Vulnerabilities / Threats
6/15/2009
05:00 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Twitter Security Heating Up In July

In an effort to raise awareness of browser security flaws, one researcher wants to post a vulnerability every day that shows the soft underside of the Fail Whale.

For Twitter users, the month of living dangerously begins in two weeks. Come July, Israeli security researcher Aviv Raff plans to publish a new Twitter security vulnerability every day, for the duration of the month.

Raff participated in the "Month of Browser Bugs" initiative in July 2006. It was an effort to raise awareness of browser security flaws. Now he wants to shine the spotlight on Twitter with the "Month of Twitter Bugs."

"Each day I will publish a new vulnerability in a third-party Twitter service on the twitpwn.com Web site," Raff explained on his blog. "As those vulnerabilities can be exploited to create a Twitter worm, I'm going to give the third-party service provider and Twitter at least 24 hours heads-up before I publish the vulnerability."

Raff says that while he has more than enough vulnerabilities to publish one every day in July, he nonetheless welcomes submissions.

Twitter did not respond to a request for comment.

Raff, in a previous blog post, observed that Twitter's most significant security problem is its API, which can be abused to create worms.

In May, he created proof-of-concept code that exploits a vulnerability in the Web site twitpic.com, which uses the Twitter API.

Twitter has weathered several security problems already this year. In April, a Twitter worm created by a 17-year-old infected at least 190 accounts and generated almost 10,000 spam tweets.

Also in April, a Twitter administrative account was hacked. The hacker who claimed responsibility posted screenshots of several celebrity Twitter accounts accessed through the compromised administrative account.

There have been other incidents too: In March, about 750 Twitter accounts were hacked and used to send spam. And in January, 33 Twitter accounts associated with celebrities were hacked through a brute-force password attack.

In response to the April account hack, Twitter co-founder Biz Stone said the company would conduct an independent security audit of its internal systems and would deploy additional anti-intrusion measures. To date, the company has not provided an update on its security efforts.


InformationWeek Analytics and DarkReading.com have published an independent analysis of security outsourcing. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

CVE-2014-6132
Published: 2014-12-24
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2014-6153
Published: 2014-12-24
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.