Twitter Visited By Worms Instead Of Bunnies

Over the weekend, a computer worm attacked the Twitter messaging service in three distinct attacks, generating almost 10,000 spam tweets -- as online posts are called in Twitter's twee terminology -- and compromising at least 190 accounts.

In a post on the Twitter blog, company co-founder Biz Stone said that no sensitive information was compromised as a result of the attacks.

The worm uses a cross-site scripting (XSS) flaw in Twitter to send spam tweets from infected accounts. The infection appears to have started when the worm's creator opened four new Twitter accounts containing the infectious code. The worm spread when Twitter users viewed the user profiles of the infected accounts.

"This is particularly nasty because you could get infected simply by viewing somebody’s profile page on Twitter that was already infected," explained developer Damon Cortesi in a blog post Saturday. "If you visited an infected profile, the JavaScript in the profile would execute and by doing so tweet the misleading link, and update your profile with the same malicious JavaScript thereby infecting anybody that then visits your profile on twitter.com."

The worm can be blocked by disabling JavaScript in your Web browser or by using the NoScript plug-in for Firefox.

The first attack struck about 2 a.m. PST on Saturday, and the Twitter security team worked to secure the service from about 7:30 a.m. PST through about 11 a.m. PST. Some 90 accounts were compromised.

The second attack struck later that afternoon. It affected about 100 accounts.

The third attack began Sunday and affected an undisclosed number of accounts.

Twitter's Stone said the company is still reviewing what happened, cleaning up, and watching for further incursions. "Every time we battle an attack, we evaluate our Web coding practices to learn how we can do better to prevent them in the future," he said. "We will conduct a full review of the weekend activities. Everything from how it happened, how we reacted, and preventative measures will be covered." Despite Stone's reassurances, Mikko Hypponen, chief researcher at F-Secure, said further attacks occurred Monday. "Twitter administrators don't seem to be able to shut down the various XSS/CSRF worms that have been plaguing the service over the weekend," he said in a blog post. "The actual problems to end users haven't been devastating -- so far. Most of the Twitter worms simply modify people's profiles to infect more users. However, attacks like these could be much worse if the attackers would incorporate nastier attacks, such as browser exploits."

Hypponen observes that the latest worm attack uses the bit.ly URL shortening service to redirect victims to an infected profile. URL shortening services like bit.ly have been criticized recently for various reasons, one of which is the security implications of disguised URLs.

Last month, Secure Science researchers Lance James and Eric Wastl said Twitter was vulnerable to a serious XSS vulnerability that could allow an attacker to hijack users' accounts or, in conjunction with other exploit code, compromise their computers.

The Twitter worm that struck over the weekend appears to make use of a different XSS vulnerability. Its code has been posted on GitHub, a collaborative programming code repository.

A post on the Secure Science blog warns that the viral effect of social networks magnifies the impact of viral computer code. "[W]hen vulnerabilities are found such as cross-site scripting, this viral effect may be easily abused and produce a detrimental outcome such as infecting account holders and possibly crashing the social network," the company said.

According to online news site BNOnews.com, a 17-year-old from Brooklyn, N.Y., identified as Mikeyy Mooney, claimed responsibility for creating the Twitter worm to drive traffic to his Web site, StalkDaily.com.

A request for comment sent to StalkDaily.com was not answered.

Attend a Webcast on why bad security breaches keep happening to good organizations. It happens Wednesday, April 15. Find out more and register.