Twitter Patches Account Hijacking Vulnerability

Twitter users faced a virulent new JavaScript-based account hijacking attack on Monday. Simply clicking on one of the malicious links involved, disguised as innocuous-looking links in Tweets, enabled attackers to hijack a user's account and post numerous Tweets.

According to Stefan Tanase at antivirus vendor Kaspersky Lab, which discovered the attack, it "uses a cross-site scripting vulnerability to steal the cookie of the Twitter user, which is transferred to two specific servers. Essentially, any account which clicked on the malicious links is compromised."

So found numerous Twitter users on Monday. According to bit.ly, just one of the malicious links involved in the attack saw more than 116,000 clicks.

All signs point to this attack's origin -- or at least primary target -- as being Brazil, especially since one of the malicious Tweets, written in Portuguese, claimed that a leading Brazilian pop act had suffered a "tragic accident." Furthermore, the stolen cookies were copied to two domains registered under Brazilian names, and one of the sites is hosted in Brazil, said Tanase. "We are currently working on taking down the malicious URLs and minimizing the damage as much as possible."

On Tuesday, Twitter said it had patched the related vulnerability, apparently after taking the dev.twitter.com development server offline. But according to security researchers, additional variations on the vulnerability may still be at large.

This bug has legs. It was first disclosed in late July by a security researcher known as "cbr."

But the Web application vulnerability gained a fresh look on Monday after security researcher Mike Bailey crafted and released proof-of-exploit code. "These things are ridiculously easy to attack," he said, noting that his exploit had required less than 10 minutes of coding.

To help combat such attacks in the future, Twitter is beginning to implement a new link-wrapping service known as t.co, which will compare shortened links with a blacklist of known malware attacks before forwarding users on.