Vulnerabilities / Threats // Vulnerability Management
6/12/2014
12:00 AM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

XSS Flaw In TweetDeck Leads To Spread Of Potential Exploits

Twitter unit fixes cross-site scripting problem, but not before many users spread vulnerable scripts with their tweets.

A cross-site scripting bug in Twitter's TweetDeck tool caused trouble for many users on Wednesday, and potentially opened up many other users to XSS attacks.

A researcher tweeted the vulnerability early Wednesday morning, setting off a wave of online conversation and eventually leading to downtime at TweetDeck, which is Twitter's tool for tracking online postings.

TweetDeck reported that it had fixed the vulnerability about four hours after it was reported, but subesequently took the service down to assess the damage. Service was restored less than six hours after the original vulnerability disclosure, but by that time, many users had unknowingly tweeted out code that could lead to future XSS attacks.

TweetDeck did not disclose the details of how many users were affected or the number of active exploits found to be using the vulnerability. However, it did offer a simple fix -- users need only log out of TweetDeck and log back in to close the issue. Unfortunately, many users did not see the instructions or did not follow them, leading to widespread infection.

"Tweetdeck appears to have jumped on this issue and patched it, but we’re still seeing it spread like wildfire through Twitter," said Trey Ford, global security strategist at security firm Rapid7, in a statement. "This vulnerability very specifically renders a tweet as code in the browser, allowing various XSS attacks to be run by simply viewing a tweet. The current attack we’re seeing is a 'worm' that self-replicates by creating malicious tweets. It looks like this primarily affects users of the Tweetdeck plugin for Google Chrome.

"The guidance from Tweetdeck is simple and correct – log out, and log back in," Ford advised. "One of the most common and useful XSS attacks is used to steal the user’s session, effectively enabling an attacker to log in as you. Logging out will eliminate that threat. This worm hearkens back to the MySpace 'Samy Worm' in 2006, except for one key step -- this worm does not appear to have the ability to force your account to follow the attacker."

XSS, a vulnerability which has been around for more than a decade, still accounts for more than 30 percent of online attacks, says Barry Shtieman, director of security strategy at application security vendor Imperva. "XSS -- and Persistent XSS [pXSS] in particular -- can lead to breaches, identity and credentials compromise, and even malware infection through a derived drive-by [attack] on vulnerable websites."

 

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gnuian
50%
50%
gnuian,
User Rank: Ninja
6/12/2014 | 12:00:36 PM
Browser Alternatives - Safe?
Some mention has been made of trying alternatives to the usual suspects of the web browser world (hardened Lynx (text only), WhiteHat Aviator), but let's not forget that not all web traffice goes across a browser - many applications act like web browsers on the inside and are just as exploitable through methods like XSS.  This is especially true with desktops like GNOME where just about every app I use tugs on Mozilla APIs or similar.  As long as the key web elements are there XSS can still work on the client-side as if you were using a browser.  I
mention this only because users shouldn't think because they turn to other apps to access TweetDeck they are safe.
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
6/12/2014 | 11:44:19 AM
Surprised
I was pretty surprised Tweetdeck got caught out by this to be honest. It's large enough and has been operating long enough that you'd think it would have some solid people in place to ward off problems like this.

That said, I did hear that it was to do with the heart symbol which hasn't been around long, so it was a relatively recent exploit it seems. 
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
6/12/2014 | 11:08:13 AM
Re: XSS Flaw in TweetDeck
Maybe the major retailers will learn from these incidents but you would think the Target would have been a wakeup call for all.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
6/12/2014 | 11:01:07 AM
Re: XSS Flaw in TweetDeck
Exactly correct Randy!  This is yet another example where putting secure coding first and foremost would prevent a major issue.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
6/12/2014 | 9:04:58 AM
XSS Flaw in TweetDeck
Another example of how secure coding can help all. The use of "white lists" in code can eliminate this exploit from occurring. White lists are used to only allow certain characters to be inputed into form fields and not allow characters that are normally part of XSS attacks. OWASP has information to help with this.

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#A_Positive_XSS_Prevention_Model

 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.