It was first disclosed in late July by a security researcher known as "cbr."

But the Web application vulnerability gained a fresh look on Monday after security researcher Mike Bailey crafted and released proof-of-exploit code. "These things are ridiculously easy to attack," he said, noting that his exploit had required less than 10 minutes of coding.

To help combat such attacks in the future, Twitter is beginning to implement a new link-wrapping service known as t.co, which will compare shortened links with a blacklist of known malware attacks before forwarding users on.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio