Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Twitter Patches Account Hijacking Vulnerability

Easy-to-exploit, one-click attack caught more than 100,000 users; additional variations may still be at large.

Strategic Security Survey: Global Threat, Local Pain
(click for larger image and for full photo gallery)
Twitter users faced a virulent new JavaScript-based account hijacking attack on Monday. Simply clicking on one of the malicious links involved, disguised as innocuous-looking links in Tweets, enabled attackers to hijack a user's account and post numerous Tweets.

According to Stefan Tanase at antivirus vendor Kaspersky Lab, which discovered the attack, it "uses a cross-site scripting vulnerability to steal the cookie of the Twitter user, which is transferred to two specific servers. Essentially, any account which clicked on the malicious links is compromised."

So found numerous Twitter users on Monday. According to bit.ly, just one of the malicious links involved in the attack saw more than 116,000 clicks.

All signs point to this attack's origin -- or at least primary target -- as being Brazil, especially since one of the malicious Tweets, written in Portuguese, claimed that a leading Brazilian pop act had suffered a "tragic accident." Furthermore, the stolen cookies were copied to two domains registered under Brazilian names, and one of the sites is hosted in Brazil, said Tanase. "We are currently working on taking down the malicious URLs and minimizing the damage as much as possible."

On Tuesday, Twitter said it had patched the related vulnerability, apparently after taking the dev.twitter.com development server offline. But according to security researchers, additional variations on the vulnerability may still be at large.

This bug has legs. It was first disclosed in late July by a security researcher known as "cbr."

But the Web application vulnerability gained a fresh look on Monday after security researcher Mike Bailey crafted and released proof-of-exploit code. "These things are ridiculously easy to attack," he said, noting that his exploit had required less than 10 minutes of coding.

To help combat such attacks in the future, Twitter is beginning to implement a new link-wrapping service known as t.co, which will compare shortened links with a blacklist of known malware attacks before forwarding users on.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/27/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-05-27
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
PUBLISHED: 2020-05-27
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
PUBLISHED: 2020-05-27
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
PUBLISHED: 2020-05-27
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
PUBLISHED: 2020-05-27
IBM MobileFirst Platform Foundation stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207.